Thread: createremotethread and writeprocessmemory problems

  1. #1
    Registered User
    Join Date
    Aug 2006
    << snipped from >>
    Hey there

    I have been coping with the problems of injecting code into other processes and I was successful with injecting dlls, leaving the problem I have to use two files to simply inject code, the PE and the dll.

    Is there a working example out there, which just injects code instead of files?
    I found lots of example code for dll injecting but none for code injection.

    I've got the same problem as this guy 'cloudy' couple of years ago, my program with similar code just crashes at the same spot.

    I thought there is no need in creating a new thread as this unsolved problem is the same as I have. (But maybe it could moved to the windows programming board )

    Thanks for answer,
    Last edited by Salem; 01-19-2008 at 01:36 AM. Reason: Still a bump, read the rules.

  2. #2
    Reverse Engineer maxorator's Avatar
    Join Date
    Aug 2005
    The mistake that cloudy did and probably you too was that you can't use global variables inside the injected function.
    This string IS a global variable. One way to do it might be something like this:
    char localvar[24]={'c',':','/','w','i','n','d','o','w','s','/','n',
    The second mistake was to call a function inside injected function. You can't call functions directly because the import section of each process is different. (The normal calls inside processes first call the import section equivalent which redirects it to the real function).

    The only way to get something done is to also inject a structure with the real addresses (the addresses of basic DLL's functions are the same in every process) of the functions you want to use (I recommend only to send the addys of GetProcAddress and GetModuleHandle) into the target process and pass the pointer to that structure as an argument to your remote thread. You can get the real address of a function by using for example
    You can only pass the functions of the modules of the basic Windows DLL's such as kernel32, user32 and a few more. So if you want to get the addys of more functions inside that process you have to send it the addys of GetProcAddress and GetModuleHandle so it could indepently get the addys of more functions.

    Cloudy also just used a guessed size of the injected function, which is very bad too. There isn't a standard way to get the size of a function, but there is one hackish way to do it. You can add an empty function after the injected function and subtract the address of the injected function from the function after it. Notice that this may or may not work depending on your compiler. For example in MSVC++ if you make two injected functions and add an empty function after them, it merges the empty functions, so you've got to make those functions do different meaningless things.

    One more thing - you've got to turn off ANY exception handling routines which the compiler adds, because it adds these routines to your injected function too.

    If you didn't understand any of this, you should start by learning the structure of an executable, a little assembly and reverse engineering.
    Last edited by maxorator; 01-19-2008 at 05:43 AM.
    "The Internet treats censorship as damage and routes around it." - John Gilmore

  3. #3
    Join Date
    Oct 2007
    Inside my computer
    Injecting code into other processes can be used for malware, as well... not sure what you're trying to accomplish?
    Also, injecting code is difficult; it's better to create a DLL and use CreateRemoteThread to attach the DLL to the process in question.
    Quote Originally Posted by Adak View Post
    io.h certainly IS included in some modern compilers. It is no longer part of the standard for C, but it is nevertheless, included in the very latest Pelles C versions.
    Quote Originally Posted by Salem View Post
    You mean it's included as a crutch to help ancient programmers limp along without them having to relearn too much.

    Outside of your DOS world, your header file is meaningless.

  4. #4
    Super Moderator VirtualAce's Avatar
    Join Date
    Aug 2001
    Code injection is not normally how well behaved programs go about their business.

    I think we are done here. If anyone has objections please PM me or one of the mods.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. createremotethread and writeprocessmemory problems
    By cloudy in forum C++ Programming
    Replies: 1
    Last Post: 07-03-2005, 05:06 PM
  2. CreateRemoteThread() for subclassing
    By bennyandthejets in forum Windows Programming
    Replies: 24
    Last Post: 07-26-2003, 09:23 AM