(help)injector

Posts 1–9 of 9 · Page 1 of 1

(help)injector

what do i look up to learn about injectors

Allocating memory. Finding module addresses. Writing process memory. Opening process handles. Creating remote threads. There's SHITLOADS of material around.

do you think you think you can make a well explained tutorial on the most simple injector

Originally Posted by tremaster

do you think you think you can make a well explained tutorial on the most simple injector

Just leech a injector source code.

Originally Posted by tremaster

do you think you think you can make a well explained tutorial on the most simple injector

I may do...but I dunno if I can be fucked. I'll see if I have time with Uni and shit. I'd release it in the VB section though.

I have an old source that someone posted on here a long time ago, so don't flame if you recognize it, but this may help.
You need to import some unmanaged functions:

Code:

            [DllImport("kernel32.dll")]
            public static extern IntPtr CreateRemoteThread(
              IntPtr hProcess,
              IntPtr lpThreadAttributes,
              uint dwStackSize,
              UIntPtr lpStartAddress, // raw Pointer into remote process
              IntPtr lpParameter,
              uint dwCreationFlags,
              out IntPtr lpThreadId
                );
            [DllImport("kernel32.dll")]
            public static extern Int32 CloseHandle(
                IntPtr hObject
                );
            [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
            static extern bool VirtualFreeEx(
                IntPtr hProcess,
                IntPtr lpAddress,
                UIntPtr dwSize,
                uint dwFreeType
                );
            [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true)]
            public static extern UIntPtr GetProcAddress(
                IntPtr hModule,
                string procName
                );
            [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
            static extern IntPtr VirtualAllocEx(
                IntPtr hProcess,
                IntPtr lpAddress,
                uint dwSize,
                uint flAllocationType,
                uint flProtect
                );
            [DllImport("kernel32.dll")]
            static extern bool WriteProcessMemory(
                IntPtr hProcess,
                IntPtr lpBaseAddress,
                string lpBuffer,
                UIntPtr nSize,
                out IntPtr lpNumberOfBytesWritten
                );
            [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
            public static extern IntPtr GetModuleHandle(
                string lpModuleName
                );
            [DllImport("kernel32", SetLastError = true, ExactSpelling = true)]
            internal static extern Int32 WaitForSingleObject(
                IntPtr handle,
                Int32 milliseconds
                );

So, yeah, I think that's all of the functions you need. Like I said, I didn't write this, it's just a source I had on my pc that I THINK was posted on mpgh before.
Now the function that actually injects the dll:

Code:

public void InjectDLL(IntPtr hProcess, String strDLLName)
            {
                IntPtr bytesout;

                // Length of string containing the DLL file name +1 byte padding
                Int32 LenWrite = strDLLName.Length + 1;
                // Allocate memory within the virtual address space of the target process
                IntPtr AllocMem = (IntPtr)VirtualAllocEx(hProcess, (IntPtr)null, (uint)LenWrite, 0x1000, 0x40); //allocation pour WriteProcessMemory

                // Write DLL file name to allocated memory in target process
                WriteProcessMemory(hProcess, AllocMem, strDLLName, (UIntPtr)LenWrite, out bytesout);
                // Function pointer "Injector"
                UIntPtr Injector = (UIntPtr)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");

                if (Injector == null)
                {
                    // return failed
                    return;
                }
                // Create thread in target process, and store handle in hThread
                IntPtr hThread = (IntPtr)CreateRemoteThread(hProcess, (IntPtr)null, 0, Injector, AllocMem, 0, out bytesout);
                // Make sure thread handle is valid
                if (hThread == null)
                {
                    //incorrect thread handle ... return failed
                    return;
                }
                // Time-out is 10 seconds...
                int Result = WaitForSingleObject(hThread, 10 * 1000);
                // Check whether thread timed out...
                if (Result == 0x00000080L || Result == 0x00000102L || Result == 0xFFFFFFFF)
                {
                    /* Thread timed out... */
                    // Make sure thread handle is valid before closing... prevents crashes.
                    if (hThread != null)
                    {
                        //Close thread in target process
                        CloseHandle(hThread);
                    }
                    return;
                }
                // Sleep thread for 1 second
                Thread.Sleep(1000);
                // Clear up allocated space ( Allocmem )
                VirtualFreeEx(hProcess, AllocMem, (UIntPtr)0, 0x8000);
                // Make sure thread handle is valid before closing... prevents crashes.
                if (hThread != null)
                {
                    //Close thread in target process
                    CloseHandle(hThread);
                }
                // return succeeded
                return;
            }//Dll injector

There. There may be errors or things that are missing, hell, I dunno. Mess with it enough and you'll probably get it to work or maybe it'll help you learn.

I just found this code and put it together so theres nothing missing.

Just need using DLLInject; and then call the function InjecDLL(IntPtr hProcess, String strDLLName);

Code:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
using System.Threading;



namespace DLLInjector
{
    class DLLInjector
    {
        public void InjectDLL(IntPtr hProcess, String strDLLName)
        {

            IntPtr bytesout;

            // Length of string containing the DLL file name +1 byte padding
            Int32 LenWrite = strDLLName.Length + 1;
            // Allocate memory within the virtual address space of the target process
            IntPtr AllocMem = (IntPtr)VirtualAllocEx(hProcess, (IntPtr)null, (uint)LenWrite, 0x1000, 0x40); //allocation pour WriteProcessMemory

            // Write DLL file name to allocated memory in target process
            WriteProcessMemory(hProcess, AllocMem, strDLLName, (UIntPtr)LenWrite, out bytesout);
            // Function pointer "Injector"
            UIntPtr Injector = (UIntPtr)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");

            if (Injector == null)
            {
                // return failed
                return;
            }
            // Create thread in target process, and store handle in hThread
            IntPtr hThread = (IntPtr)CreateRemoteThread(hProcess, (IntPtr)null, 0, Injector, AllocMem, 0, out bytesout);
            // Make sure thread handle is valid
            if (hThread == null)
            {
                //incorrect thread handle ... return failed
                return;
            }
            // Time-out is 10 seconds...
            int Result = WaitForSingleObject(hThread, 10 * 1000);
            // Check whether thread timed out...
            if (Result == 0x00000080L || Result == 0x00000102L || Result == 0xFFFFFFFF)
            {
                /* Thread timed out... */
                // Make sure thread handle is valid before closing... prevents crashes.
                if (hThread != null)
                {
                    //Close thread in target process
                    CloseHandle(hThread);
                }
                return;
            }
            // Sleep thread for 1 second
            Thread.Sleep(1000);
            // Clear up allocated space ( Allocmem )
            VirtualFreeEx(hProcess, AllocMem, (UIntPtr)0, 0x8000);
            // Make sure thread handle is valid before closing... prevents crashes.
            if (hThread != null)
            {
                //Close thread in target process
                CloseHandle(hThread);
            }
            // return succeeded
            return;
        }

        [DllImport("kernel32.dll")]
        public static extern IntPtr CreateRemoteThread(
          IntPtr hProcess,
          IntPtr lpThreadAttributes,
          uint dwStackSize,
          UIntPtr lpStartAddress, // raw Pointer into remote process
          IntPtr lpParameter,
          uint dwCreationFlags,
          out IntPtr lpThreadId
            );
        [DllImport("kernel32.dll")]
        public static extern Int32 CloseHandle(
            IntPtr hObject
            );
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern bool VirtualFreeEx(
            IntPtr hProcess,
            IntPtr lpAddress,
            UIntPtr dwSize,
            uint dwFreeType
            );
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true)]
        public static extern UIntPtr GetProcAddress(
            IntPtr hModule,
            string procName
            );
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAllocEx(
            IntPtr hProcess,
            IntPtr lpAddress,
            uint dwSize,
            uint flAllocationType,
            uint flProtect
            );
        [DllImport("kernel32.dll")]
        static extern bool WriteProcessMemory(
            IntPtr hProcess,
            IntPtr lpBaseAddress,
            string lpBuffer,
            UIntPtr nSize,
            out IntPtr lpNumberOfBytesWritten
            );
        [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
        public static extern IntPtr GetModuleHandle(
            string lpModuleName
            );
        [DllImport("kernel32", SetLastError = true, ExactSpelling = true)]
        internal static extern Int32 WaitForSingleObject(
            IntPtr handle,
            Int32 milliseconds
            );
    }
}

Originally Posted by haipahaipa

I just found this code and put it together so theres nothing missing.

Just need using DLLInject; and then call the function InjecDLL(IntPtr hProcess, String strDLLName);

Code:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
using System.Threading;



namespace DLLInjector
{
    class DLLInjector
    {
        public void InjectDLL(IntPtr hProcess, String strDLLName)
        {

            IntPtr bytesout;

            // Length of string containing the DLL file name +1 byte padding
            Int32 LenWrite = strDLLName.Length + 1;
            // Allocate memory within the virtual address space of the target process
            IntPtr AllocMem = (IntPtr)VirtualAllocEx(hProcess, (IntPtr)null, (uint)LenWrite, 0x1000, 0x40); //allocation pour WriteProcessMemory

            // Write DLL file name to allocated memory in target process
            WriteProcessMemory(hProcess, AllocMem, strDLLName, (UIntPtr)LenWrite, out bytesout);
            // Function pointer "Injector"
            UIntPtr Injector = (UIntPtr)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");

            if (Injector == null)
            {
                // return failed
                return;
            }
            // Create thread in target process, and store handle in hThread
            IntPtr hThread = (IntPtr)CreateRemoteThread(hProcess, (IntPtr)null, 0, Injector, AllocMem, 0, out bytesout);
            // Make sure thread handle is valid
            if (hThread == null)
            {
                //incorrect thread handle ... return failed
                return;
            }
            // Time-out is 10 seconds...
            int Result = WaitForSingleObject(hThread, 10 * 1000);
            // Check whether thread timed out...
            if (Result == 0x00000080L || Result == 0x00000102L || Result == 0xFFFFFFFF)
            {
                /* Thread timed out... */
                // Make sure thread handle is valid before closing... prevents crashes.
                if (hThread != null)
                {
                    //Close thread in target process
                    CloseHandle(hThread);
                }
                return;
            }
            // Sleep thread for 1 second
            Thread.Sleep(1000);
            // Clear up allocated space ( Allocmem )
            VirtualFreeEx(hProcess, AllocMem, (UIntPtr)0, 0x8000);
            // Make sure thread handle is valid before closing... prevents crashes.
            if (hThread != null)
            {
                //Close thread in target process
                CloseHandle(hThread);
            }
            // return succeeded
            return;
        }

        [DllImport("kernel32.dll")]
        public static extern IntPtr CreateRemoteThread(
          IntPtr hProcess,
          IntPtr lpThreadAttributes,
          uint dwStackSize,
          UIntPtr lpStartAddress, // raw Pointer into remote process
          IntPtr lpParameter,
          uint dwCreationFlags,
          out IntPtr lpThreadId
            );
        [DllImport("kernel32.dll")]
        public static extern Int32 CloseHandle(
            IntPtr hObject
            );
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern bool VirtualFreeEx(
            IntPtr hProcess,
            IntPtr lpAddress,
            UIntPtr dwSize,
            uint dwFreeType
            );
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true)]
        public static extern UIntPtr GetProcAddress(
            IntPtr hModule,
            string procName
            );
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAllocEx(
            IntPtr hProcess,
            IntPtr lpAddress,
            uint dwSize,
            uint flAllocationType,
            uint flProtect
            );
        [DllImport("kernel32.dll")]
        static extern bool WriteProcessMemory(
            IntPtr hProcess,
            IntPtr lpBaseAddress,
            string lpBuffer,
            UIntPtr nSize,
            out IntPtr lpNumberOfBytesWritten
            );
        [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
        public static extern IntPtr GetModuleHandle(
            string lpModuleName
            );
        [DllImport("kernel32", SetLastError = true, ExactSpelling = true)]
        internal static extern Int32 WaitForSingleObject(
            IntPtr handle,
            Int32 milliseconds
            );
    }
}

You should probably look up what functions actually return upon an error. None of those functions return NULL on failure so your 'error checking' won't really do anything.

Let me google that for you

Posts 1–9 of 9 · Page 1 of 1

Tags for this Thread

None

(help)injector

Post a Reply

Tags for this Thread