Only the injection method:
Procedure.i InjectLibrary(ProcessID.l, DLLPath.s) Define ProcessHandle.l Define StartAddress.l Define BufferSize.i Define ParamAddress.l Define ThreadHandle.l ProcessHandle = OpenProcess_(#PROCESS_ALL_ACCESS,#False,processID) If ProcessHandle = 0 ProcedureReturn -1 EndIf StartAddress = GetProcAddress_(GetModuleHandle_("kernel32.dll"), "LoadLibraryA") If StartAddress = 0 ProcedureReturn -1 EndIf BufferSize = Len(DLLPath) + 1 ParamAddress = VirtualAllocEx_(ProcessHandle, 0, BufferSize, #MEM_COMMIT, #PAGE_READWRITE) If ParamAddress = 0 ProcedureReturn -1 EndIf If Not WriteProcessMemory_(ProcessHandle, ParamAddress, DLLPath, BufferSize, 0) ProcedureReturn -1 EndIf ThreadHandle = CreateRemoteThread_(ProcessHandle, 0, 0, StartAddress, ParamAddress, 0, 0) WaitForSingleObject_(ThreadHandle, #INFINITE) If ParamAddress <> 0 VirtualFreeEx_(ProcessHandle, ParamAddress, 0, #MEM_RELEASE) Else ProcedureReturn -1 EndIf CloseHandle_(ProcessHandle) ProcedureReturn 0 EndProcedure
Complete with Example:
injector.pb
Procedure.i InjectLibrary(ProcessID.l, DLLPath.s) Define ProcessHandle.l Define StartAddress.l Define BufferSize.i Define ParamAddress.l Define ThreadHandle.l ProcessHandle = OpenProcess_(#PROCESS_ALL_ACCESS,#False,processID) If ProcessHandle = 0 ProcedureReturn -1 EndIf StartAddress = GetProcAddress_(GetModuleHandle_("kernel32.dll"), "LoadLibraryA") If StartAddress = 0 ProcedureReturn -1 EndIf BufferSize = Len(DLLPath) + 1 ParamAddress = VirtualAllocEx_(ProcessHandle, 0, BufferSize, #MEM_COMMIT, #PAGE_READWRITE) If ParamAddress = 0 ProcedureReturn -1 EndIf If Not WriteProcessMemory_(ProcessHandle, ParamAddress, DLLPath, BufferSize, 0) ProcedureReturn -1 EndIf ThreadHandle = CreateRemoteThread_(ProcessHandle, 0, 0, StartAddress, ParamAddress, 0, 0) WaitForSingleObject_(ThreadHandle, #INFINITE) If ParamAddress <> 0 VirtualFreeEx_(ProcessHandle, ParamAddress, 0, #MEM_RELEASE) Else ProcedureReturn -1 EndIf CloseHandle_(ProcessHandle) ProcedureReturn 0 EndProcedure NotePad = RunProgram("notepad", "", "", #PB_Program_Open|#PB_Program_Read) Debug(NotePad) If NotePad ProcessID = ProgramID(NotePad) If ProcessID InjectLibrary(ProcessID, "dll01.dll") EndIf EndIfdll.pb
ProcedureDLL AttachProcess(Instance) MessageRequester("", "This is the first DLL") EndProcedure
PyroStrex, do you have a function for signature scanning? Thank you.
ReplyDeleteHmm. Sorry, signature scanning. I never though of experiencing something like that. :). So, no, I don't.
ReplyDeletePlease, update you tutorial because its not working I tried that on Windows 8 and can't inject. :(
ReplyDelete