Jump to content
Tuts 4 You

Dll injection failing ... sometimes ...


Recommended Posts


I'm using this code to inject a dll into a process:

bool InjectDll(HANDLE hProcess, char * Dll)
size_t AllocSize;
void * Alloc;
HANDLE hThread;
DWORD dwExitCode = 0; AllocSize = strlen(Dll) + 1; Alloc = VirtualAllocEx(hProcess, 0, AllocSize, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProcess, Alloc, Dll, AllocSize, 0);
hThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryA"), Alloc, 0, 0);
if(WAIT_OBJECT_0 == WaitForSingleObject(hThread, 5000))
GetExitCodeThread(hThread, &dwExitCode);
VirtualFreeEx(hProcess, Alloc, 0, MEM_RELEASE);
} return (dwExitCode != 0);

This is basically taken from the source atomos posted at RES some time ago.

The code works fine for most apps but for one it just fails. All APIs succeed, only the thread exit code is 0.

ie. LoadLibrary was unable to load the dll.

However, if I load the app into Olly and use Ollyadvanced to inject the dll, it works just fine

I looked at what it does internally and it seems to write a piece of code that calls LoadLibraryA and sets EIP to that memory.

Could this fail because of missing privileges?

Any help much appreciated :)

Link to comment

Looking at this code, it creates a remote thread at LoadLibraryA itself, with the parameter for the thread being the address of the dll string (which was written in after some memory is allocated for this). There is no ExitThread because the RET 4 from LoadLibraryA will be returning directly to the kernel code where the thread proc was called from and ExitThread can be found there...

This looks very neat, as there is no extra code written, its making use of the kernel code already there. Clever.



Link to comment

Yeah it's standard code in some game hacks I analyze from time to time. I think the problem may be in the entry of your DLL. I remember a lot of the DLLs I analyzed called DisableThreadLibraryCalls or some API with a similar name like that. You might want to look into that.

Edited by Loveless
Link to comment

Hm it's 60MB so uploading is not really an option :/

I sort of fixed it. I forgot to remove a breakpoint on an API that seems to have been called from within LoadLibraryA.

Kinda weird as the debug thread should have taken care of it.

Thanks for you help :)

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...