63
DCoder's answer is a good one. To expand somewhat, I most often use DLL injection in the context of forcing an existing process to load a DLL through CreateRemoteThread. From there, the entrypoint of the DLL will be executed by the operating system once it is loaded. In the entrypoint, I will then invoke a routine that performs in-memory patching of all ...
43
DLL Injection works by tricking/forcing the target process into loading a DLL of your choice. After that, the code in that DLL will get executed as part of the target process and will be able to do anything the process itself can. The fun part will be to figure out how to get your code called by the target process.
DLLs can be injected by:
simply ...
31
Note: I am assuming 32bit x86 on Windows, your question unfortunately doesn't state for certain. But since it's Windows and you don't explicitly mention x64 this was the sanest assumption I could make.
First off, try to search for the function names with a search engine. Don't just settle for a single search engine. Failing that, inspect whatever came in ...
25
This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), each thunk being a relative jump (E9 xx xx xx xx) to a function.
All function calls in the binary are redirected to the corresponding ILT instead of pointing ...
21
Very easy, if I got you right:
Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page.
In Menu Debugger, Process Options, put the path to your exe into the textbox "Application", Into "input file" put the path to your DLL. Confirm with OK.
Start with menu Debugger, Start Process or F9.
Your breakpoint should be hit.
16
What you're trying to do is very hard if the attacker is an experienced game hacker and the specifics of the cheat is unknown.
In general if you want to inject a DLL which is harder to detect and won't show up on the module list of the process you use something called manual mapping. What this does is that it emulates the behavior of LoadLibrary without ...
16
There are multiple ways that you can use which might work (and see below for the reasons why they might not). Here are two:
A process can debug itself, and then it will receive notifications of DLL loading.
A process can host a TLS callback, and then it will receive notifications of thread creation. That can intercept thread creation such as what is ...
16
Let me start by telling you that what you want would be impossible, because of how well-known DLLs work. You can attempt something similar with tools like PEBundle or dllpackager, but that will usually (I'd say certainly) fail with the well-known DLLs (such as system DLLs as well as even the MSVC runtime DLLs in their different incarnations). See this and ...
15
The Windows kernel, unlike Linux or OS X, does not use consistent syscall numbering across versions. The numbers can change even after a servicepack release. For example, the NtReadFile syscall was 0x0086 on Windows NT 4 but on Windows 7 it's 0x0111 (see here for the full list).
That's why all proper programs use the kernel32.dll (or ntdll.dll) to perform ...
14
Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code
https://github.com/0xd4d/dnSpy
Main difference from ILSpy :
Uses dnLib to read assemblies (vs ILSpy's Mono.Cecil)
https://github.com/0xd4d/dnlib
dnlib was created because de4dot needed a robust .NET ...
13
Both, DllMain and DllEntryPoint are merely symbolic names of the same concept. They even share the same prototype. But they aren't the same:
The function must be defined with the __stdcall calling convention.
The parameters and return value must be defined as documented in the
Win32 API for WinMain (for an .exe file) or DllEntryPoint (for a DLL).
It ...
12
DllEntryPoint - is the address from which the execution will start (but does not have to if we are speaking about malware) after the loader had finished the loading process of the PE image. This address is specified inside the PE optional header. Please look here. The other name for DllEntryPoint is AddressOfEntryPoint.
DllMain - is the default function ...
11
I think you have 4 options here:
Overwrite the function in assembler using OllyDbg, IDA Pro or any other tool. However, you may not have enough space.
Insert a jmp to another place where you have enough space to do this. You will likely need to find for "holes" between sections where you can put your code.
Add a new section to the PE/ELF file, mark it as ...
11
Debug Symbol information is often "stripped off" from C++ binaries. Symbol information stores all user-created names, symbols, and types, bounds, fouction boundary and other function related metadata information (it is generally stored according to a popular and standardized "dwarf" format which is widely used and employed in modern ...
10
If the previously suggested resource editors aren't to your liking, you can find descriptions and reviews of several resource editors here: http://www.woodmann.com/collaborative/tools/index.php/Category:Resource_Editors
In case you have trouble accessing that page (as per the comments below), here is the list of resource editors as of 6/26/13:
PE Explorer
...
9
One thing you need to keep in mind is that code in your process and the code in the target process reside in different address spaces. So any address in your program is not necessary valid in the target process and vice versa.
This means the code that you inject cannot make any assumptions about addresses of functions or variables. Even your inject function'...
9
Would this driver exist in user space, or in kernel space?
Kernel space.
Is it even possible for a non kernel mode driver to exist?
You can write a user-mode driver using the User-Mode Driver Framework, but that type of driver is effectively a user-mode service with access to some extra I/O functionality.
What we typically think of as a "driver" is a ...
9
If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls.
This way you can limit the amount of pages that need updating when a new dll get loaded. Which lets the calling code be position independent with regards to the call target. Calls to external function are sent to that page and forwarded to ...
8
A dynamically linked library has the same executable header and structure as a standard executable. Therefore they can be debugged the same way that a normal executable can be debugged. It might be a bit tricker than usual, because in order to debug it, it has to be loaded into some process, and making that happen could be trivial (i.e. if it's loaded as ...
8
The surprising part for me is objdump can recognize anything in a PE file. According to Wikipedia,
.. PE is a modified version of the Unix COFF file format. PE/COFF is an alternative term in Windows development.
so apparently there is just enough overlap in the headers to make it work (at least partially). The basic design of one is clearly based on the ...
7
Question 1: What is causing these bytes to change?
These appear to be standard relocation fixups applied based on the DLL's Relocation Table.
Sub-question 1.1: Is is some sort of protection mechanism?
No.
Sub-question 1.2: Was it recently introduced?
No.
Sub-question 1.3: Can it be disabled?
Not easily, no.
Question 2: What do these changing ...
7
These are Unicode characters that are not supported by the font used by dnSpy.
Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian in their code. But yeah, usually obfuscation.
You can try to deobfuscate this .Net binary by using de4dot which is doing an incredible job with deobfuscating ...
6
Manually, i prefer to observe the following signs in the PE header:
1- Presence of mscoree!_CorExeMain in the import table.
2- VirtualAddress and Size of the CLR Header/*Com Descriptor* data directory are set. Size set to 0x48.
3- Size of the Base Relocation data directory set to 0x0C i.e. Only one fixup.
Also, one minor sign is:
4- SectionAlignment set ...
6
First thing that comes to mind is the following approach
Using your favourite debugger/disassembler locate the function and note down some unique byte pattern which identifies the function (Sort of like IDA's Flirt signatures)
Get a handle to the DLL (GetModuleHandleA)
Get the image size (from MODULEINFO.SizeOfImage using GetModuleInformation)
Search for ...
6
If you want to use a function in the application the bottom line is that you need to know where it's located. Without ASLR you can hardcode the address of the function into your DLL, and use a function pointer to call it. If you want to modify data from a function in a loaded library then you would need to hook that function, and call your own code for its ...
6
You can use OllyDbg's loaddll.exe to load a DLL and call (and debug) its functions:
6
TLDR: No, no and no.
You have several questions hiding there in your post:
Is is possible to inject a DLL into each and every process?
If it is possible, can the following methods do that:
SetWindowsHookEx?
AppInit_Dlls?
The answer to the first question is "no".
The answer to both parts of the second question is "no, even if the answer to the first ...
6
Your faux function is not fixing up the stack on the epilog of the function. It should have
pop ds
pop bp
dec bp
at the end by the calling convention.
If you look at the original function it fixes up the stack correctly.
Let's say the stack pointer had the value of 1000h coming into the function (after CS:IP is already pushed on the stack for the far ...
6
In case you know the address of your function in the DLL you can call in "C" language via a function pointer. Let us make an example:
Assume you have a function residing in a DLL called "notExportedFunc" with the signature
int notExportedFunc(int a, int b);
You could call it like in the following main program:
typedef int notExportedFunc(int a, int b);
...
5
To actually force a DLL to load at a particular address without making structural changes to it first, you need to allocate all of the rest of available memory first, and of course, ensure that the target location isn't in use already.
To disable ASLR for any given file, you have to set the IMAGE_FILE_RELOCS_STRIPPED flag in the Characteristics field of the ...
Only top voted, non community-wiki answers of a minimum length are eligible
