When I Inject my dll using this c++ console application it just seems to crash notepad. I’ve checked this other one which is having the same old issue but I cant really figure it out on my code because I dont want to break much but heres my code.
EDIT: I fixed the shell code to 64 bit, I hope but Ask me if you need the old 32 bit code because this is a 64 bit console app. But now I have an error that says It cannot open a handle to the process now
#include <Windows.h>
#include <TlHelp32.h>
#include <string>
#include <stdio.h>
using namespace std;
#pragma comment(lib, "ntdll.lib")
extern "C" NTSTATUS NTAPI RtlAdjustPrivilege(ULONG Privilege, BOOLEAN Enable, BOOLEAN CurrentThread, BOOLEAN* Enabled);
#define SE_DEBUG_PRIVILEGE 20
unsigned char shell_code[] = {
0x50, // push rax
0x53, // push rbx
0x51, // push rcx
0x52, // push rdx
0x56, // push rsi
0x57, // push rdi
0x55, // push rbp
0x41, 0x50, // push r8
0x41, 0x51, // push r9
0x41, 0x52, // push r10
0x41, 0x53, // push r11
0x41, 0x54, // push r12
0x41, 0x55, // push r13
0x41, 0x56, // push r14
0x41, 0x57, // push r15
0xE8, 0x00, 0x00, 0x00, 0x00, // call next
0x5B, // next: pop rbx
0x48, 0x83, 0xEB, 0x06, // sub rbx, 0x06
0x48, 0xB8, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, // mov rax, 0xCCCCCCCCCCCCCCCC
0x48, 0x8D, 0x93, 0x22, 0x00, 0x00, 0x00, // lea rdx, [rbx + 0x22]
0x52, // push rdx
0xFF, 0xD0, // call rax
0x41, 0x5F, // pop r15
0x41, 0x5E, // pop r14
0x41, 0x5D, // pop r13
0x41, 0x5C, // pop r12
0x41, 0x5B, // pop r11
0x41, 0x5A, // pop r10
0x41, 0x59, // pop r9
0x41, 0x58, // pop r8
0x5D, // pop rbp
0x5F, // pop rdi
0x5E, // pop rsi
0x5A, // pop rdx
0x59, // pop rcx
0x5B, // pop rbx
0x58, // pop rax
0x68, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, // push 0xCCCCCCCCCCCCCCCC
0xC3 // ret
};
void get_proc_id(const char* window_title, DWORD& process_id)
{
GetWindowThreadProcessId(FindWindow(NULL, window_title), &process_id);
}
void error(const char* error_title, const char* error_message)
{
MessageBox(NULL, error_message, error_title, NULL);
exit(-1);
}
bool file_exists(string file_name)
{
struct stat buffer;
return (stat(file_name.c_str(), &buffer) == 0);
}
int main()
{
LPBYTE ptr;
HANDLE h_process, h_thread, h_snap;
PVOID allocated_memory, buffer;
DWORD proc_id;
BOOLEAN buff;
THREADENTRY32 te32;
CONTEXT ctx;
char dll_path[MAX_PATH];
const char* dll_name = "DLL64.dll";
const char* window_title = "Untitled - Notepad";
te32.dwSize = sizeof(te32);
ctx.ContextFlags = CONTEXT_ARM64_FULL;
RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE, TRUE, FALSE, &buff);
if (!file_exists(dll_name))
{
error("fatal error", "DLL does not exist");
}
if (!GetFullPathName(dll_name, MAX_PATH, dll_path, nullptr))
{
error("fatal error", "Cannot get Full path name.");
}
get_proc_id(window_title, proc_id);
if (proc_id == NULL)
{
error("fatal error", "Failed to get proc id.");
}
h_process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, proc_id);
if (!h_process)
{
error("fatal error", "Cannot open a handle to the process.");
}
h_snap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (h_snap == INVALID_HANDLE_VALUE)
{
CloseHandle(h_process);
error("fatal error", "Cannot create toolhelp snapshot.");
}
Thread32First(h_snap, &te32);
while (Thread32Next(h_snap, &te32))
{
if (te32.th32OwnerProcessID == proc_id)
{
break;
}
}
CloseHandle(h_snap);
allocated_memory = VirtualAllocEx(h_process, NULL, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (!allocated_memory)
{
CloseHandle(h_process);
error("fatal error", "Cannot Allocate Memory.");
}
h_thread = OpenThread(THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID);
if (!h_thread)
{
VirtualFreeEx(h_process, allocated_memory, NULL, MEM_RELEASE);
CloseHandle(h_process);
error("fatal error", "cannot open a handle to the main thread");
}
SuspendThread(h_thread);
GetThreadContext(h_thread, &ctx);
buffer = VirtualAlloc(NULL, 65536, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
ptr = (LPBYTE)buffer;
memcpy(buffer, shell_code, sizeof(shell_code));
while (1)
{
if (*ptr == 0xb8 && *(PDWORD)(ptr + 1) == 0xCCCCCCCC)
{
*(PDWORD)(ptr + 1) = (DWORD)LoadLibraryA;
}
if (*ptr == 0x68 && *(PDWORD)(ptr + 1) == 0xCCCCCCCC)
{
*(PDWORD)(ptr + 1) = ctx.Rip;
}
if (*ptr == 0xC3)
{
ptr++;
break;
}
ptr++;
}
strcpy((char*)ptr, dll_path);
if (!WriteProcessMemory(h_process, allocated_memory, buffer, sizeof(shell_code) + strlen((char*)ptr), nullptr))
{
VirtualFreeEx(h_process, allocated_memory, NULL, MEM_RELEASE);
ResumeThread(h_thread);
CloseHandle(h_thread);
CloseHandle(h_process);
VirtualFree(buffer, NULL, MEM_RELEASE);
error("fatal error", "Failed to write process memory.");
}
ctx.Rip = (DWORD)allocated_memory;
if (!SetThreadContext(h_thread, &ctx))
{
VirtualFreeEx(h_process, allocated_memory, NULL, MEM_RELEASE);
ResumeThread(h_thread);
CloseHandle(h_thread);
CloseHandle(h_process);
VirtualFree(buffer, NULL, MEM_RELEASE);
error("fatal error", "Failed to set thread context.");
}
ResumeThread(h_thread);
CloseHandle(h_thread);
CloseHandle(h_process);
VirtualFree(buffer, NULL, MEM_RELEASE);
MessageBox(NULL, "SUCCESS", "injected", NULL);
return NULL;
}
I tried to research and a lot of stuff but still haven’t fixed my code crashing the target process.
8