So I posted about this earlier but changed my program heavily so I might of had to remake this question Injector crashes notepad instead of injecting ( edited ). I’m slightly a beginner at visual studio now because I used to use it quite frequently but I came back to learn about dll injecting because its a bit interesting but heres my problem, I am trying to make a dll injector to get the grasp of visual studio’s c++ launguage and stuff but the main problem is that the target program crashes instead of injecting maybe because its overworking the process or something like that but heres the code and the dll its injecting.
Main program:
#include <Windows.h>
#include <TlHelp32.h>
#include <string>
#include <stdio.h>
using namespace std;
#pragma comment(lib, "ntdll.lib")
extern "C" NTSTATUS NTAPI RtlAdjustPrivilege(ULONG Privilege, BOOLEAN Enable, BOOLEAN CurrentThread, BOOLEAN* Enabled);
#define SE_DEBUG_PRIVILEGE 20
unsigned char shell_code[] = {
0x50, // push rax
0x53, // push rbx
0x51, // push rcx
0x52, // push rdx
0x56, // push rsi
0x57, // push rdi
0x55, // push rbp
0x41, 0x50, // push r8
0x41, 0x51, // push r9
0x41, 0x52, // push r10
0x41, 0x53, // push r11
0x41, 0x54, // push r12
0x41, 0x55, // push r13
0x41, 0x56, // push r14
0x41, 0x57, // push r15
0xE8, 0x00, 0x00, 0x00, 0x00, // call next
0x5B, // next: pop rbx
0x48, 0x83, 0xEB, 0x06, // sub rbx, 0x06
0x48, 0xB8, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, // mov rax, 0xCCCCCCCCCCCCCCCC
0x48, 0x8D, 0x93, 0x22, 0x00, 0x00, 0x00, // lea rdx, [rbx + 0x22]
0x52, // push rdx
0xFF, 0xD0, // call rax
0x41, 0x5F, // pop r15
0x41, 0x5E, // pop r14
0x41, 0x5D, // pop r13
0x41, 0x5C, // pop r12
0x41, 0x5B, // pop r11
0x41, 0x5A, // pop r10
0x41, 0x59, // pop r9
0x41, 0x58, // pop r8
0x5D, // pop rbp
0x5F, // pop rdi
0x5E, // pop rsi
0x5A, // pop rdx
0x59, // pop rcx
0x5B, // pop rbx
0x58, // pop rax
0x68, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, // push 0xCCCCCCCCCCCCCCCC
0xC3 // ret
};
void get_proc_id(const char* window_title, DWORD& process_id)
{
GetWindowThreadProcessId(FindWindow(NULL, window_title), &process_id);
}
void error(const char* error_title, const char* error_message)
{
MessageBox(NULL, error_message, error_title, NULL);
exit(-1);
}
bool file_exists(string file_name)
{
struct stat buffer;
return (stat(file_name.c_str(), &buffer) == 0);
}
int main()
{
LPBYTE ptr;
HANDLE h_process, h_thread, h_snap;
PVOID allocated_memory, buffer;
DWORD proc_id;
BOOLEAN buff;
THREADENTRY32 te32;
CONTEXT ctx;
char dll_path[MAX_PATH];
const char* dll_name = "DLL64.dll";
const char* window_title = "Untitled - Notepad";
te32.dwSize = sizeof(te32);
ctx.ContextFlags = CONTEXT_ARM64_FULL;
RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE, TRUE, FALSE, &buff);
if (!file_exists(dll_name))
{
error("fatal error", "DLL does not exist");
}
if (!GetFullPathName(dll_name, MAX_PATH, dll_path, nullptr))
{
error("fatal error", "Cannot get Full path name.");
}
get_proc_id(window_title, proc_id);
if (proc_id == NULL)
{
error("fatal error", "Failed to get proc id.");
}
h_process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, proc_id);
if (!h_process)
{
error("fatal error", "Cannot open a handle to the process.");
}
h_snap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (h_snap == INVALID_HANDLE_VALUE)
{
CloseHandle(h_process);
error("fatal error", "Cannot create toolhelp snapshot.");
}
Thread32First(h_snap, &te32);
while (Thread32Next(h_snap, &te32))
{
if (te32.th32OwnerProcessID == proc_id)
{
break;
}
}
CloseHandle(h_snap);
allocated_memory = VirtualAllocEx(h_process, NULL, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (!allocated_memory)
{
CloseHandle(h_process);
error("fatal error", "Cannot Allocate Memory.");
}
h_thread = OpenThread(THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID);
if (!h_thread)
{
VirtualFreeEx(h_process, allocated_memory, NULL, MEM_RELEASE);
CloseHandle(h_process);
error("fatal error", "cannot open a handle to the main thread");
}
SuspendThread(h_thread);
GetThreadContext(h_thread, &ctx);
buffer = VirtualAlloc(NULL, 65536, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
ptr = (LPBYTE)buffer;
memcpy(buffer, shell_code, sizeof(shell_code));
while (1)
{
if (*ptr == 0xb8 && *(PDWORD)(ptr + 1) == 0xCCCCCCCC)
{
*(PDWORD)(ptr + 1) = (DWORD)LoadLibraryA;
}
if (*ptr == 0x68 && *(PDWORD)(ptr + 1) == 0xCCCCCCCC)
{
*(PDWORD)(ptr + 1) = ctx.Rip;
}
if (*ptr == 0xC3)
{
ptr++;
break;
}
ptr++;
}
strcpy((char*)ptr, dll_path);
if (!WriteProcessMemory(h_process, allocated_memory, buffer, sizeof(shell_code) + strlen((char*)ptr), nullptr))
{
VirtualFreeEx(h_process, allocated_memory, NULL, MEM_RELEASE);
ResumeThread(h_thread);
CloseHandle(h_thread);
CloseHandle(h_process);
VirtualFree(buffer, NULL, MEM_RELEASE);
error("fatal error", "Failed to write process memory.");
}
ctx.Rip = (DWORD)allocated_memory;
if (!SetThreadContext(h_thread, &ctx))
{
VirtualFreeEx(h_process, allocated_memory, NULL, MEM_RELEASE);
ResumeThread(h_thread);
CloseHandle(h_thread);
CloseHandle(h_process);
VirtualFree(buffer, NULL, MEM_RELEASE);
error("fatal error", "Failed to set thread context.");
}
ResumeThread(h_thread);
CloseHandle(h_thread);
CloseHandle(h_process);
VirtualFree(buffer, NULL, MEM_RELEASE);
MessageBox(NULL, "SUCCESS", "injected", NULL);
return NULL;
}
DLL code:
#include "pch.h"
#include <Windows.h>
BOOL APIENTRY DllMain(HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
MessageBoxA(NULL, "cool", "Success", NULL);
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
MessageBoxA(NULL, "Out of here", "cool", NULL);
}
return TRUE;
}
I tried to debug it but I don’t know if I could well dubug it since it crashes it instead. Help is appreciated.