(help)injector

[tremaster]

what do i look up to learn about injectors

[Jason]

Allocating memory. Finding module addresses. Writing process memory. Opening process handles. Creating remote threads. There's SHITLOADS of material around.

[tremaster]

do you think you think you can make a well explained tutorial on the most simple injector

[Nathan]

do you think you think you can make a well explained tutorial on the most simple injector

Just leech a injector source code.

[Jason]

do you think you think you can make a well explained tutorial on the most simple injector

I may do...but I dunno if I can be fucked. I'll see if I have time with Uni and shit. I'd release it in the VB section though.

[t7ancients]

I have an old source that someone posted on here a long time ago, so don't flame if you recognize it, but this may help.
You need to import some unmanaged functions:

            [DllImport("kernel32.dll")]
            public static extern IntPtr CreateRemoteThread(
              IntPtr hProcess,
              IntPtr lpThreadAttributes,
              uint dwStackSize,
              UIntPtr lpStartAddress, // raw Pointer into remote process
              IntPtr lpParameter,
              uint dwCreationFlags,
              out IntPtr lpThreadId
                );
            [DllImport("kernel32.dll")]
            public static extern Int32 CloseHandle(
                IntPtr hObject
                );
            [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
            static extern bool VirtualFreeEx(
                IntPtr hProcess,
                IntPtr lpAddress,
                UIntPtr dwSize,
                uint dwFreeType
                );
            [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true)]
            public static extern UIntPtr GetProcAddress(
                IntPtr hModule,
                string procName
                );
            [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
            static extern IntPtr VirtualAllocEx(
                IntPtr hProcess,
                IntPtr lpAddress,
                uint dwSize,
                uint flAllocationType,
                uint flProtect
                );
            [DllImport("kernel32.dll")]
            static extern bool WriteProcessMemory(
                IntPtr hProcess,
                IntPtr lpBaseAddress,
                string lpBuffer,
                UIntPtr nSize,
                out IntPtr lpNumberOfBytesWritten
                );
            [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
            public static extern IntPtr GetModuleHandle(
                string lpModuleName
                );
            [DllImport("kernel32", SetLastError = true, ExactSpelling = true)]
            internal static extern Int32 WaitForSingleObject(
                IntPtr handle,
                Int32 milliseconds
                );

So, yeah, I think that's all of the functions you need. Like I said, I didn't write this, it's just a source I had on my pc that I THINK was posted on mpgh before.
Now the function that actually injects the dll:

public void InjectDLL(IntPtr hProcess, String strDLLName)
            {
                IntPtr bytesout;

                // Length of string containing the DLL file name +1 byte padding
                Int32 LenWrite = strDLLName.Length + 1;
                // Allocate memory within the virtual address space of the target process
                IntPtr AllocMem = (IntPtr)VirtualAllocEx(hProcess, (IntPtr)null, (uint)LenWrite, 0x1000, 0x40); //allocation pour WriteProcessMemory

                // Write DLL file name to allocated memory in target process
                WriteProcessMemory(hProcess, AllocMem, strDLLName, (UIntPtr)LenWrite, out bytesout);
                // Function pointer "Injector"
                UIntPtr Injector = (UIntPtr)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");

                if (Injector == null)
                {
                    // return failed
                    return;
                }
                // Create thread in target process, and store handle in hThread
                IntPtr hThread = (IntPtr)CreateRemoteThread(hProcess, (IntPtr)null, 0, Injector, AllocMem, 0, out bytesout);
                // Make sure thread handle is valid
                if (hThread == null)
                {
                    //incorrect thread handle ... return failed
                    return;
                }
                // Time-out is 10 seconds...
                int Result = WaitForSingleObject(hThread, 10 * 1000);
                // Check whether thread timed out...
                if (Result == 0x00000080L || Result == 0x00000102L || Result == 0xFFFFFFFF)
                {
                    /* Thread timed out... */
                    // Make sure thread handle is valid before closing... prevents crashes.
                    if (hThread != null)
                    {
                        //Close thread in target process
                        CloseHandle(hThread);
                    }
                    return;
                }
                // Sleep thread for 1 second
                Thread.Sleep(1000);
                // Clear up allocated space ( Allocmem )
                VirtualFreeEx(hProcess, AllocMem, (UIntPtr)0, 0x8000);
                // Make sure thread handle is valid before closing... prevents crashes.
                if (hThread != null)
                {
                    //Close thread in target process
                    CloseHandle(hThread);
                }
                // return succeeded
                return;
            }//Dll injector

There. There may be errors or things that are missing, hell, I dunno. Mess with it enough and you'll probably get it to work or maybe it'll help you learn.

[haipahaipa]

I just found this code and put it together so theres nothing missing.

Just need using DLLInject; and then call the function InjecDLL(IntPtr hProcess, String strDLLName);

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
using System.Threading;



namespace DLLInjector
{
    class DLLInjector
    {
        public void InjectDLL(IntPtr hProcess, String strDLLName)
        {

            IntPtr bytesout;

            // Length of string containing the DLL file name +1 byte padding
            Int32 LenWrite = strDLLName.Length + 1;
            // Allocate memory within the virtual address space of the target process
            IntPtr AllocMem = (IntPtr)VirtualAllocEx(hProcess, (IntPtr)null, (uint)LenWrite, 0x1000, 0x40); //allocation pour WriteProcessMemory

            // Write DLL file name to allocated memory in target process
            WriteProcessMemory(hProcess, AllocMem, strDLLName, (UIntPtr)LenWrite, out bytesout);
            // Function pointer "Injector"
            UIntPtr Injector = (UIntPtr)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");

            if (Injector == null)
            {
                // return failed
                return;
            }
            // Create thread in target process, and store handle in hThread
            IntPtr hThread = (IntPtr)CreateRemoteThread(hProcess, (IntPtr)null, 0, Injector, AllocMem, 0, out bytesout);
            // Make sure thread handle is valid
            if (hThread == null)
            {
                //incorrect thread handle ... return failed
                return;
            }
            // Time-out is 10 seconds...
            int Result = WaitForSingleObject(hThread, 10 * 1000);
            // Check whether thread timed out...
            if (Result == 0x00000080L || Result == 0x00000102L || Result == 0xFFFFFFFF)
            {
                /* Thread timed out... */
                // Make sure thread handle is valid before closing... prevents crashes.
                if (hThread != null)
                {
                    //Close thread in target process
                    CloseHandle(hThread);
                }
                return;
            }
            // Sleep thread for 1 second
            Thread.Sleep(1000);
            // Clear up allocated space ( Allocmem )
            VirtualFreeEx(hProcess, AllocMem, (UIntPtr)0, 0x8000);
            // Make sure thread handle is valid before closing... prevents crashes.
            if (hThread != null)
            {
                //Close thread in target process
                CloseHandle(hThread);
            }
            // return succeeded
            return;
        }

        [DllImport("kernel32.dll")]
        public static extern IntPtr CreateRemoteThread(
          IntPtr hProcess,
          IntPtr lpThreadAttributes,
          uint dwStackSize,
          UIntPtr lpStartAddress, // raw Pointer into remote process
          IntPtr lpParameter,
          uint dwCreationFlags,
          out IntPtr lpThreadId
            );
        [DllImport("kernel32.dll")]
        public static extern Int32 CloseHandle(
            IntPtr hObject
            );
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern bool VirtualFreeEx(
            IntPtr hProcess,
            IntPtr lpAddress,
            UIntPtr dwSize,
            uint dwFreeType
            );
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true)]
        public static extern UIntPtr GetProcAddress(
            IntPtr hModule,
            string procName
            );
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAllocEx(
            IntPtr hProcess,
            IntPtr lpAddress,
            uint dwSize,
            uint flAllocationType,
            uint flProtect
            );
        [DllImport("kernel32.dll")]
        static extern bool WriteProcessMemory(
            IntPtr hProcess,
            IntPtr lpBaseAddress,
            string lpBuffer,
            UIntPtr nSize,
            out IntPtr lpNumberOfBytesWritten
            );
        [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
        public static extern IntPtr GetModuleHandle(
            string lpModuleName
            );
        [DllImport("kernel32", SetLastError = true, ExactSpelling = true)]
        internal static extern Int32 WaitForSingleObject(
            IntPtr handle,
            Int32 milliseconds
            );
    }
}

[Jason]

I just found this code and put it together so theres nothing missing.

Just need using DLLInject; and then call the function InjecDLL(IntPtr hProcess, String strDLLName);

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
using System.Threading;



namespace DLLInjector
{
    class DLLInjector
    {
        public void InjectDLL(IntPtr hProcess, String strDLLName)
        {

            IntPtr bytesout;

            // Length of string containing the DLL file name +1 byte padding
            Int32 LenWrite = strDLLName.Length + 1;
            // Allocate memory within the virtual address space of the target process
            IntPtr AllocMem = (IntPtr)VirtualAllocEx(hProcess, (IntPtr)null, (uint)LenWrite, 0x1000, 0x40); //allocation pour WriteProcessMemory

            // Write DLL file name to allocated memory in target process
            WriteProcessMemory(hProcess, AllocMem, strDLLName, (UIntPtr)LenWrite, out bytesout);
            // Function pointer "Injector"
            UIntPtr Injector = (UIntPtr)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");

            if (Injector == null)
            {
                // return failed
                return;
            }
            // Create thread in target process, and store handle in hThread
            IntPtr hThread = (IntPtr)CreateRemoteThread(hProcess, (IntPtr)null, 0, Injector, AllocMem, 0, out bytesout);
            // Make sure thread handle is valid
            if (hThread == null)
            {
                //incorrect thread handle ... return failed
                return;
            }
            // Time-out is 10 seconds...
            int Result = WaitForSingleObject(hThread, 10 * 1000);
            // Check whether thread timed out...
            if (Result == 0x00000080L || Result == 0x00000102L || Result == 0xFFFFFFFF)
            {
                /* Thread timed out... */
                // Make sure thread handle is valid before closing... prevents crashes.
                if (hThread != null)
                {
                    //Close thread in target process
                    CloseHandle(hThread);
                }
                return;
            }
            // Sleep thread for 1 second
            Thread.Sleep(1000);
            // Clear up allocated space ( Allocmem )
            VirtualFreeEx(hProcess, AllocMem, (UIntPtr)0, 0x8000);
            // Make sure thread handle is valid before closing... prevents crashes.
            if (hThread != null)
            {
                //Close thread in target process
                CloseHandle(hThread);
            }
            // return succeeded
            return;
        }

        [DllImport("kernel32.dll")]
        public static extern IntPtr CreateRemoteThread(
          IntPtr hProcess,
          IntPtr lpThreadAttributes,
          uint dwStackSize,
          UIntPtr lpStartAddress, // raw Pointer into remote process
          IntPtr lpParameter,
          uint dwCreationFlags,
          out IntPtr lpThreadId
            );
        [DllImport("kernel32.dll")]
        public static extern Int32 CloseHandle(
            IntPtr hObject
            );
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern bool VirtualFreeEx(
            IntPtr hProcess,
            IntPtr lpAddress,
            UIntPtr dwSize,
            uint dwFreeType
            );
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true)]
        public static extern UIntPtr GetProcAddress(
            IntPtr hModule,
            string procName
            );
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAllocEx(
            IntPtr hProcess,
            IntPtr lpAddress,
            uint dwSize,
            uint flAllocationType,
            uint flProtect
            );
        [DllImport("kernel32.dll")]
        static extern bool WriteProcessMemory(
            IntPtr hProcess,
            IntPtr lpBaseAddress,
            string lpBuffer,
            UIntPtr nSize,
            out IntPtr lpNumberOfBytesWritten
            );
        [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
        public static extern IntPtr GetModuleHandle(
            string lpModuleName
            );
        [DllImport("kernel32", SetLastError = true, ExactSpelling = true)]
        internal static extern Int32 WaitForSingleObject(
            IntPtr handle,
            Int32 milliseconds
            );
    }
}

You should probably look up what functions actually return upon an error. None of those functions return NULL on failure so your 'error checking' won't really do anything.

[Kantanomo]

Let me google that for you