Hi Folks..
Actually I am new to this dll injection n api hooking
implementations but have zeal to learn. I wrote a small code but it is
failing in createremotethread. Can anyone help me plz..
I think
reading my unindented code would be a bit hectic. So I would like to
tell you my intention. I have written a dll called sum.dll . I have
written one exe which used this dll.
Now my I want to write one app and keep a hook in this exe and call a method
from sum.dll .
I
know that hooking kernel apis is nice try as kernel32.dll will be
loaded in the same base memory address in all processes. But as I am
trying for other Dll , I have called LoadLibrary and GetProcAdress in
exe in which I want to call.
WriteProcessmemory and
Readprocessmemory apis are working fine as I could read the data which
I have written . But execution of createremotethread is not working
fine. I copy pasted my code . Plz check it.
#include<stdio.h>
#include<conio.h>
#include<windows.h>
typedef FARPROC (__stdcall *PGetProcAddress)(HMODULE, char*);
typedef HMODULE (__stdcall *PLoadLibrary)(char *);
typedef DWORD (__stdcall *PGetLastError)();
typedef DWORD (__stdcall *sumfunc)(int , int);
struct data
{
HMODULE processHModule;
PGetProcAddress procGetProcAddress;
PLoadLibrary procLoadLibrary;
sumfunc procAddition;
char dllPath[512];
PGetLastError procGetLastError;
char lpFunctionName[256];
DWORD result;
int param1;
int param2;
DWORD procLastError1;
DWORD procLastError2;
}mydata;
void myfunc(struct data *mydata);
DWORD err;
int ret;
int main()
{
DWORD processID = 516;
DWORD SIZE_PAGE = 4096;
HANDLE processhandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID );
err = GetLastError();
LUID priviliges;
TOKEN_PRIVILEGES tkp;
HANDLE handleToken;
HANDLE processtokenhandle;
ret = OpenProcessToken(processhandle,TOKEN_ALL_ACCESS,&processtokenhandle);
err = GetLastError();
PTOKEN_GROUPS ptg = NULL;
DWORD process_token_len;
ret =
GetTokenInformation(processtokenhandle,TokenGroups,(LPVOID)ptg,0,&process_token_len);
err = GetLastError();
SetLastError(0);
ptg = (PTOKEN_GROUPS)malloc(process_token_len*sizeof(TOKEN_GROUPS));
err = GetLastError();
ret =
GetTokenInformation(processtokenhandle,TokenGroups,(LPVOID)ptg,process_token_len,&process_token_len);
err = GetLastError();
LUID luid;
TOKEN_PRIVILEGES tp;
ret = LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&luid);
err = GetLastError();
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
ret =
AdjustTokenPrivileges(processtokenhandle,false,&tp,sizeof(TOKEN_PRIVILEGES),NULL,NULL);
err = GetLastError();
void *func;
func =
VirtualAllocEx(processhandle,0,SIZE_PAGE,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
err = GetLastError();
struct data *funcdata;
funcdata = (struct data
*)VirtualAllocEx(processhandle,0,SIZE_PAGE,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
err = GetLastError();
SetLastError(0);
ret = WriteProcessMemory(processhandle,func,&myfunc,SIZE_PAGE,0);
err = GetLastError();
struct data func_data , ret_func_data;
strcpy(func_data.dllPath,"C:\\CpProj\\sumDll\\Debug\\sumDll.dll");
err = GetLastError();
strcpy(func_data.lpFunctionName,"addition");
err = GetLastError();
HMODULE hkernel32;
hkernel32 = LoadLibrary("kernel32.dll");
err = GetLastError();
func_data.procLoadLibrary = (PLoadLibrary
)GetProcAddress(hkernel32,"LoadLibraryW");
err = GetLastError();
func_data.procGetProcAddress = (PGetProcAddress
)GetProcAddress(hkernel32,"GetProcAddress");
err = GetLastError();
func_data.procGetLastError =
(PGetLastError)GetProcAddress(hkernel32,"GetLastError");
func_data.param1 = 10;
func_data.param2 = 20;
ret = WriteProcessMemory(processhandle,funcdata,&func_data,SIZE_PAGE,0);
err = GetLastError();
HANDLE thid;
DWORD rc;
thid =
CreateRemoteThread(processhandle,0,0,(LPTHREAD_START_ROUTINE)func,funcdata,0,&rc);
err = GetLastError();
rc = WaitForSingleObject(thid,5000); // even I tried keeping Infinite //instead
of 5 secs.
err = GetLastError();
ret =
ReadProcessMemory(processhandle,funcdata,&ret_func_data,sizeof(ret_func_data),0);
err = GetLastError();
return 1;
}
void myfunc(struct data *mydata)
{
mydata->processHModule = (HMODULE )(mydata->procLoadLibrary)(mydata->dllPath);
mydata->procLastError1 = (mydata->procGetLastError)();
mydata->procAddition = (sumfunc
)(mydata->procGetProcAddress)(mydata->processHModule,mydata->lpFunctionName);
mydata->procLastError2 = (mydata->procGetLastError)();
mydata->result = (mydata->procAddition)(mydata->param1,mydata->param2);
err = GetLastError();
}
Thx
--Gopi
Unlimited freedom, unlimited storage. Get it now, on
http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/
[Non-text portions of this message have been removed]
