DLL injector in C doesn't inject the DLL

Question

I am trying to write a DLL injector to perform a DLL injector on a calculator process.

I wrote the DLL injector program in C and the DLL but the injector doesn't inject the DLL or any other DLL (I tried to take some random windows DLL that the calculator doesn't use).

#include <Windows.h>
#include <stdio.h>

int main() {
    // The DLL path we want to inject and the target process id.
    char* dllpath = "C:\\Users\\......\\Dll1.dll";
    int processID = 5844;

    printf("#### Starting ####\n");

    // Open target process handle    
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
    if (hProcess == NULL) {
        printf("[!] Unable to find the target process id: %d\n" , processID);
        return 1;
    }
    printf("[+] Open target process handle\n");

    // Getting targt memory address for the dll path
    LPVOID dllpathMemoryAddr = VirtualAllocEx(hProcess, NULL, strlen(dllpath), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (dllpathMemoryAddr == NULL) {
        printf("[!] Unable to get memory address of target process for the dllpath");
        return 1;
    }
    printf("[+] Allocate the memory address to store the dllpath\n");

    // Writing the dll path to the target memory address
    BOOL succeedWrite = WriteProcessMemory(hProcess, dllpathMemoryAddr, dllpath, strlen(dllpath), NULL);
    if (!succeedWrite) {
        printf("[!] Unable to write to the memory address of target process the dllpath\n");
        return 1;
    }
    printf("[+] Writed the dllpath to memory\n");

    // Getting LoadLibreryA address
    FARPROC loadLibAddr = GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryA");
    if (loadLibAddr == NULL) {
        printf("[!] Unable to get the memory address of LoadLibraryA function\n");
        return 1;
    }
    printf("[+] Allocate the memory address to LoadLibraryA function\n");

    // Create remote thread on the remote process to load the dll
    HANDLE rThread = CreateRemoteThread(hProcess, NULL, strlen(dllpath), (LPTHREAD_START_ROUTINE)loadLibAddr, dllpathMemoryAddr, NULL, NULL);
    if (rThread == NULL) {
        printf("[!] Unable to create thread to execute the LoadLibraryA function\n the error: %u\n", GetLastError());
        return 1;
    }
    printf("#### DLL INJECTED ####\n");


    return 0;
}

after running the injector I get this output:

#### Starting ####
[+] Open target process handle
[+] Allocate the memory address to store the dllpath
[+] Writed the dllpath to memory
[+] Allocate the memory address to LoadLibraryA function
#### DLL INJECTED ####

after that, I am still unable to see in process explorer the new DLL.

Answer 1

Your code works fine. The problem is that you're almost certainly trying to load an x86_32 DLL into an x86_64 processor, or vice versa.

I compiled your code and tested it against VLC and Notepad, and in both cases the operation succeeds when the target path is for a 64-bit DLL. Keep in mind that many "random" binaries in the System32 folder are not 64-bit even on a 64-bit OS.

The other failure case might be that you're targeting a process with an image loading policy or a binary signature policy applied, and the target DLL does not meet the requirements. The most common case is either that the DLL does not have a Microsoft signature, or the DLL file has a low integrity label applied.

Answer 2

The problem resides in trying to use Calculator as the target for the injection - in recent Windows versions the Calculator is no longer a native Windows app, but a UWP app, which do not allow dynamic library loading of arbitrary DLLs - have a look at this answer

You have two options:

• Modify the DLL permissions to allow loading into any UWP package
• Try injecting into notepad for instance, this is a native executable and you should have no issues.