1

I am trying to write a DLL injector to perform a DLL injector on a calculator process.

I wrote the DLL injector program in C and the DLL but the injector doesn't inject the DLL or any other DLL (I tried to take some random windows DLL that the calculator doesn't use).

#include <Windows.h>
#include <stdio.h>

int main() {
    // The DLL path we want to inject and the target process id.
    char* dllpath = "C:\\Users\\......\\Dll1.dll";
    int processID = 5844;

    printf("#### Starting ####\n");

    // Open target process handle    
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
    if (hProcess == NULL) {
        printf("[!] Unable to find the target process id: %d\n" , processID);
        return 1;
    }
    printf("[+] Open target process handle\n");

    // Getting targt memory address for the dll path
    LPVOID dllpathMemoryAddr = VirtualAllocEx(hProcess, NULL, strlen(dllpath), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (dllpathMemoryAddr == NULL) {
        printf("[!] Unable to get memory address of target process for the dllpath");
        return 1;
    }
    printf("[+] Allocate the memory address to store the dllpath\n");

    // Writing the dll path to the target memory address
    BOOL succeedWrite = WriteProcessMemory(hProcess, dllpathMemoryAddr, dllpath, strlen(dllpath), NULL);
    if (!succeedWrite) {
        printf("[!] Unable to write to the memory address of target process the dllpath\n");
        return 1;
    }
    printf("[+] Writed the dllpath to memory\n");

    // Getting LoadLibreryA address
    FARPROC loadLibAddr = GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryA");
    if (loadLibAddr == NULL) {
        printf("[!] Unable to get the memory address of LoadLibraryA function\n");
        return 1;
    }
    printf("[+] Allocate the memory address to LoadLibraryA function\n");

    // Create remote thread on the remote process to load the dll
    HANDLE rThread = CreateRemoteThread(hProcess, NULL, strlen(dllpath), (LPTHREAD_START_ROUTINE)loadLibAddr, dllpathMemoryAddr, NULL, NULL);
    if (rThread == NULL) {
        printf("[!] Unable to create thread to execute the LoadLibraryA function\n the error: %u\n", GetLastError());
        return 1;
    }
    printf("#### DLL INJECTED ####\n");


    return 0;
}

after running the injector I get this output:

#### Starting ####
[+] Open target process handle
[+] Allocate the memory address to store the dllpath
[+] Writed the dllpath to memory
[+] Allocate the memory address to LoadLibraryA function
#### DLL INJECTED ####

after that, I am still unable to see in process explorer the new DLL.

1

Your code works fine. The problem is that you're almost certainly trying to load an x86_32 DLL into an x86_64 processor, or vice versa.

I compiled your code and tested it against VLC and Notepad, and in both cases the operation succeeds when the target path is for a 64-bit DLL. Keep in mind that many "random" binaries in the System32 folder are not 64-bit even on a 64-bit OS.

The other failure case might be that you're targeting a process with an image loading policy or a binary signature policy applied, and the target DLL does not meet the requirements. The most common case is either that the DLL does not have a Microsoft signature, or the DLL file has a low integrity label applied.

| improve this answer | |
0

The problem resides in trying to use Calculator as the target for the injection - in recent Windows versions the Calculator is no longer a native Windows app, but a UWP app, which do not allow dynamic library loading of arbitrary DLLs - have a look at this answer

You have two options:

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.