Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Code Project
  1. Home
  2. General Programming
  3. C / C++ / MFC
  4. Dll injection and hooking

Dll injection and hooking

Scheduled Pinned Locked Moved C / C++ / MFC
graphicsquestion
2 Posts 1 Posters 0 Views 1 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M Offline
    M Offline
    miniman06
    wrote on last edited by
    #1

    Hello once again,I have been working on some project for a while now and I needed to hook a creation of processes,I have that code(hook/detour)

    BOOL WINAPI CreateProcH::CreateProcessInternalW ( HANDLE hToken,
    LPCWSTR lpApplicationName,
    LPWSTR lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL bInheritHandles,
    DWORD dwCreationFlags,
    LPVOID lpEnvironment,
    LPCWSTR lpCurrentDirectory,
    LPSTARTUPINFOW lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation,
    PHANDLE hNewToken
    )
    clogf("start %x ref: %x",realCreateProcessInternalW,&realCreateProcessInternalW);
    BOOL res = FALSE;
    res = realCreateProcessInternalW(hToken,lpApplicationName,lpCommandLine,lpProcessAttributes,lpThreadAttributes,bInheritHandles,dwCreationFlags,lpEnvironment,lpCurrentDirectory,lpStartupInfo,lpProcessInformation,hNewToken);
    if(res == FALSE)
    return res;

    Sleep(100);//let it load
    
    vector ::iterator it;
    for(it = pubvPaths.begin(); it < pubvPaths.end(); it++)
    {	
    	if(!CDetour::InjectDll(lpProcessInformation->hProcess,\*it))
    		clogf("InjectDll(lpProcessInformation->hProcess,\*it) FAILED!");
    	clogf("Strlen %d Injecting dll: %ls",lstrlenW(\*it),\*it);
    }
    clogf("hThread: %d hProcess: %d dwThreadId: %d dwProcessId: %d",lpProcessInformation->hThread,lpProcessInformation->hProcess,lpProcessInformation->dwThreadId,lpProcessInformation->dwProcessId);
    return res;
    

    };

    LOG:

    [Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: start 7d843e8 ref: 741285ac
    [Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: Strlen 103 Injecting dll: C:/Users/JEAN/SplitPLayGUI-build-desktop-Qt_4_8_1_for_Desktop_-_MSVC2010__Qt_SDK__Debug/CreateProcH.dll
    [Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: hThread: 5360 hProcess: 5376 dwThreadId: 8376 dwProcessId: 1388

    but the process fails to create or crashes not sure what is wrong, So I just commented out

    if(!CDetour::InjectDll(lpProcessInformation->hProcess,*it))
    clogf("InjectDll(lpProcessInformation->hProcess,*it) FAILED!");

    and everything logged the same way but the process actually created and ran, here is CDetour::InjectDll

    bool CDetour::InjectDll(HANDLE hProcess ,wchar_t * pwstrDll)
    {
    LPVOID Remo

    M 1 Reply Last reply
    0
    • M miniman06

      Hello once again,I have been working on some project for a while now and I needed to hook a creation of processes,I have that code(hook/detour)

      BOOL WINAPI CreateProcH::CreateProcessInternalW ( HANDLE hToken,
      LPCWSTR lpApplicationName,
      LPWSTR lpCommandLine,
      LPSECURITY_ATTRIBUTES lpProcessAttributes,
      LPSECURITY_ATTRIBUTES lpThreadAttributes,
      BOOL bInheritHandles,
      DWORD dwCreationFlags,
      LPVOID lpEnvironment,
      LPCWSTR lpCurrentDirectory,
      LPSTARTUPINFOW lpStartupInfo,
      LPPROCESS_INFORMATION lpProcessInformation,
      PHANDLE hNewToken
      )
      clogf("start %x ref: %x",realCreateProcessInternalW,&realCreateProcessInternalW);
      BOOL res = FALSE;
      res = realCreateProcessInternalW(hToken,lpApplicationName,lpCommandLine,lpProcessAttributes,lpThreadAttributes,bInheritHandles,dwCreationFlags,lpEnvironment,lpCurrentDirectory,lpStartupInfo,lpProcessInformation,hNewToken);
      if(res == FALSE)
      return res;

      Sleep(100);//let it load
      
      vector ::iterator it;
      for(it = pubvPaths.begin(); it < pubvPaths.end(); it++)
      {	
      	if(!CDetour::InjectDll(lpProcessInformation->hProcess,\*it))
      		clogf("InjectDll(lpProcessInformation->hProcess,\*it) FAILED!");
      	clogf("Strlen %d Injecting dll: %ls",lstrlenW(\*it),\*it);
      }
      clogf("hThread: %d hProcess: %d dwThreadId: %d dwProcessId: %d",lpProcessInformation->hThread,lpProcessInformation->hProcess,lpProcessInformation->dwThreadId,lpProcessInformation->dwProcessId);
      return res;
      

      };

      LOG:

      [Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: start 7d843e8 ref: 741285ac
      [Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: Strlen 103 Injecting dll: C:/Users/JEAN/SplitPLayGUI-build-desktop-Qt_4_8_1_for_Desktop_-_MSVC2010__Qt_SDK__Debug/CreateProcH.dll
      [Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: hThread: 5360 hProcess: 5376 dwThreadId: 8376 dwProcessId: 1388

      but the process fails to create or crashes not sure what is wrong, So I just commented out

      if(!CDetour::InjectDll(lpProcessInformation->hProcess,*it))
      clogf("InjectDll(lpProcessInformation->hProcess,*it) FAILED!");

      and everything logged the same way but the process actually created and ran, here is CDetour::InjectDll

      bool CDetour::InjectDll(HANDLE hProcess ,wchar_t * pwstrDll)
      {
      LPVOID Remo

      M Offline
      M Offline
      miniman06
      wrote on last edited by
      #2

      Since nobody replied I made a much deeper research on my own, and found out that I can't really use the same DLL injection way that is used when the process is already loaded.

      1 Reply Last reply
      0
      Reply
      • Reply as topic
      Log in to reply
      • Oldest to Newest
      • Newest to Oldest
      • Most Votes


      • Login

      • Don't have an account? Register

      • Login or register to search.
      • First post
        Last post
      0
      • Categories
      • Recent
      • Tags
      • Popular
      • World
      • Users
      • Groups