[Help] Inject x64 DLL into x64 PE File

[Gladiator]

HelloI have problem with injection 64 bit dll into 64 bit exe file , in case i don't know what i should to do ?
any one can help me with information , sources or some thing that solve my problemThanks

[mrexodia]

Hi,

Look at VirtualAllocEx + CreateRemoteThread, just start a new thread at LoadLibraryW and provide a newly allocated page as argument.

Its not much different from x32.

Greetings,

Mr. eXoDia

[Dreamer]

http://www.softpedia.com/get/Programming/File-Editors/Injector.shtml

[Gladiator]

Thanks Dear Mr.eXoDia & Dear Dreamer for reply

But i means Code Injection via Dll Directly to PE File not to Process

Look Likes Armadillo and many other protectors and packers

 

[Dreamer]

my mistake sorry 

[Aguila]

https://github.com/fancycode/MemoryModule

[Gladiator]

https://github.com/fancycode/MemoryModule

 

Thanks for reply but i mean static dll injection , for example , injecting some asm code to show message box to x64 PE file as new section , change oep to new section and rebuild file to run without any error or etc

[kao]

That is not called "injection".

 

Theoretically, everything is the same as in 32-bit world. The biggest difference is that you pass arguments to function in registers, not on stack.

What did you try and what exactly did not work?

[Gladiator]

i had build 32 bit code injection to PE but in 64 bit in need some references and information

[kao]

Again - what exactly did you try and what exactly does not work?

 

Attached is simple demo I made in 10 minutes using HIEW as a hex editor and to assemble x64 code.

x64_adding_code.zip

[Gladiator]

Thanks for Demo , I Have used Code Project PE-Inject in Win32 but i does not works in 64 bit Applications

http://www.codeproject.com/Articles/12532/Inject-your-code-to-a-Portable-Executable-file#PEViewerDownloadLink

 

Would you please share demo src code ?

[mudlord]

Is this for your payware EXE packer/protector?

Looks to me for that article, you need to read up on the differences between x64 PE header and x86....

 

If it was me, I would just use TitanEngine for such things, plus a decent x64 assembler like AsmJit.

Edited April 3, 2014 by mudlord

[mrexodia]

If you wanna execute your DllMain with the executable start: use CFF Explorer (import adder, add a random import).

Greetings

[mudlord]

I think he means inserting a DLL like how Armadillo works internally, or ASProtect.

[mrexodia]

Ah! Then you need to understand the decryption/encryption of the file inside the executable and you also need to patch some crc checks.

[mudlord]

I think Gladiator is meaning this in a protection sense, so this applies to unprotected apps.

Might be for a x64 port of his protector?