Since nobody replied I made a much deeper research on my own, and found out that I can't really use the same DLL injection way that is used when the process is already loaded.
miniman06
Posts
-
Dll injection and hooking -
Dll injection and hookingHello once again,I have been working on some project for a while now and I needed to hook a creation of processes,I have that code(hook/detour)
BOOL WINAPI CreateProcH::CreateProcessInternalW ( HANDLE hToken,
LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation,
PHANDLE hNewToken
)
clogf("start %x ref: %x",realCreateProcessInternalW,&realCreateProcessInternalW);
BOOL res = FALSE;
res = realCreateProcessInternalW(hToken,lpApplicationName,lpCommandLine,lpProcessAttributes,lpThreadAttributes,bInheritHandles,dwCreationFlags,lpEnvironment,lpCurrentDirectory,lpStartupInfo,lpProcessInformation,hNewToken);
if(res == FALSE)
return res;Sleep(100);//let it load vector ::iterator it; for(it = pubvPaths.begin(); it < pubvPaths.end(); it++) { if(!CDetour::InjectDll(lpProcessInformation->hProcess,\*it)) clogf("InjectDll(lpProcessInformation->hProcess,\*it) FAILED!"); clogf("Strlen %d Injecting dll: %ls",lstrlenW(\*it),\*it); } clogf("hThread: %d hProcess: %d dwThreadId: %d dwProcessId: %d",lpProcessInformation->hThread,lpProcessInformation->hProcess,lpProcessInformation->dwThreadId,lpProcessInformation->dwProcessId); return res;
};
LOG:
[Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: start 7d843e8 ref: 741285ac
[Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: Strlen 103 Injecting dll: C:/Users/JEAN/SplitPLayGUI-build-desktop-Qt_4_8_1_for_Desktop_-_MSVC2010__Qt_SDK__Debug/CreateProcH.dll
[Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: hThread: 5360 hProcess: 5376 dwThreadId: 8376 dwProcessId: 1388but the process fails to create or crashes not sure what is wrong, So I just commented out
if(!CDetour::InjectDll(lpProcessInformation->hProcess,*it))
clogf("InjectDll(lpProcessInformation->hProcess,*it) FAILED!");and everything logged the same way but the process actually created and ran, here is CDetour::InjectDll
bool CDetour::InjectDll(HANDLE hProcess ,wchar_t * pwstrDll)
{
LPVOID Remo -
Strange memory leakthat pretty much solved me the problem something to note delete still calls the destructor. so the auto delete code that you provided will cause an exception.
Process::~Process()
{
if(m_bDeallocated)
return;delete m\_proc; delete \[\] m\_filename; m\_bDeallocated = true; if (m\_bAutoDelete) delete this; //will call this destructor again and cause trouble
}
-
Strange memory leakVisual Leak Detector Version 2.2.3 installed.
No memory leaks detected.
Visual Leak Detector is now exiting.
The program '[9248] ProcEnum.exe' has exited with code 0 (0x0).Not a false positive.
-
Strange memory leaknot that either it's around 500~ bytes and I'm deallocating that too :/
-
Strange memory leakit's not used ,its deallocating it anyway...
-
Strange memory leak//process.h
private:
PROCESSENTRY32 * m_proc;
char * m_filename;
bool m_stringupdated;//process.cpp
Process::Process()
{
m_proc = new PROCESSENTRY32;
m_proc->dwSize = sizeof(PROCESSENTRY32);
m_stringupdated = false;
m_filename = NULL;
}
//process.cpp
Process::~Process()
{
delete m_proc;
if(m_filename)
delete [] m_filename;
}//main
Process * allo = new Process();
allo->~Process();VLD reports:
Visual Leak Detector Version 2.2.3 installed.
WARNING: Visual Leak Detector detected memory leaks!
---------- Block 1 at 0x005A2100: 12 bytes ----------
Call Stack:
c:\users\jean\documents\visual studio 2012\projects\procenum\procenum\procenum.cpp (26): ProcEnum.exe!wmain + 0x7 bytes
f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c (533): ProcEnum.exe!__tmainCRTStartup + 0x19 bytes
f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c (377): ProcEnum.exe!wmainCRTStartup
0x760A33AA (File and line number not available): kernel32.dll!BaseThreadInitThunk + 0x12 bytes
0x76CF9EF2 (File and line number not available): ntdll.dll!RtlInitializeExceptionChain + 0x63 bytes
0x76CF9EC5 (File and line number not available): ntdll.dll!RtlInitializeExceptionChain + 0x36 bytes
Data:
48 21 5A 00 00 00 00 00 00 CD CD CD H!Z..... ........Visual Leak Detector detected 1 memory leak (48 bytes).
Largest number used: 640 bytes.
Total allocations: 640 bytes.
Visual Leak Detector is now exiting.
The program '[10680] ProcEnum.exe' has exited with code 0 (0x0).I'm freaking out guys I just don't see the leak ,Thanks in advance :) .