DLL Injection search for procedures/variables

Question

I am learning DLL injection basics and different techniques to achieve it, like using CreateProcess and LoadLibrary for example, or simply replacing a .dll in folder where the application to inject into resides. I was able to perform some basic tasks after having loaded the .dll into application's memory space like invoking a MessageBox on DLLEntry and some others. But how can one manipulate with the code of the application itself, eg. calling a certain procedure that is part of the application, or simply modifying a variable? Most tutorials I have read online discuss only injection process itself, but not the actual manipulations with applications. Or at least I am having trouble finding that information.

So, how to find/extract the memory parts of the application you are interested in and then modify/alter them?

Answer 1

If you want to use a function in the application the bottom line is that you need to know where it's located. Without ASLR you can hardcode the address of the function into your DLL, and use a function pointer to call it. If you want to modify data from a function in a loaded library then you would need to hook that function, and call your own code for its operations.

If an application's function is at 0x0041A000 you can create a function pointer if you know all the information about the function; the call convention, return value, and parameters. Assume it's a __stdcall, two VOID *parameters, and returns a DWORD.

typedef DWORD (WINAPI *FunctionType)(VOID *a, VOID *b);

DllEntry(...)
{
    FunctionType function = (FunctionType) 0x0041A000;

    function(your_param1, your_param2);
}

You can also hook that function by using the Windows Detours library. Again you would hardcode the address of the function you want to hook, and write your own version of the function. You need to make sure that it returns the same type of value as the real function to ensure nothing breaks in the calling function. Using GetProcAddress you can hook a function call of a library rather than the application's function.

This all gets complicated with ASLR. As the application might not be at the location you think it is. This answer can help with the calculations of certain sections determined by the base address of the program.

Modifying global variables is the same kind of deal. You'll need to find their offset in the program. You can then create pointer to that memory address for manipulating it.