0

I am trying to learn about injecting a DLL into a process and I wanted to simply execute a code which injects an already built DLL so that I could then check with OllyDbg if it worked.

I am using the code below for this:

LPCSTR DllPath = "E:\\testdll.dll";
GetWindowThreadProcessId(FindWindowA(0, "Calculator"), &ProcessId);
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessId);
LPVOID pDllPath = VirtualAllocEx(hProcess, 0, strlen(DllPath) + 1, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProcess, pDllPath, (LPVOID)DllPath, strlen(DllPath) + 1, 0);
HANDLE hLoadThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA("Kernel32.dll"), "LoadLibraryA"), pDllPath, 0, 0);
WaitForSingleObject(hLoadThread, INFINITE);

Apparently this worked (I have added a MessageBox inside the DLL in order to check that) but I can't find my DLL inside the 'Executable Modules' in OllyDbg. Also, the code inside the DLL keeps running even if I close the process it was injected into.

What did I do wrong?

0

After the target process is gone the code should not be running anymore, which makes me suspect you inject into a different process.

Try printing your ProcessId.

If FindWindow or GetWindowThreadProcessId fail, you'll likely end up injecting into pid 0 (the idle process). I'm a bit surprised that it works, but it would explain why your DLL code is actually executed, not visible in the calculator module list and persists even after exiting the calculator.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.