[Source] DLL Injection

tarafından **Hello EMO** C.tesi Ara. 04, 2010 1:21 pm

This codes shows how DLL injection works.
A dll will be injected into the Windows calculator which will beep until the calculator will be closed. Smile

Injector Code:

Kod:: #include <windows.h> typedef HINSTANCE (*fpLoadLibrary)(char*); int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow ) { HANDLE hProc; LPVOID paramAddr; HINSTANCE hDll; DWORD id; HWND hProcWnd = FindWindow(0, "Calculator"); GetWindowThreadProcessId(hProcWnd, &id); hDll = LoadLibrary("KERNEL32"); fpLoadLibrary LoadLibraryAddr = (fpLoadLibrary)GetProcAddress(hDll, "LoadLibraryA"); char* dll_path = "D:\Programme\Microsoft Visual Studio\MyProjects\mydll\Release\mydll.dll"; hProc = OpenProcess(PROCESS_ALL_ACCESS, false, id); paramAddr = VirtualAllocEx(hProc, 0, strlen(dll_path)+1, MEM_COMMIT, PAGE_READWRITE); WriteProcessMemory(hProc, paramAddr, dll_path, strlen(dll_path)+1, NULL); CreateRemoteThread(hProc, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryAddr, paramAddr, 0, 0); CloseHandle(hProc); return 0; }

To test this, I prepared a simple dll code for you:

Kod:: HANDLE ThreadHandle; DWORD threadId = 0; DWORD WINAPI my_thread(void *par); BOOL APIENTRY DllMain (HINSTANCE hInst, DWORD reason, LPVOID reserved) { switch (reason) { case DLL_PROCESS_ATTACH: Beep(1000, 1000); ThreadHandle = CreateThread(0, 0x1000, &my_thread, 0, 0, &threadId); break; case DLL_PROCESS_DETACH: break; case DLL_THREAD_ATTACH: break; case DLL_THREAD_DETACH: break; } return TRUE; } DWORD WINAPI my_thread(void *par) { while(true) { Beep(2000, 100); Sleep(1000); } }