Can't find injected DLL in OllyDbg

Question

I am trying to learn about injecting a DLL into a process and I wanted to simply execute a code which injects an already built DLL so that I could then check with OllyDbg if it worked.

I am using the code below for this:

LPCSTR DllPath = "E:\\testdll.dll";
GetWindowThreadProcessId(FindWindowA(0, "Calculator"), &ProcessId);
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessId);
LPVOID pDllPath = VirtualAllocEx(hProcess, 0, strlen(DllPath) + 1, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProcess, pDllPath, (LPVOID)DllPath, strlen(DllPath) + 1, 0);
HANDLE hLoadThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA("Kernel32.dll"), "LoadLibraryA"), pDllPath, 0, 0);
WaitForSingleObject(hLoadThread, INFINITE);

Apparently this worked (I have added a MessageBox inside the DLL in order to check that) but I can't find my DLL inside the 'Executable Modules' in OllyDbg. Also, the code inside the DLL keeps running even if I close the process it was injected into.

What did I do wrong?

Answer 1

After the target process is gone the code should not be running anymore, which makes me suspect you inject into a different process.

Try printing your ProcessId.

If FindWindow or GetWindowThreadProcessId fail, you'll likely end up injecting into pid 0 (the idle process). I'm a bit surprised that it works, but it would explain why your DLL code is actually executed, not visible in the calculator module list and persists even after exiting the calculator.