55

DCoder's answer is a good one. To expand somewhat, I most often use DLL injection in the context of forcing an existing process to load a DLL through CreateRemoteThread. From there, the entrypoint of the DLL will be executed by the operating system once it is loaded. In the entrypoint, I will then invoke a routine that performs in-memory patching of all ...


38

DLL Injection works by tricking/forcing the target process into loading a DLL of your choice. After that, the code in that DLL will get executed as part of the target process and will be able to do anything the process itself can. The fun part will be to figure out how to get your code called by the target process. DLLs can be injected by: simply ...


19

Very easy, if I got you right: Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page. In Menu Debugger, Process Options, put the path to your exe into the textbox "Application", Into "input file" put the path to your DLL. Confirm with OK. Start with menu Debugger, Start Process or F9. Your breakpoint should be hit.


14

There are multiple ways that you can use which might work (and see below for the reasons why they might not). Here are two: A process can debug itself, and then it will receive notifications of DLL loading. A process can host a TLS callback, and then it will receive notifications of thread creation. That can intercept thread creation such as what is ...


13

What you're trying to do is very hard if the attacker is an experienced game hacker and the specifics of the cheat is unknown. In general if you want to inject a DLL which is harder to detect and won't show up on the module list of the process you use something called manual mapping. What this does is that it emulates the behavior of LoadLibrary without ...


8

One thing you need to keep in mind is that code in your process and the code in the target process reside in different address spaces. So any address in your program is not necessary valid in the target process and vice versa. This means the code that you inject cannot many any assumptions about addresses of functions or variables. Even your inject function'...


7

The reason why there aren't engines to hook the end of a function is because it's hard to determine where that is, or if it even exists. A function has a single entry point, but it can have multiple exit points, including none at all (consider exit()). The exit point can have multiple types, too - return, throw(), longjmp(), C++EH, etc. The general idea to ...


6

If you want to use a function in the application the bottom line is that you need to know where it's located. Without ASLR you can hardcode the address of the function into your DLL, and use a function pointer to call it. If you want to modify data from a function in a loaded library then you would need to hook that function, and call your own code for its ...


5

How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))? A process doesn't have a base offset; I believe you mean the base address of the primary module. To get that address, you would use GetModuleHandle(NULL). Is there a way to see the base offset in OllyDbg (not that useful I ...


5

Is there any way to detect from the driver that this process is protected ? Disclaimer: This following procedure depends on undocmented data structure which is extracted from PDB symbol of combase.dll file. As usual this may not work in future Windows OS version. This is the sample C code to detect protected process. The program accepts a valid process ID ...


3

how do i avoid getting detected You can't know how to avoid getting detected if you don't know how the detection works. I'd recommend finding and reverse engineering the detection logic so that you can either disable it (patch it out) or better understand how to avoid detection. That said, if you're looking for a generic alternative to "standard" DLL ...


3

please look at the following: PyDBG - it's a python wrapper around Win Debug API and much more. The framework enables one to literally inspect every aspect of the running process by registering event handlers for BPs, memory executions/reads/writes, stack inspection, etc.. You can change whatever you want in the process you are debugging. PyDBG ...


3

A much simpler approach is to identify the point at which the code has actually generated the data you need. When you find that location, replace the next several bytes with a call or an far call to your own code. Make careful note of the bytes that you are overwriting. (As an aside, I recommend a call or far call rather than a jmp so that I don't have to ...


3

Microsoft Detours makes this very easy. You'd effectively write the following code (to be safe, you'd want to make other calls such as DetourUpdateThread() as well): DetourTransactionBegin(); DetourAttach(&(PVOID&)OriginalFunction, Function); DetourTransactionCommit(); And then have code such as the following as your hook: int Function(int x) { ...


3

Patching game's executable + using loading order trick You should check the integrity of the games executable files before loading as there are way to patch it to load malicious Dll files, overlays if those were added (virus like) Check game directory for unknown dll files - strange names, dlls that mimic system library files Another thing is - some loader ...


3

You could create a loader which simply creates your target app in suspended state and loads dll into virtual address space of that process. That way the dll you injected would run before entrypoint of the target app. Example code: STARTUPINFO si; PROCESS_INFORMATION pi; ZeroMemory(&si, sizeof(STARTUPINFO)); ZeroMemory(&pi, sizeof(PROCESS_INFORMATION)...


2

Yes, it is possible. There are a couple of generic approaches you can take for detecting injected processes (not just dlls). The first is to enumerate DLLs that are injected by the OS via registry key. The two known key/value are AppCertDLL & AppInitDLLs. The second is to search for all memory that is marked as RWX and then parse out the memory for clues ...


2

At one particular instance it showed a debug error saying: "The process was not able to resume execution because the ESP value was changed", or something similar. ... typedef void(__cdecl* ChatFunc)(char*); ChatFunc Chat = (ChatFunc)0x00450C60; It sounds like the function at 0x00450C60 is not a __cdecl function and/or it doesn't take exactly one ...


2

Have you considered using the DLL only for providing "stub" methods, that you could call using CreateRemoteThread, and have the DLL methods transform the arguments into what the method you ultimately want to call takes? I know this is not really a solution to how the program detects other threads running. But with some luck, the fact that your threads ...


2

You can certainly hook dlls similarly to how you'd hook any other function. To get the address of a dll function, you'd need to call two windows APIs. First, you'll need to get the address/handle (these are the same when discussing loaded modules) of the module you're trying to hook. A simple method to get that is to call either LoadLibrary or ...


2

One way of doing this : Localize lua_gettop in your target binary with IDA (which should be called very frequently). You can get it by downloading Lua sources, and look for error messages in your target binary. You should be able to reconstruct little by little the Lua runtime by looking at XRefs of lua functions containing error messages. Hook lua_gettop, ...


2

Aphex has demo's written in Delphi with a few code injection examples. Should compile with Delphi 2007...maybe even with Delphi 7. Remote Procedure Injection InjectLibrary InjectLibraryEx CreateProcessEx Inject Executable Most examples rely on Aphex's AfxCodeHook library (with source), and this is where the heavy lifting is done. Even without a copy of ...


2

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE. From the main screen choose PE Editor and select the executable (or DLL) that you wish to modify: Then click Directories: Click the Ellipsis button next to Import Table: Right Click and choose add import: Now add your dll and ...


1

Since I cannot add a comment I will post it here: @NirIzr : Well it doesn't actually point to the end, does it? It should point to the memory where the actual byte array starts. Note that I first write the testString into the memory of my second program then the bytecode. Then I do remoteCave = (LPVOID)((DWORD)remoteString + stringlen) which should then be ...


1

I ended up placing the required code in the executable: 00C0B500 68 B6B4C000 PUSH ForgedAl.00C0B4B6 ; ASCII "lua-extension.dll" 00C0B505 FF15 88F4C000 CALL DWORD PTR DS:[<&KERNEL32.LoadLibrar> ; kernel32.LoadLibraryA 00C0B50B 68 C9B4C000 PUSH ForgedAl.00C0B4C9 ; ASCII "initialize" 00C0B510 ...


1

Yes, you can. Like this: uint32_t some_value; uint32_t ptr_to_some_value; // eax is always 32-bit void __declspec(naked) hookYCoordASM() { __asm { // #1: to get the value mov eax, [esi + 0x7C]; mov some_value, eax; // #2: to get a pointer to the value lea eax, [esi + 0x7C]; mov ptr_to_some_value, eax; ...


1

Searched the local drive for an unknown binary that uses a dll found calc.exe from gnuwin32 it uses 2 dlls calc2.dll and readline5.dll copied all 3 of them to a test directory e:\GNUWIN32\bin>cp -v calc.exe calc2.dll readline5.dll e:\test\detours\. `calc.exe' -> `e:\\test\\detours\\./calc.exe' `calc2.dll' -> `e:\\test\\detours\\./calc2.dll' `...


1

It really depends on the functions you're hooking. If they're not likely to be changed, then scanning for the bytes would be the naive solution. It should be relatively fast and work perfectly fine. If it's likely that the functions will have changed (patches, removal, different compiler/build env, etc) then you could try to find a bytestring 'signature' ...


1

I have identified the problem. It comes in two steps: 1. Use PostMessageA instead of CallWindowProc PostMessageA(hWnd, WM_COMMAND, 40003, 0) does the heavy lifting and calls the WindowProc on the desired window. 2. Make sure that the Window is Top-Level I had ignored this before because the application window was visible and I thought it was top-level. ...


1

What error you get? Try something like this: class HashClass { public: byte data[1024]; LPVOID HashFunc(float, char, char); }; typedef LPVOID (HashClass::*HASHFUNC)(float, char, char); HASHFUNC *HashFunc = (HASHFUNC *) 0xD34DB33F; void CallHashFunction() { HashClass *hashClass = new HashClass(); (*hashClass.*HashFunc)(1.0f, 'a', 'b'); ...


Only top voted, non community-wiki answers of a minimum length are eligible