We changed our privacy policy. Read more.

Questions tagged [dll-injection]

DLL Injection is a method of code injection in a Microsoft Windows environment.

Filter by
Sorted by
Tagged with
66
votes
2answers
41k views

What is DLL Injection and how is it used for reversing?

I was reading a discussion about dumping a processes part of a process's memory and someone suggested using DLL injection to do this. I'll be honest in that I don't really understand. How does DLL ...
20
votes
4answers
44k views

How can DLL injection be detected?

In this question on DLL injection multiple answers mention that DLL injection can be used to modify games, perhaps for the purposes of writing a bot. It seems desirable to be able to detect DLL ...
13
votes
1answer
32k views

How to debug the DLL of an EXE using IDA Pro?

I'm fairly new to the RE world, started right around a week and have gotten my hands dirty with some really good stuff on this website. Pardon my naive knowledge. Currently, I'm trying to reverse a ...
10
votes
1answer
5k views

Dll injection and GetProcAddress with the winapi

So i just read a little bit about how one would go about for injecting a dll into a running program on Wikipedia (the CreateRemoteThread idea). I followed the steps described and eventually got it ...
8
votes
3answers
5k views

Hook end/middle of function

How could I hook anywhere but the beginning of a function? I'm trying to add features to a third party executable, and I need it to execute it's code completely, then pass its data onto my function. I ...
8
votes
1answer
904 views

Red Alert 2 Windows 8 DirectDraw compatibility

The game Red Alert 2 runs on Windows 8, but as soon as I inject a DLL (via ddraw.dll or an extra DLL) it stops drawing buttons on the main menu. With the DLL it still work fine in windowed mode and it ...
5
votes
1answer
2k views

DLL Injection search for procedures/variables

I am learning DLL injection basics and different techniques to achieve it, like using CreateProcess and LoadLibrary for example, or simply replacing a .dll in folder where the application to inject ...
5
votes
1answer
791 views

Microsoft Edge and it's related processes may have turned protected in windows 10 1903

It seems like driver based injection using APC calls fails on MicrosoftEdge and it's related processes (browser_broker.exe , MicrosoftEdgeCP.exe and MicrosoftEdge.exe). Looking into the problem, it ...
4
votes
1answer
3k views

Patching a string using DLL injection and OllyDbg

I'm a novice when it comes to RE but I'm trying to get into it. I have a background in C/C++ so doing the development side of things should be a breeze (aside from when assembly has to be used, im ...
4
votes
1answer
6k views

API hooking using DLL injection with Python C-Types

I'd like to write something using Python C-Types that hooks API calls and can be leveraged for unpacking executables. Currently my (Python with C-Types) code launches an executable in a suspended ...
4
votes
1answer
3k views

Hacking Lua - Introduce new functions into built Lua

I am trying to hack a game (not for cheating though) by introducing new built-in methods and functions in order to communicate with the game using sockets. Here is a small "pseudo code" example of ...
3
votes
2answers
970 views

Permanently load a DLL to an executable

With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger. I've learnt that ...
3
votes
2answers
2k views

Extracting HTTPS packets before encryption

Say we have a Windows application, which sends some packets over HTTPS. We need to extract the content of this packets (unencrypted of course). There is no way to get hands on server private ...
3
votes
1answer
273 views

DLL Injection Call Address In Target

I have an address that is located in a dll loaded by my target process. I would like to call this address using dll injection. For now my dll looks like this: BOOL APIENTRY DllMain(HMODULE hModule, ...
3
votes
2answers
487 views

Simulate Windows menu item activation

I am trying to shortcut the call to a procedure that is activated when clicking on a menu item. I injected a DLL on the process that creates this window with the menu bar. I used Spy++ from ...
2
votes
2answers
3k views

How to inject a DLL without being detected?

I understand that DLL injection can be used to modify games, perhaps for the purposes of writing a bot. Last time i injected a DLL, it was detected. My injection method must have been detectable then, ...
2
votes
3answers
218 views

How can I view the output of printf calls without a console window?

I'm using IDA to poke around in an old video game and noticed there are lots of calls to the printf function: I can see in another function that dword_5CE914 is a bitmask comprising various startup ...
2
votes
1answer
58 views

Are offsets within a loaded dll always the same relative to each other?

If I load a dll in 2 different processes, will the offsets calculations within one process hold for the other process? I'm currently trying to patch the import table of a dll, once injected into a ...
2
votes
2answers
305 views

How to decompile "call eax" in IDA Pro?

I know that there is a similar question but the answers didn't provide any fix for that problem. I am decompiling a .dll file, and I have found out the subroutine that I needed, but it's throwing a "...
2
votes
1answer
170 views

Avoid program detecting a thread being used [closed]

I'm writing a DLL for a program that needs to run in an infinite loop (with delays, of course). For example: while (true) { std::cout << "I am running.\n"; Sleep(1000); } I'm not sure ...
2
votes
1answer
352 views

dll injection (assembly code)

I need some tip to undrestand what is the best way to execute external code from DLL or command line. I like to add the force feedback support to different games that not support it. I can write a DLL ...
2
votes
1answer
860 views

DLL Injection does not work twice

I created a program that performs DLL injection. It does that by opening the process with OpenProcess, writes the DLL path to the process and creates a remote thread with CreateRemoteThread with the ...
2
votes
1answer
91 views

What is an easy way to update the addresses of hooked functions in an exe

I have hooked into some functions in an exe. I was wondering if there were any simple ways to detect the memory addresses of these functions after the exe has a new build (not my exe). Is the best way ...
2
votes
0answers
885 views

Dll Injection into QT application

I'm pretty new to this stuff, so please excuse me if anything I ask is kinda stupid. I'm trying to inject a DLL into a QT application and call some of the QT functions. I got the injection working ...
1
vote
1answer
101 views

Why does reflective dll injection need to perform loading in the target process?

I'm not sure i understand reflective loading. An injector process allocates memory in the target, writes a stub and the dll binary to be loaded, and the stub calls ReflectiveLoad in that binary. ...
1
vote
1answer
70 views

advapi32.dll changes name of function during forwarding of exports

Im trying myself at writing a manual mapper, for injection of DLLs into other processes. Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another ...
1
vote
1answer
219 views

Hiding a file in a Windows operating system

I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis. What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
1
vote
2answers
147 views

learning detour and code injection

i am looking to expand my knowledge so i can someday(hopefully within few months) be able to join the reverse engineering community, probably in the anti-virus/defense field. i was wondering, since ...
1
vote
1answer
1k views

How to manipulate game which loads many dll's

I am messing around with a game made with CryEngine. It's a MMORPG, but I found out that I can manipulate the X/Y/Z coordinates of my character through cheat engine. And I also found out that I can ...
1
vote
1answer
783 views

Cannot call function (properly) in C++

I am developing a DLL for the purpose of injecting it into a running process for a game. I've found the memory addresses to some key functions(via Immunity Debugger) and I am trying to call those ...
1
vote
1answer
90 views

Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
1
vote
1answer
238 views

Is it possible to hijack a C++ DLL after it has been loaded into the memory space? How?

I have a .Net application, in which a C++ DLL is embedded as a resource into the application. When the .Net application is running, I will extract the C++ DLL to a temporary folder, and after that, ...
1
vote
1answer
364 views

Finding lua C functions compiled binary

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am ...
1
vote
1answer
565 views

Unable to call function with CreateRemoteThread

I am messing around with some dll injection/code injection. Therefore I made a little program which does nothing, but it has a function in it, which never get called and I wrote another program which ...
1
vote
1answer
334 views

What is the quickest way to run code of my own DLL?

Not sure if the title is that telling but what I want to do is hack into an executable and do as little as necessary to get the code from my DLL running since I want to write as few lines of assembly ...
1
vote
1answer
675 views

Call a thiscall method from an injected DLL [closed]

I am trying to create a (32-bit) DLL to inject into a target process. My DLL should call a function inside the original process. So far nothing special, however the target function is using the ...
1
vote
1answer
140 views

Return by Value/Call by Value internals

Good evening, fellow experts. I'm fiddling around with something and right now I'm stuck. I want to modify the behaviour of an application (Windows 7, 64bit). Therefore, I inject a DLL into the ...
1
vote
0answers
76 views

what are modern hooking techniques? [closed]

i was looking at interesting anti malware roles (malware analysis and prevention) and among the required skills they mentioned that "modern hooking techniques" should be well acquainted with. i was ...
1
vote
0answers
160 views

Detouring with Unreal Engine 4, importing exe functions

I'm not sure that this is the right SO community to be asking this in, but I thought I'd give it a try. Some friends and I have successfully detoured a game built with UE4 by loading a modified ...
1
vote
0answers
362 views

Get DLL from EXE file [duplicate]

I am trying to reverse engineer an DLL that is loaded from a EXE. I don't have the DLL file. I just have an executable file that injects the DLL into a certain process. When I try using ollydbg or ...
1
vote
0answers
402 views

Resources for API Hooking and DLL Injection

What are great resources and essential skills needed to become a proficient reverse engineer regarding API Hooking and DLL Injection? I would like to use a comprehensive book instead of scattered ...
1
vote
1answer
73 views

Why address space is different for Ghidra, IDA and xDebug runtime and which one to use?

I have opened an executable with Ghidra, IDA and x64dbg (runtime). It seems that the address space in IDA and x64dbg is the same, but it is different from the one I see in Ghidra. When hooking through ...
0
votes
1answer
225 views

Modifying program using IDA/Hexrays decompilation pseudocode

A bit long-winded, apologies in advance. Updates to the question are at the end. I'm experimenting with hooking functions in a program & modifying them based on the decompilation pseudocode from ...
0
votes
3answers
1k views

In Memory DLL Injection

I am currently working on learning how different types of DLL injection can be performed. Right now I am able to run a function by: Opening the remote process; Allocating memory in remote process; ...
0
votes
1answer
51 views

Call libc functions from the payload statically injected into ELF binary

I am working on ELF-injector, which given some payload (currently it's an assembly file with .text section only) will inject it into ELF binary. I had related post here. Now I would like to make it ...
0
votes
1answer
278 views

best approach to hook function

I have found 2 source code example to hook a function. Example1: #include "detours.h" #include "sigscan.h" // this is the function that the program // will jump to when sum() is ...
0
votes
1answer
255 views

Loading a PE32 executable DLL Intel 80386 into a c# program

I'm new here so I'm sorry if this isn't the right section for my question. I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
0
votes
1answer
56 views

Get string from function and pass it to another program

I want to make a small tool that analyzes text from console in online game and I'm stuck at reading a string from a function and sending it to another program. I managed to find function that takes ...
0
votes
1answer
158 views

Possible to hook an address and directly write to it?

I am reversing a game for fun and currently use this function to manipulate the Y coordinate: void __declspec(naked) hookYCoordASM() { __asm { mov eax, valueY mov [esi + 0x7C], ...
0
votes
1answer
1k views

Reverse Engineering Exported DLL Function

I am trying to read the arguments sent to an external dll file "FlashToolLib.dll". My hook function is never triggered, I am guessing because I have the address wrong. I have tried the address in ...