Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


[HELP] C++ DLL Injector

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
Maskote
Expert Cheater
Reputation: 1

Joined: 10 Feb 2007
Posts: 134
Location: Somewhere breaking my neck

PostPosted: Sun Mar 29, 2009 11:27 am    Post subject: [HELP] C++ DLL Injector Reply with quote

Hi everyone

Recently, I've been trying to code a working DLL Injector in C++. I tried to code the whole thing by myself but failed. So I thought about finding a working DLL Injection Code on google to help me.

This is what I found :

Code:
#include <iostream>
#include <windows.h>

using namespace::std;

int Inject(HWND hwnd, char *name);

int main()
{
   char dll[]="C:\\Users\\Maskote\\Desktop\\Hacking.dll";//Change the name to the dll you want to inject.
   HWND hw=0;

 
      hw = FindWindow("Notepad",NULL);//Change Notepad to your window name.

      cout<<"Coded by MadHatter.\n\n"<<endl;
     
      if(!hw)
      {
         cout<<"Unable find window.\n\n"<<endl;
         system("pause");
         return 0;
      }

      if(Inject(hw,dll))
      {
         cout<<"DLL has injected into the process successfully.\n\n"<<endl;
      }

      else
      {
         cout<<"Couldn't inject DLL into the process.\n\n"<<endl;
      }

   system("pause");
   return 0;
}


int Inject(HWND hwnd,char *name)
{
   DWORD Pid;
   HANDLE    hProcess,hThread;
   DWORD   BytesWritten;
   LPVOID    mem;
 

   GetWindowThreadProcessId(hwnd, &Pid);


   hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, Pid);

   if(!hProcess)
      return 0;


   mem = VirtualAllocEx(hProcess, NULL,  strlen(name), MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);

   if(mem==NULL)
   {
CloseHandle(hProcess);
return 0;
   }

   if(WriteProcessMemory(hProcess, mem, (LPVOID)name,  strlen(name), &BytesWritten))
   {
   
      hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("KERNEL32.DLL"), "LoadLibraryA"), mem, 0, NULL);
   
      if(!hThread)
      {
          VirtualFreeEx(hProcess,NULL,strlen(name),MEM_RESERVE|MEM_COMMIT);
CloseHandle(hProcess);
         return 0;
      }
      VirtualFreeEx(hProcess,NULL,strlen(name),MEM_RESERVE|MEM_COMMIT);
         
            CloseHandle(hThread);
               CloseHandle(hProcess);

      return 1;
     

   }   
   VirtualFreeEx(hProcess,NULL,strlen(name),MEM_RESERVE|MEM_COMMIT);

               CloseHandle(hProcess);
             
   return 0;
}


The code is supposed to work "out of the box" on a Console Application(Just copy and paste). However, I couldn't get the damn thing to work. I'm trying to inject my DLL (a simple one that show a message box) in notepad. I'm using windows vista. While using other DLL Injection Code, I found that alot of time, the problem happen when the CreateRemoteThread is called.

Finaly, when I compile the code, there is no errors or warning.

Thanks for your help!

_________________



Major Trainers Created : 4
Currently Working On : Perfectioning my C++ knowledge.

Want me to create a trainer for a specific game? PM me, maybe I'm bored and I'll help you Wink
Back to top
View user's profile Send private message
lurc
Grandmaster Cheater Supreme
Reputation: 2

Joined: 13 Nov 2006
Posts: 1900

PostPosted: Sun Mar 29, 2009 12:09 pm    Post subject: Reply with quote

Code:
BOOL InjectDLL(__in HANDLE hProcess, __in_z LPCTSTR lpDll)
{
   BOOL     bRET = FALSE;
   HANDLE   hThread;
   SIZE_T   nSize = 0;
   LPVOID   lpMem = VirtualAllocEx(hProcess, NULL, sizeof(TCHAR)*(lstrlen(lpDll)+1), MEM_COMMIT, PAGE_EXECUTE_READWRITE);

   if (lpMem != NULL)
   {
      if (WriteProcessMemory(hProcess, lpMem, lpDll, sizeof(TCHAR)*(lstrlen(lpDll)+1), &nSize))
      {
         if (nSize == sizeof(TCHAR)*(lstrlen(lpDll)+1))
         {
            hThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibrary, lpMem, 0, 0);
            if (hThread != NULL)
               bRET = (WaitForSingleObject(hThread, 10000) != WAIT_TIMEOUT);
         }
      }
      VirtualFreeEx(hProcess, lpMem, nSize, MEM_DECOMMIT);
   }
   return bRET;
}


Get the process handle and call this.

_________________
Back to top
View user's profile Send private message
Anden100
Grandmaster Cheater
Reputation: 0

Joined: 20 Apr 2007
Posts: 668

PostPosted: Sun Mar 29, 2009 12:46 pm    Post subject: Reply with quote

You really should try to do some more checks if an error has occured, and if an error occured, then print where the error occured, together with the return value of GetLastError()

The value returned by GetLastError() can be found here, for further explination: http://msdn.microsoft.com/en-us/library/ms681381.aspx

If you try your source code at XP, it might succeed, but as you mentioned, you are running Vista, causeing this line to fail:

Code:
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, Pid);


Atleast, i was caused by that, to solve it, take a look at AdjustTokenPrivileges:
http://msdn.microsoft.com/en-us/library/aa375202(VS.85).aspx

Together with that, use lurc's code, its better Wink
Back to top
View user's profile Send private message
Maskote
Expert Cheater
Reputation: 1

Joined: 10 Feb 2007
Posts: 134
Location: Somewhere breaking my neck

PostPosted: Sun Mar 29, 2009 6:23 pm    Post subject: Reply with quote

Ok Guys, I've been working on this almost the whole day, trying to set the Token Privilege and everything. Until I found again that it WAS NOT the problem. I've did several Debugging test and found what I said before : PROCESS_ALL_ACCESS works, the problem is in my CreateRemoteThread function wich always return a NULL value.

I tried multiple DLL Injection code, and found that everytime, the problem was with the CreateRemoteThread function.

I even tried a software that injects your DLL in a process of your choice. Guess what? The software log said : "Error in CreateRemoteThread". Looks like the problem is on my PC, right?


I'm so confused now, what should I do?

_________________



Major Trainers Created : 4
Currently Working On : Perfectioning my C++ knowledge.

Want me to create a trainer for a specific game? PM me, maybe I'm bored and I'll help you Wink
Back to top
View user's profile Send private message
Anden100
Grandmaster Cheater
Reputation: 0

Joined: 20 Apr 2007
Posts: 668

PostPosted: Mon Mar 30, 2009 1:35 am    Post subject: Reply with quote

Maskote wrote:
Ok Guys, I've been working on this almost the whole day, trying to set the Token Privilege and everything. Until I found again that it WAS NOT the problem. I've did several Debugging test and found what I said before : PROCESS_ALL_ACCESS works, the problem is in my CreateRemoteThread function wich always return a NULL value.

I tried multiple DLL Injection code, and found that everytime, the problem was with the CreateRemoteThread function.

I even tried a software that injects your DLL in a process of your choice. Guess what? The software log said : "Error in CreateRemoteThread". Looks like the problem is on my PC, right?


I'm so confused now, what should I do?


What error code does GetLastError() return?, its often a pretty useful information

try to change this line
Code:
hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("KERNEL32.DLL"), "LoadLibraryA"), mem, 0, NULL);

to
Code:
hThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibrary, mem, 0, 0);
Back to top
View user's profile Send private message
tombana
Master Cheater
Reputation: 2

Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands

PostPosted: Mon Mar 30, 2009 8:21 am    Post subject: Reply with quote

Anden100 wrote:

try to change this line
Code:
hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("KERNEL32.DLL"), "LoadLibraryA"), mem, 0, NULL);

to
Code:
hThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibrary, mem, 0, 0);

That won't always work. Sometimes 'the address of LoadLibrary' can be the address of a place in the IAT, so with a jmp to the real address. So in the remote process that address probably won't be valid.
Back to top
View user's profile Send private message
Maskote
Expert Cheater
Reputation: 1

Joined: 10 Feb 2007
Posts: 134
Location: Somewhere breaking my neck

PostPosted: Mon Mar 30, 2009 1:54 pm    Post subject: Reply with quote

Quote:
That won't always work. Sometimes 'the address of LoadLibrary' can be the address of a place in the IAT, so with a jmp to the real address. So in the remote process that address probably won't be valid.


You were right, the code did not work at all...

And Anden, GetLastError() won't work since the app won't return an error, just a NULL value (In the CreateRemoteThread function).

Is there anyone running vista who has a working DLL Injector source code that I can test?

Oh and by the way, I'm using Visual C++ Express.

_________________



Major Trainers Created : 4
Currently Working On : Perfectioning my C++ knowledge.

Want me to create a trainer for a specific game? PM me, maybe I'm bored and I'll help you Wink
Back to top
View user's profile Send private message
himpula
How do I cheat?
Reputation: 0

Joined: 26 Dec 2007
Posts: 5

PostPosted: Mon Mar 30, 2009 2:02 pm    Post subject: Reply with quote

Here is a perfectly working dll injector. It's coded in C++ 6.0.

attachment too big and "I'm not worthy enough to post an url." Wtf.

Here it is anyways www dot mediafire dot com/?1njci5mnnmm

I have used it with a dll cheat I made for counter-strike and it never had any problems.
Back to top
View user's profile Send private message
Anden100
Grandmaster Cheater
Reputation: 0

Joined: 20 Apr 2007
Posts: 668

PostPosted: Mon Mar 30, 2009 2:21 pm    Post subject: Reply with quote

The source code you posted works just fine for me, and im running Vista Business...

This is the source for the .dll i inject:
Code:
#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved){
   if (ul_reason_for_call == DLL_PROCESS_ATTACH){
      MessageBox(NULL, "Something", "Hello!", 0);   
   }
    return TRUE;
}
Back to top
View user's profile Send private message
Maskote
Expert Cheater
Reputation: 1

Joined: 10 Feb 2007
Posts: 134
Location: Somewhere breaking my neck

PostPosted: Mon Mar 30, 2009 5:28 pm    Post subject: Reply with quote

Anden, I tested the DLL that I made with an Injection Software and my DLL worked. So the problem is obviously in my c++ injector.

Oh and himpula, I tried your Injector, but what ever I do, the injector never find the DLL...

I changer the process to notepad.exe :
Code:
#define APP_EXE "notepad.exe" //change this!!!


And the DLL to mine :
Code:
char dllname[MAX_PATH];
GetModuleFileName(0, dllname, MAX_PATH);
dllname[strlen(dllname)-3] = 0;
strcat(dllname, "C:\\Users\\Maskote\\Desktop\\Hacking.dll");


But the injector always fail when finding my DLL. There are no errors during the compilation.

Am I using it the wrong way ? (I'm in the main.cpp)

_________________



Major Trainers Created : 4
Currently Working On : Perfectioning my C++ knowledge.

Want me to create a trainer for a specific game? PM me, maybe I'm bored and I'll help you Wink
Back to top
View user's profile Send private message
sloppy
Expert Cheater
Reputation: 0

Joined: 17 Aug 2008
Posts: 123

PostPosted: Mon Mar 30, 2009 7:18 pm    Post subject: Reply with quote

Unless it has changed in Vista.. shouldn't the path to your desktop folder be "?:\Documents and Settings\[user]\Desktop"? Try using SHGetFolderPath / GetOpenFileName.
Back to top
View user's profile Send private message
Maskote
Expert Cheater
Reputation: 1

Joined: 10 Feb 2007
Posts: 134
Location: Somewhere breaking my neck

PostPosted: Tue Mar 31, 2009 3:20 pm    Post subject: Reply with quote

Omg, I just found something. Since the beginning, I was always testing my injection codes on Notepad or the Calculator. SoI tried on msnmsgr.exe (MSN Messenger) and the injection worked! But still, I have a major problem, 1 time out of 4, the injection works. The other times, they say that the injection was succesful but my message box never appear (my dll is supposed to show a MessageBox). And yes my DLL works properly, tested it with an Injection Software...

What is causing that?

Sloppy --> "?:\Documents and Settings\[user]\Desktop" makes no difference.

Thanks for helping me guys, I can feel that I'm damn close to get it to work. Very Happy


EDIT : I finaly got it. It was a weird thing. Most of the time, the injector did NOT allocate enought space for the DLL... fixed everything and now it works like a charm. There is only one more thing I need to know... Normaly, for the DLL, I just put : "C:\\Users\\Maskote\\... ". But today I sent the injector to one of my friend so he can test if I really fixed the problem. To do this, I changed the path "C:\\Users\\Maskote\\Desktop\\Hacking.dll" to "Hacking.dll" and joigned the DLL with the exe and sent him the whole thing in a Compressed Archive. I told him to extract the DLL and the Exe at the same place... But, as you predicted, it did not work... I tested it on my computer and it did not work either, I always have to know the full path to the DLL... How can I fix this ? Confused

_________________



Major Trainers Created : 4
Currently Working On : Perfectioning my C++ knowledge.

Want me to create a trainer for a specific game? PM me, maybe I'm bored and I'll help you Wink
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites