CreateRemoteThread in suspended app problem

This is a discussion on CreateRemoteThread in suspended app problem within the Windows Programming forums, part of the Platform Specific Boards category; Hello everyone. This is my code: Code: int main () { STARTUPINFO si; PROCESS_INFORMATION pi; char* cl; char fileName[]="target.exe"; ZeroMemory ...

  1. #1
    Registered User
    Join Date
    Jul 2008
    Posts
    3

    CreateRemoteThread in suspended app problem

    Hello everyone. This is my code:
    Code:
    int main ()
    {
         STARTUPINFO si;
         PROCESS_INFORMATION pi;
         char* cl;
         char fileName[]="target.exe";
         ZeroMemory (&si,sizeof(si));
         si.cb=sizeof(si);
         cl=GetCommandLine();
         if (CreateProcess (&fileName,cl,NULL,NULL,FALSE,CREATE_SUSPENDED, NULL,NULL,&si,&pi))
         {
               HANDLE hToken;
               TOKEN_PRIVILEGES tp;
               LUID luid;
                if (!OpenProcessToken(pi.hProcess,TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES,&hToken))
                {                                           
                    return;
                }
                else{
                     if(!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid))
                        return;
                      tp.PrivilegeCount = 1;
                      tp.Privileges[0].Luid = luid;
                      tp.Privileges[0].Attributes = 1 ? SE_PRIVILEGE_ENABLED : 0;
                      AdjustTokenPrivileges(hToken,FALSE,&tp,0,0,0);
                }
                LPVOID LoadLibAddr = (LPVOID)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
                LPVOID RemoteString = (LPVOID)VirtualAllocEx(pi.hProcess,NULL,sizeof(DLL_NAME),MEM_COMMIT,PAGE_EXECUTE_READWRITE);
                WriteProcessMemory(pi.hProcess, (LPVOID)RemoteString,DLL_NAME,sizeof(DLL_NAME), NULL);
                ResumeThread(pi.hThread);
                Sleep(10);//If this is not here, everything goes to hell
                HANDLE hThread = CreateRemoteThread(pi.hProcess,NULL,NULL,(LPTHREAD_START_ROUTINE)LoadLibAddr,(LPVOID)RemoteString,NULL,NULL);
                WaitForSingleObject( hThread, INFINITE );
                CloseHandle(pi.hProcess);
                CloseHandle(pi.hThread);
         }
    }

    The problem is that certain app's crash when I remove the "Sleep(10)" code, not all of them. I'm trying to intercept all the calls to CreateFileA using API hooking by loading my DLL in the target process. It works great until I remove the Sleep part, the thing is, in those 10ms is possible that many calls to CreateFileA are made and I missed them.
    The problem is not in my DLL, I can even load a blank DLL and the target program still crashes.
    The only thing that comes to mind is that not everything is loaded properly in the target app when I call CreateRemoteThread and that gives me problems. I don't know what to think, I've searched everywhere for people with the same problem and found nothing. I'll be extremely grateful if someone can help me with this. Thanks for your time,


    Domingo Guzman

  2. #2
    Reverse Engineer maxorator's Avatar
    Join Date
    Aug 2005
    Location
    Estonia
    Posts
    2,318
    Do your CreateRemoteThread() stuff before resuming the thread.

  3. #3
    Registered User
    Join Date
    Jul 2008
    Posts
    3
    That's what I was trying to do, but it doesn't work either way. I have the same discussion in another forum. This is taken from there:

    Posted by Dreg (Untrusted stranger) [ip info hidden] - Jul 15 2008, 02:08 (UTC-4)
    Re: Help with CreateRemoThread on a new process
    Hi, while We developed phook [ref.1] We had a similar problem, We solved it with a (beta++) little detector of the process type (GUI or Console):

    "
    Console type processes can be created with the API CreateProcess and the
    flag CREATE_SUSPENDED.

    If GUI type processes are opened with the flag CREATE_SUSPENDED may not
    work correctly, so they must be created using the APIs:
    1.- CreateProcess : Process is created without the flag
    CREATE_SUSPENDED.
    2.- WaitForInputIdle: Correct load of the process [R.6] is waited for.
    3.- SuspendThread : The main thread is suspended.
    "

    ------[ CODE

    CreateProcess
    (
    program_name ,
    NULL ,
    NULL ,
    NULL ,
    FALSE ,
    CREATE_SUSPENDED | CREATE_NEW_CONSOLE ,
    NULL ,
    NULL ,
    pstart_inf ,
    ppro_inf
    )

    // It is necessary to check the correct creation of the process

    if ( WaitForInputIdle( ppro_inf->hProcess, 0 ) == WAIT_FAILED )
    // "Console process"
    else
    // "GUI process"

    ------[ END CODE

    Once the type of process is known, we already know how to create it suspended correctly (see section 2.3).

    Note: the method may not always work, in some ocassion a
    "Console process" will be detected as "GUI process".

    [ref.1] phook - The PEB Hooker
    http://phrack.org/issues.html?issue=65&id=10#article

    doy2001, I hope that this information is useful for you.

    Sincerly, Dreg.
    reply to this message

    Posted by doy2001 (Untrusted stranger) [ip info hidden] - Jul 15 2008, 16:15 (UTC-4)
    Re: Help with CreateRemoThread on a new process
    Hi, thanks for the responses.
    Dreg, as soon as I read your message I knew you've been in my position before and you know what you're talking about. The thing is, it's not working for me, and besides, I can't afford to have a method that won't work always. So I decided to take another approach, something similar to what buriza said, only I do not need to debug the application. I'm gonna create a code cave in the target using VirtualAllocEx and WriteProcessMemory and then I'll change the eip of the thread by reading and setting the ThreadContext. This method is not restricted to Windows NT and hopefuly it'll work always. Let's see how it goes.
    Thanks again for your time, I appreciate it. Regards,


    Domingo Guzman

  4. #4
    Reverse Engineer maxorator's Avatar
    Join Date
    Aug 2005
    Location
    Estonia
    Posts
    2,318
    This is one function I wrote a long time ago:
    Code:
    BOOL CreateProcessWithDll(char* lpApp, char* lpDll, BOOL bTerminateOnFailure){
        DWORD dwLen=strlen(lpDll)+1;
        DWORD dwGeneric;
        void* lpAlloc;
        STARTUPINFO si;
        PROCESS_INFORMATION pi;
        LPTHREAD_START_ROUTINE fnLoadLibrary;
        HANDLE hThread;
        ZeroMemory(&si,sizeof(STARTUPINFO));
        si.cb=sizeof(STARTUPINFO);
        if(CreateProcess(lpApp,NULL,0,0,FALSE,CREATE_SUSPENDED,NULL,NULL,&si,&pi)){
            lpAlloc=VirtualAllocEx(pi.hProcess,NULL,dwLen,MEM_COMMIT,PAGE_READWRITE);
            fnLoadLibrary=(LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("kernel32.dll"),"LoadLibraryA");
            if(lpAlloc && fnLoadLibrary && WriteProcessMemory(pi.hProcess,lpAlloc,(LPVOID)lpDll,dwLen,&dwGeneric)){
                hThread=CreateRemoteThread(pi.hProcess,NULL,0,fnLoadLibrary,(void*)lpAlloc,0,NULL);
                if(hThread){
                    dwGeneric=WaitForSingleObject(hThread,1000);
                    if(dwGeneric==WAIT_OBJECT_0){
                        GetExitCodeThread(pi.hThread,&dwGeneric);
                        if(dwGeneric){
                            ResumeThread(pi.hThread);
                            return TRUE;
                        }
                    }
                }
            }
            if(bTerminateOnFailure){ TerminateProcess(pi.hProcess,0); }
            else{ ResumeThread(pi.hThread); }
        }
        return FALSE;
    }
    You don't need the debug privilege to manipulate with a process you created yourself.
    Last edited by maxorator; 07-16-2008 at 11:18 AM.

  5. #5
    Registered User
    Join Date
    Jul 2008
    Posts
    3
    That's very similar to my method. Unfortunately, it doesn't work with GUI apps.
    The method I'm using now is working perfectly.
    This little tute is very helpful:
    http://www.edgeofnowhere.cc/viewtopic.php?p=2483118
    Regards,

    EDIT: Thanks for the debug privilege clarification!

    Domingo Guzman

  6. #6
    Registered User
    Join Date
    Aug 2008
    Posts
    1

    Question

    Quote Originally Posted by doy2001 View Post
    That's very similar to my method. Unfortunately, it doesn't work with GUI apps.
    The method I'm using now is working perfectly.
    This little tute is very helpful:
    http://www.edgeofnowhere.cc/viewtopic.php?p=2483118
    Regards,

    EDIT: Thanks for the debug privilege clarification!

    Domingo Guzman
    Hi Domingo,

    Just curious, which method did you end up with? I have the same problem myself: Some applications wont start up. I see them briefly in Sysinternals Process Explorer, but then they go *poof* :-/

    Thanks!

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. GTK+ Gnome desktop system tray app problem
    By BobS0327 in forum Linux Programming
    Replies: 2
    Last Post: 04-01-2006, 08:54 PM
  2. Laptop Problem
    By Boomba in forum Tech Board
    Replies: 1
    Last Post: 03-07-2006, 05:24 PM
  3. Replies: 5
    Last Post: 11-07-2005, 10:34 PM
  4. searching problem
    By DaMenge in forum C Programming
    Replies: 9
    Last Post: 09-12-2005, 01:04 AM
  5. half ADT (nested struct) problem...
    By CyC|OpS in forum C Programming
    Replies: 1
    Last Post: 10-26-2002, 08:37 AM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21