Skip to main content

Questions tagged [injection]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
5 votes
1 answer
4k views

Hacking Lua - Introduce new functions into built Lua

I am trying to hack a game (not for cheating though) by introducing new built-in methods and functions in order to communicate with the game using sockets. Here is a small "pseudo code" example of ...
Stefan Falk's user avatar
4 votes
2 answers
625 views

How to reverse a game and inject a dll in client program?

I am trying to make a bot for a game. But when I open the game in debugger like Ollydbg or in x64dbg the game simply closes and also it doesn't appears in the Attach to the process list in File menu ...
Lftbrito's user avatar
4 votes
1 answer
2k views

Modifying address found through IDA

I'm trying to inject code into a small game I wrote to keep the health up forever, I want to do this by injecting code into the game that would set the health to 10 before each render() call, causing ...
Paradoxis's user avatar
  • 173
4 votes
0 answers
235 views

How to correctly inject a [jump + address] instruction into another process (code injection)?

I am trying to inject a jump instruction into another process (External injection), although the injection operation has been completed the address was not correct. For example: unsigned int addr = ...
Lion King's user avatar
  • 269
3 votes
2 answers
3k views

How to debug malware that injects itself into another process?

I am kind of new in the field of reverse engineering, so sorry if it is a silly question. I have to analyse some malwares for my bachelor thesis and I am currently trying to reverse engineer a ...
Paviste's user avatar
  • 33
3 votes
1 answer
2k views

ELF binary injection

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
Nazar Pasternak's user avatar
3 votes
1 answer
2k views

Detect a process for being injected with a dll [duplicate]

I'm trying to figure out how can I detect a process for being injected with a dll. I found this thread but I couldn't figure out a simple way out of it. I want to clarify my intention: given a pid - ...
Shan Pop's user avatar
3 votes
0 answers
440 views

When I start up a remote thread in an application, why does it always crash when it tries to access data in the thread structure?

I'm on OS X 10.10 64 bit (x86_64) and created a chunk of memory called code with vm_allocate. I allocate a chunk of memory for a stack. I load a library to memory and determine an entry point to ...
Div's user avatar
  • 93
3 votes
0 answers
129 views

Automating a custom QGraphicsObject control in an external QT based process

I have injected a DLL into an external application that is based on the QT framework. I, then, use the method QApplication::allWidgets() and iterate through the list of widgets to find a QGraphicsView ...
pokerguy's user avatar
2 votes
1 answer
790 views

How to analyze dumped process?

I'm trying to reverse engineer a malware which uses a Process Hollow technique. This malware uses an API hashing technique and contains some RC4 encryption algorithm references. I already knew the ...
ManJaro's user avatar
  • 55
2 votes
1 answer
491 views

Hooking IAT in remote process with Python?

I'm trying to hook a win32 function call (CreateFileW) inside of a notepad process to have the function do additional actions before returning what it should do. Ultimately, this will assist me in ...
tunemein's user avatar
2 votes
1 answer
561 views

Why is the process crashing after executing my injected payload?

I tried the following payload for APC injection in Windows. It gets executed successfully(pops up a MessageBox) but the process crashes after the execution of payload. What could be the possible ...
Jithin Pavithran's user avatar
2 votes
1 answer
222 views

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process? Are they always present at a static/preset address?
c00000fd's user avatar
  • 1,711
2 votes
1 answer
410 views

Import Address Table in Process Hollowing

I know that the PE loader is the one that is responsible for assigning addresses in a PE Import Address Table, so why when we inject code using process hollowing we don't build the IAT? We just copy ...
shon's user avatar
  • 21
2 votes
1 answer
1k views

Found a way to make any program run with the discrete Nvidia dGPU. But I need a little help to finish implementing the injection

Nvidia Optimus is a major thorn in my side. I just bought a new laptop that is using this on-the-fly gpu switching crap. This means that unless an application starts by querying the GPU for 3D tech or ...
OptimusCrime's user avatar
2 votes
0 answers
159 views

Find an address of injected code via GetModuleHandleA

I am reversing really old game (20 years old). l2.exe loads Dsetup.dll Network.dll. (not sure about order) inside of the Dsetup.dll i found and injection (kind of protection) into module Network.dll. ...
Vetal.lebed's user avatar
2 votes
2 answers
190 views

Modern methods of fuzzing/locating heap bugs and potential vulnerabilites

really glad I found this great learning resource. I was wondering, is there any way to fuzz or automate heap vulnerability assesment? I know a lot of practical frameworks for stack based fuzzing in ...
caterpillar's user avatar
2 votes
0 answers
315 views

POC for appleScript injection method

I am trying to make a POC of code injection using applescript injection technic which is used in GitHub project EasySIMBL. The method also described here. (It's basically a huge article, just search ...
Zohar81's user avatar
  • 293
2 votes
2 answers
1k views

How to debug DLL injection in IDA?

Recently, I've been cracking a crackme DLL, and I need to inject it into a process, to see if it worked. However, I've ran into a problem. I cannot seem to find how to debug DLL injection inside of ...
Verideth's user avatar
1 vote
1 answer
9k views

Inject code into exe

I don't know whether this is the right place to ask this question. I want some guide lines on this subject because I don't know how to search my problem in the internet. I want to create an ...
Ramesh-X's user avatar
  • 187
1 vote
1 answer
156 views

How to split bytes into instructions in binary ELF file for x86

I'm working on a static code injector for ELF files. I need to "steal" some bytes in order to write jump to my code on their place and then execute stolen instructions somewhere in the ...
Nazar Pasternak's user avatar
1 vote
2 answers
471 views

learning detour and code injection

i am looking to expand my knowledge so i can someday(hopefully within few months) be able to join the reverse engineering community, probably in the anti-virus/defense field. i was wondering, since ...
newB's user avatar
  • 19
1 vote
1 answer
722 views

How to inject some code to ARM .so files permanently?

I am trying to figure out how to solve the following. I have two ARM .SO libraries (32 bit and 64 bit) with the same functions. There is a method which returns const char* , it looks like this in ...
ARMResearcher's user avatar
1 vote
1 answer
2k views

How to manipulate game which loads many dll's

I am messing around with a game made with CryEngine. It's a MMORPG, but I found out that I can manipulate the X/Y/Z coordinates of my character through cheat engine. And I also found out that I can ...
QDA's user avatar
  • 27
1 vote
2 answers
359 views

Adding Features to a Released PC Game

I've just recently finished a C++ class at my university, and I'm curious about game-modding/reverse engineering. My ultimate goal is to add features that were missing from the latest version of a ...
Swamp's user avatar
  • 11
1 vote
1 answer
300 views

Converting a data address offset to the equivalent struct in a C++ module

I have an offset to a property within a player class that I need to access data from. It's made of a specific struct that I have already assembled. IDA reports the accessing offset as so: v32 = ( v3 + ...
David W's user avatar
  • 21
1 vote
1 answer
109 views

Executable code in the same location differs in memory and on disk

I'm trying to inject code to change the byte value of a CMP in an executable from 0 to 2 at runtime, in order to effectively no-op a boolean comparison as part of an effort to insert my own behavior. ...
Zatherz's user avatar
  • 21
1 vote
1 answer
691 views

Unable to call function with CreateRemoteThread

I am messing around with some dll injection/code injection. Therefore I made a little program which does nothing, but it has a function in it, which never get called and I wrote another program which ...
Peter's user avatar
  • 11
1 vote
1 answer
345 views

Question about process injection

During an analysis, I found the following piece of malware: ... lea eax, [ebp+ThreadId] push eax ;lpThreadId push ebx ;dwCreationFlags push [ebp+...
user3097712's user avatar
  • 1,541
1 vote
0 answers
140 views

what are modern hooking techniques? [closed]

i was looking at interesting anti malware roles (malware analysis and prevention) and among the required skills they mentioned that "modern hooking techniques" should be well acquainted with. i was ...
beginner's user avatar
1 vote
0 answers
77 views

Possible to inject a new menu into a program's menu bar?

Is it be possible to inject a new menu/menu item into a program's menu bar? As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
Coldblackice's user avatar
1 vote
0 answers
198 views

Tools to support Android native code hacking?

I am learning android reverse engineering, and want to know tools to hack native code. gdb to remotely debug the code, but I find it can not ever hit a breakpoint. arminject is a choice, it works on ...
Cosmore's user avatar
  • 111
1 vote
0 answers
777 views

Why does calling the original function from my hook fail?

I am trying to retrieve text from another program. I used Ollydbg to find the address for the function I need to hook to get the info. I used EasyHook to inject the code below. The hook works fine ...
Player5's user avatar
  • 11
1 vote
1 answer
761 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
bielu000's user avatar
  • 133
0 votes
3 answers
998 views

How To Identify Which Process Is Being Written To With WriteProcessMemory?

Basically, I cannot find which process is being written to when WriteProcessMemory is being called. Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
MadMax2020's user avatar
0 votes
1 answer
151 views

Why a single "nop" crashed the game?

I hope answer to my question is not game/app specific and can be answered in communities like this. So, I tried to use some internal functions of a game, like pick a target. No malicious intentions, ...
user224351's user avatar
0 votes
1 answer
496 views

Save injected code

I am analyzing a binary that is injecting code into another process (i.e., svchost.exe) to make the debugging more tedious. I can attach the new process to a debugger (e.g., ollydbg or the one ...
Engineer 007's user avatar
0 votes
1 answer
510 views

Inject into game developer's console

I want to make a program that injects a string into the game's developer's console. (Call of Duty: Modern Warfare 2 in this case) How would I approach this? Would I need to find the console's memory ...
Rikus Honey's user avatar
0 votes
1 answer
778 views

Recreating ping command injection using curl instead using web page on Huawei router

I have an ARM based Huawei router and Im trying to do injection vulnerability on page under diagnostics where's "ping" feature is. So first I tried this command -c 1 127.0.0.1 and it worked -...
Vido's user avatar
  • 515
0 votes
1 answer
307 views

Call libc functions from the payload statically injected into ELF binary

I am working on ELF-injector, which given some payload (currently it's an assembly file with .text section only) will inject it into ELF binary. I had related post here. Now I would like to make it ...
Nazar Pasternak's user avatar
0 votes
1 answer
297 views

modern instrumentation for reversing and researching [closed]

i am really glad i found this great site and wanted to ask from your expertise regarding the following issue: i have been doing malware analysis and researching for a few years, and i want to learn ...
journey's user avatar
0 votes
1 answer
2k views

Convert C/C++ function to raw bytes [closed]

I'm planning to inject a thread into another process and unfortunately I need to write the thread function in raw bytes and can't just compile it in my program and then copy it over. The thread needs ...
Forivin's user avatar
  • 209
0 votes
0 answers
27 views

PowerPC Macintosh code injection

I'm reverse engineering a game for the old PowerPC MacOS 9 pc via the static analysis in IDA Pro windows but I want to inject code during runtime(for example via the dynamic library) in an emulator ...
void_17's user avatar
  • 33
0 votes
0 answers
96 views

How to inject (a lot of) code into a running program?

I've seen a number of tutorials on changing several binary digits of an executable, like changing assembly je to jn. But what I want to add new functionalities. #include <iostream> #include <...
Gqqnbig's user avatar
  • 133
0 votes
0 answers
225 views

How can i inject xamarin smali code into another apk?

I tried to make a simple foreground service android application using xamarin... then decompile and inject it into another apk...but it always crashes. here is adb logcat : 05-31 23:57:34.158 7680 ...
akunguti's user avatar
0 votes
1 answer
304 views

Is command injection using a valid file path possible?

My question is theoretical, and not bound to python - but for the sake of simplicity, I'll use Python code snippet. Let's assume I have the following code: import os import sys if os.path.exist(sys....
macro_controller's user avatar
0 votes
1 answer
284 views

Is it possible to add a label to an ELF executable and then call that label? If so, how?

Let's say we have this simple "hello world" nasm code that will be compiled to an ELF executable: global main section .data message db "Hello World!", 0x00 section .text main: call ...
Arne's user avatar
  • 103
-1 votes
1 answer
2k views

Using cheat engine to activate a modified version of a lua script

I'm trying to hack a game. I'm a bit of a white hat hacker - only for this specific game, and only because I enjoy it. There has recently been a spate of players getting away with much more than they ...
FraserOfSmeg's user avatar
-1 votes
1 answer
175 views

PE Self Injection Not Working

I'm working on different PE Injection technique. I want to inject PE file into virtual memory of the current executable. After that, I want to execute the injected PE file, I wrote an injection code, ...
Crazy Programmer's user avatar
-1 votes
1 answer
119 views

can a stdout captured at a parameter to python script

I'm working on a CTF challenge that is find a secret password.This secret password base on the username and password that i input and the hash value had print out after hash calculation and i want to ...
y_man's user avatar
  • 1