[SRC] InjectDllViaAPC - Delphi

Here is what I was using instead "CreateRemoteThread" in my DHM Loader, A lot more stealthy and a lot less chance of getting detected compared to your normal "Injectors".

Function:

Code:

function InjectDllViaAPC(hProcess:DWORD; hThread:DWORD; szDllPath:string):Boolean;
var
  dwPathSize: DWORD;
  pMemory:    Pointer;
  dwWritten:  DWORD;
begin
  Result := FALSE;
  dwPathSize := Length(szDllPath) + 1;
  pMemory := VirtualAllocEx(hProcess, nil, dwPathSize, MEM_COMMIT, PAGE_READWRITE);
  if (Assigned(pMemory)) then
  begin
    WriteProcessMemory(hProcess, pMemory, @szDllPath[1], dwPathSize, dwWritten);
    if (dwPathSize = dwWritten) then
    begin
      if (QueueUserAPC(GetProcAddress(LoadLibraryA('kernel32.dll'), 'LoadLibraryA'), hThread, DWORD(pMemory))) then
        Result := TRUE;
    end;
  end;
end;

Usage:

Code:

procedure TForm1.btn1Click(Sender: TObject);
var
 strExecute: string;
 ProcInfo:   TProcessInformation;
  StartInfo:  TStartupInfo;
begin
 strExecute:= 'Engine.exe -windowtitle \CombatArms\ -rez Engine.REZ -rez Game -authip 208.85.111.14 -authport 10001 -pcroom 0 -UserId';
 ZeroMemory(@startInfo, SizeOf(TStartupInfo));
  StartInfo.cb := SizeOf(TStartupInfo);
  if (CreateProcessA(nil, PChar(strExecute), nil, nil, FALSE, 0, nil, nil, StartInfo, ProcInfo)) then
    InjectDllViaAPC(ProcInfo.hProcess, ProcInfo.hThread, 'DMH.dll');
end;

Enjoy the stealth method of injecting your dll

Only problem with the APC is that it only works on alertable threads, and it's not very straightforward to wait for - and capture - the functions return value. I mean, this is fine for an injector as most processes' base threads are alertable, and cleaning up the dll path in the remote memory isn't so much of a memory leak issue.

Reference: QueueUserAPC function

Originally Posted by msdn

Note: Queuing APCs to threads outside the caller's process is not recommended for a number of reasons. DLL rebasing can cause the addresses of functions used by the APC to be incorrect when the functions are executed outside the caller's process. Similarly, if a 64-bit process queues an APC to a 32-bit process or vice versa, addresses will be incorrect and the application will crash. Other factors can prevent successful function execution, even if the address is known.

Just some food for thought, but this is a nice alternative for CRT for very simple injectors that don't need or want to be able to unload the loaded module with ease, nice find.

[SRC] InjectDllViaAPC - Delphi

Post a Reply

Similar Threads

Tags for this Thread