| | |
DLL Injection - Coding the DLL C++
Please support our C++ advertiser: Intel Parallel Studio Home
![]() |
•
•
Join Date: Feb 2009
Posts: 7
Reputation:
Solved Threads: 0
Ok i've created basic DLL and DLL Injector/Loader which the DLL calls on a function called CreateRemoteThread inside the target process i was wondering how
to code DLL to read/write to memory
so e.g. lets say my target process is:
How would i code a DLL to read ''mytest'' variable and display it and also write to it e.g. changing it to lets say 10
Thanks for taking your time reading
Any tips/help would be much appreciated
/PoZ
to code DLL to read/write to memory
so e.g. lets say my target process is:
C++ Syntax (Toggle Plain Text)
int main() { int mytest = 2; system("PAUSE"); return EXIT_SUCCESS; }
Thanks for taking your time reading
Any tips/help would be much appreciated
/PoZ
Read this article
Last edited by Ancient Dragon; Mar 17th, 2009 at 1:33 am.
Don't PM me with questions -- you might get a nasty PM in response. If you have a question then post it in one of the forums.
•
•
Join Date: Feb 2009
Posts: 7
Reputation:
Solved Threads: 0
Thanks for reply but didnt quite understand 1/2 of it >.<
I've injected the process with the DLL which works fine...
I would like to read/write variables in the injected process (so il be needing to code the DLL to read/write) any chance you could show me abit of code on how it would be done?
Thanks,
PoZ
I've injected the process with the DLL which works fine...
I would like to read/write variables in the injected process (so il be needing to code the DLL to read/write) any chance you could show me abit of code on how it would be done?
Thanks,
PoZ
>>any chance you could show me abit of code on how it would be done?
Nope --but possibly the windows debug api might be useful
Nope --but possibly the windows debug api might be useful
Last edited by Ancient Dragon; Mar 17th, 2009 at 11:17 am.
Don't PM me with questions -- you might get a nasty PM in response. If you have a question then post it in one of the forums.
•
•
Join Date: Feb 2009
Posts: 7
Reputation:
Solved Threads: 0
•
•
•
•
>>any chance you could show me abit of code on how it would be done?
Nope --but possibly the windows debug api might be useful
C++ Syntax (Toggle Plain Text)
#include <windows.h> #include <tlhelp32.h> #include <shlwapi.h> #include <conio.h> #include <stdio.h> #define WIN32_LEAN_AND_MEAN #define CREATE_THREAD_ACCESS (PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ) BOOL Inject(DWORD pID, const char * DLL_NAME); DWORD GetTargetThreadIDFromProcName(const char * ProcName); int main(int argc, char * argv[]) { // Retrieve process ID DWORD pID = GetTargetThreadIDFromProcName("notepad.exe"); // Get the dll's full path name char buf[MAX_PATH] = {0}; GetFullPathName("Project1.dll", MAX_PATH, buf, NULL); printf(buf); printf("\n"); // Inject our main dll if(!Inject(pID, buf)) { printf("DLL Not Loaded!"); }else{ printf("DLL Loaded!"); } _getch(); return 0; } BOOL Inject(DWORD pID, const char * DLL_NAME) { HANDLE Proc; HMODULE hLib; char buf[50] = {0}; LPVOID RemoteString, LoadLibAddy; if(!pID) return false; Proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID); if(!Proc) { sprintf(buf, "OpenProcess() failed: %d", GetLastError()); //MessageBox(NULL, buf, "Loader", MB_OK); printf(buf); return false; } LoadLibAddy = (LPVOID)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA"); // Allocate space in the process for our DLL RemoteString = (LPVOID)VirtualAllocEx(Proc, NULL, strlen(DLL_NAME), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); // Write the string name of our DLL in the memory allocated WriteProcessMemory(Proc, (LPVOID)RemoteString, DLL_NAME, strlen(DLL_NAME), NULL); // Load our DLL CreateRemoteThread(Proc, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, NULL, NULL); CloseHandle(Proc); return true; } DWORD GetTargetThreadIDFromProcName(const char * ProcName) { PROCESSENTRY32 pe; HANDLE thSnapShot; BOOL retval, ProcFound = false; thSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if(thSnapShot == INVALID_HANDLE_VALUE) { //MessageBox(NULL, "Error: Unable to create toolhelp snapshot!", "2MLoader", MB_OK); printf("Error: Unable to create toolhelp snapshot!"); return false; } pe.dwSize = sizeof(PROCESSENTRY32); retval = Process32First(thSnapShot, &pe); while(retval) { if(StrStrI(pe.szExeFile, ProcName)) { return pe.th32ProcessID; } retval = Process32Next(thSnapShot, &pe); } return 0; }
DLL code (Coded in C++): its at home im currently at college >.< il post that later basically what it does it CreateRemoteThread in the process and produces a messagebox saying that remotethread is sucessfull
Going to read that link you send me ^.^ thank you for your help again
/PoZ
Last edited by PoZHx; Mar 17th, 2009 at 11:27 am.
•
•
Join Date: Feb 2009
Posts: 7
Reputation:
Solved Threads: 0
Also read that link you send me Ancient Dragon ... it didn't cover what i was needing (well i don't think) >.< but thanks alot for trying mate
DLL Code:
Dllmain.cpp:
All these code work fine... just wanting to read/write process memory from injected process so e.g.
DLL Loader: Injector.exe
DLL: Project1.dll
Target: Test.exe
i want the Project1.dll to able to read variables from Test.exe so lets say Test.exe has variable such as int tcode = 10;
i want the DLL to be able to read/write to the variable "tcode".
DLL Code:
Dllmain.cpp:
C++ Syntax (Toggle Plain Text)
/* Replace "dll.h" with the name of your header */ #include "dll.h" #include <windows.h> #include <stdio.h> #include <stdlib.h> DWORD WINAPI MyFunction1(LPVOID pData) { int temp = 10, *test; MessageBox(NULL,"Remote Thread was created!", "Successful Injection" ,NULL); return 1; } BOOL APIENTRY DllMain (HINSTANCE hInst /* Library instance handle. */ , DWORD reason /* Reason this function is being called. */ , LPVOID reserved /* Not used. */ ) { switch (reason) { case DLL_PROCESS_ATTACH: HANDLE hThread; // Thread handle DWORD nThread; // Thread ID //Try to create a new thread (which will run my function()) if((hThread = CreateThread(NULL, 0, MyFunction1, NULL, 0, &nThread)) != NULL) { // Close handle CloseHandle(hThread); } break; case DLL_PROCESS_DETACH: MessageBox(NULL,"Project1.dll detached to Process!", "Successful Injection" ,NULL); break; case DLL_THREAD_ATTACH: break; case DLL_THREAD_DETACH: break; } /* Returns TRUE on success, FALSE on failure */ return TRUE; }
All these code work fine... just wanting to read/write process memory from injected process so e.g.
DLL Loader: Injector.exe
DLL: Project1.dll
Target: Test.exe
i want the Project1.dll to able to read variables from Test.exe so lets say Test.exe has variable such as int tcode = 10;
i want the DLL to be able to read/write to the variable "tcode".
![]() |
Other Threads in the C++ Forum
- Previous Thread: Help auto adjust command
- Next Thread: Resizing created screen shot
| Thread Tools | Search this Thread |
api array based beginner binary c++ c/c++ calculator char char* class classes code compile compiler console conversion count delete deploy desktop directshow dll download dynamic dynamiccharacterarray email encryption error file forms fstream function functions game givemetehcodez google graph gui homeworkhelp homeworkhelper iamthwee ifstream input int integer java lib linkedlist linker linux list loop looping loops map math matrix memory news node numbertoword output parameter pointer problem program programming project python random read recursion recursive reference return rpg sorting string strings struct temperature template templates test text text-file tree unix url variable vector video visualstudio win32 windows winsock word wordfrequency wxwidgets






