Geek Answers Handbook

Call Function in Injected DLL

I want to call a function in the remote process of the injected DLL that I created.

I successfully entered my dll with

CreateRemoteThread(pHandle, NULL, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryA"), pLibRemote, 0, NULL);

DllMain is running, and the DLL starts in standby mode. What I would like to do is somehow call the remotely loaded DLL to do some work.

I tried to export the function as follows:

extern "C" __declspec(dllexport) void MyFunc(void)

and then do the following function:

CreateRemoteThread(pHandle, NULL, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("mydll"), "MyFunc"), NULL, 0, NULL);

but it leads to failure.

How can i solve this?

+5
source share
2 answers

GetModuleHandle, DLL, ( ). , DLL. , , .def, . :

  • DLL ,
  • DLL . GetProcAddress, DLL.
  • , 1. CreateRemoteThread .

DLL- , DLL.

HMODULE hInjected;

hThread = CreateRemoteThread( hProcess, NULL, 0,
      (LPTHREAD_START_ROUTINE)( GetProcAddress( hMod,
      "LoadLibraryW" ) ), lpAddress, 0, NULL );

// Locate address our payload was loaded
if( hThread != 0 ) {
  WaitForSingleObject( hThread, INFINITE );
  GetExitCodeThread( hThread, ( LPDWORD )&hInjected );
  CloseHandle( hThread );
}

hInjected DLL. :

void* GetPayloadExportAddr( LPCWSTR lpPath, HMODULE hPayloadBase, LPCSTR lpFunctionName ) {
  // Load payload in our own virtual address space
  HMODULE hLoaded = LoadLibrary( lpPath );

  if( hLoaded == NULL ) {
    return NULL;
  } else {
    void* lpFunc   = GetProcAddress( hLoaded, lpFunctionName );
    DWORD dwOffset = (char*)lpFunc - (char*)hLoaded;

    FreeLibrary( hLoaded );
    return (DWORD)hPayloadBase + dwOffset;
  }
}

, . , GetProcAddress . DLL. hInjected, , , CreateRemoteThread. , :

BOOL InitPayload( HANDLE hProcess, LPCWSTR lpPath, HMODULE hPayloadBase, HWND hwndDlg ) {
  void* lpInit = GetPayloadExportAddr( lpPath, hPayloadBase, "Init" );
  if( lpInit == NULL ) {
    return FALSE;
  } else {
    HANDLE hThread = CreateRemoteThread( hProcess, NULL, 0,
        lpInit, hwndDlg, 0, NULL );

    if( hThread == NULL ) {
      return FALSE;
    } else {
      CloseHandle( hThread );
    }
  }

  return TRUE;
}

, . , , , , -.

+13

, 32- DLL 32- .

64- DLL 64- , DLL GetExitCodeThread, 32 64- .

, , LoadLibrary ( ), ( CreateRemoteThread), ReadProcessMemory.

( PowerShell ASM-): http://clymb3r.wordpress.com/2013/05/26/implementing-remote-loadlibrary-and-remote-getprocaddress-using-powershell-and-assembly/

, , , 64- , DWORD ( 32 ).

+2

More articles:


All Articles