 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Maskote Expert Cheater
Reputation: 1
Joined: 10 Feb 2007 Posts: 134 Location: Somewhere breaking my neck
|
Posted: Sun Mar 29, 2009 11:27 am Post subject: [HELP] C++ DLL Injector |
|
|
Hi everyone
Recently, I've been trying to code a working DLL Injector in C++. I tried to code the whole thing by myself but failed. So I thought about finding a working DLL Injection Code on google to help me.
This is what I found :
| Code: | #include <iostream>
#include <windows.h>
using namespace::std;
int Inject(HWND hwnd, char *name);
int main()
{
char dll[]="C:\\Users\\Maskote\\Desktop\\Hacking.dll";//Change the name to the dll you want to inject.
HWND hw=0;
hw = FindWindow("Notepad",NULL);//Change Notepad to your window name.
cout<<"Coded by MadHatter.\n\n"<<endl;
if(!hw)
{
cout<<"Unable find window.\n\n"<<endl;
system("pause");
return 0;
}
if(Inject(hw,dll))
{
cout<<"DLL has injected into the process successfully.\n\n"<<endl;
}
else
{
cout<<"Couldn't inject DLL into the process.\n\n"<<endl;
}
system("pause");
return 0;
}
int Inject(HWND hwnd,char *name)
{
DWORD Pid;
HANDLE hProcess,hThread;
DWORD BytesWritten;
LPVOID mem;
GetWindowThreadProcessId(hwnd, &Pid);
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, Pid);
if(!hProcess)
return 0;
mem = VirtualAllocEx(hProcess, NULL, strlen(name), MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);
if(mem==NULL)
{
CloseHandle(hProcess);
return 0;
}
if(WriteProcessMemory(hProcess, mem, (LPVOID)name, strlen(name), &BytesWritten))
{
hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("KERNEL32.DLL"), "LoadLibraryA"), mem, 0, NULL);
if(!hThread)
{
VirtualFreeEx(hProcess,NULL,strlen(name),MEM_RESERVE|MEM_COMMIT);
CloseHandle(hProcess);
return 0;
}
VirtualFreeEx(hProcess,NULL,strlen(name),MEM_RESERVE|MEM_COMMIT);
CloseHandle(hThread);
CloseHandle(hProcess);
return 1;
}
VirtualFreeEx(hProcess,NULL,strlen(name),MEM_RESERVE|MEM_COMMIT);
CloseHandle(hProcess);
return 0;
} |
The code is supposed to work "out of the box" on a Console Application(Just copy and paste). However, I couldn't get the damn thing to work. I'm trying to inject my DLL (a simple one that show a message box) in notepad. I'm using windows vista. While using other DLL Injection Code, I found that alot of time, the problem happen when the CreateRemoteThread is called.
Finaly, when I compile the code, there is no errors or warning.
Thanks for your help!
_________________
Major Trainers Created : 4
Currently Working On : Perfectioning my C++ knowledge.
Want me to create a trainer for a specific game? PM me, maybe I'm bored and I'll help you  |
|
| Back to top |
|
 |
lurc Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006 Posts: 1900
|
Posted: Sun Mar 29, 2009 12:09 pm Post subject: |
|
|
| Code: | BOOL InjectDLL(__in HANDLE hProcess, __in_z LPCTSTR lpDll)
{
BOOL bRET = FALSE;
HANDLE hThread;
SIZE_T nSize = 0;
LPVOID lpMem = VirtualAllocEx(hProcess, NULL, sizeof(TCHAR)*(lstrlen(lpDll)+1), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (lpMem != NULL)
{
if (WriteProcessMemory(hProcess, lpMem, lpDll, sizeof(TCHAR)*(lstrlen(lpDll)+1), &nSize))
{
if (nSize == sizeof(TCHAR)*(lstrlen(lpDll)+1))
{
hThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibrary, lpMem, 0, 0);
if (hThread != NULL)
bRET = (WaitForSingleObject(hThread, 10000) != WAIT_TIMEOUT);
}
}
VirtualFreeEx(hProcess, lpMem, nSize, MEM_DECOMMIT);
}
return bRET;
} |
Get the process handle and call this.
_________________
|
|
| Back to top |
|
 |
Anden100 Grandmaster Cheater
Reputation: 0
Joined: 20 Apr 2007 Posts: 668
|
Posted: Sun Mar 29, 2009 12:46 pm Post subject: |
|
|
You really should try to do some more checks if an error has occured, and if an error occured, then print where the error occured, together with the return value of GetLastError()
The value returned by GetLastError() can be found here, for further explination: http://msdn.microsoft.com/en-us/library/ms681381.aspx
If you try your source code at XP, it might succeed, but as you mentioned, you are running Vista, causeing this line to fail:
| Code: | | hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, Pid); |
Atleast, i was caused by that, to solve it, take a look at AdjustTokenPrivileges:
http://msdn.microsoft.com/en-us/library/aa375202(VS.85).aspx
Together with that, use lurc's code, its better
|
|
| Back to top |
|
 |
Maskote Expert Cheater
Reputation: 1
Joined: 10 Feb 2007 Posts: 134 Location: Somewhere breaking my neck
|
Posted: Sun Mar 29, 2009 6:23 pm Post subject: |
|
|
Ok Guys, I've been working on this almost the whole day, trying to set the Token Privilege and everything. Until I found again that it WAS NOT the problem. I've did several Debugging test and found what I said before : PROCESS_ALL_ACCESS works, the problem is in my CreateRemoteThread function wich always return a NULL value.
I tried multiple DLL Injection code, and found that everytime, the problem was with the CreateRemoteThread function.
I even tried a software that injects your DLL in a process of your choice. Guess what? The software log said : "Error in CreateRemoteThread". Looks like the problem is on my PC, right?
I'm so confused now, what should I do?
_________________
Major Trainers Created : 4
Currently Working On : Perfectioning my C++ knowledge.
Want me to create a trainer for a specific game? PM me, maybe I'm bored and I'll help you  |
|
| Back to top |
|
 |
Anden100 Grandmaster Cheater
Reputation: 0
Joined: 20 Apr 2007 Posts: 668
|
Posted: Mon Mar 30, 2009 1:35 am Post subject: |
|
|
| Maskote wrote: | Ok Guys, I've been working on this almost the whole day, trying to set the Token Privilege and everything. Until I found again that it WAS NOT the problem. I've did several Debugging test and found what I said before : PROCESS_ALL_ACCESS works, the problem is in my CreateRemoteThread function wich always return a NULL value.
I tried multiple DLL Injection code, and found that everytime, the problem was with the CreateRemoteThread function.
I even tried a software that injects your DLL in a process of your choice. Guess what? The software log said : "Error in CreateRemoteThread". Looks like the problem is on my PC, right?
I'm so confused now, what should I do? |
What error code does GetLastError() return?, its often a pretty useful information
try to change this line
| Code: | | hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("KERNEL32.DLL"), "LoadLibraryA"), mem, 0, NULL); |
to
| Code: | | hThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibrary, mem, 0, 0); |
|
|
| Back to top |
|
 |
tombana Master Cheater
Reputation: 2
Joined: 14 Jun 2007 Posts: 456 Location: The Netherlands
|
Posted: Mon Mar 30, 2009 8:21 am Post subject: |
|
|
| Anden100 wrote: |
try to change this line
| Code: | | hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("KERNEL32.DLL"), "LoadLibraryA"), mem, 0, NULL); |
to
| Code: | | hThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibrary, mem, 0, 0); |
|
That won't always work. Sometimes 'the address of LoadLibrary' can be the address of a place in the IAT, so with a jmp to the real address. So in the remote process that address probably won't be valid.
|
|
| Back to top |
|
 |
Maskote Expert Cheater
Reputation: 1
Joined: 10 Feb 2007 Posts: 134 Location: Somewhere breaking my neck
|
Posted: Mon Mar 30, 2009 1:54 pm Post subject: |
|
|
| Quote: | | That won't always work. Sometimes 'the address of LoadLibrary' can be the address of a place in the IAT, so with a jmp to the real address. So in the remote process that address probably won't be valid. |
You were right, the code did not work at all...
And Anden, GetLastError() won't work since the app won't return an error, just a NULL value (In the CreateRemoteThread function).
Is there anyone running vista who has a working DLL Injector source code that I can test?
Oh and by the way, I'm using Visual C++ Express.
_________________
Major Trainers Created : 4
Currently Working On : Perfectioning my C++ knowledge.
Want me to create a trainer for a specific game? PM me, maybe I'm bored and I'll help you  |
|
| Back to top |
|
 |
himpula How do I cheat?
Reputation: 0
Joined: 26 Dec 2007 Posts: 5
|
Posted: Mon Mar 30, 2009 2:02 pm Post subject: |
|
|
Here is a perfectly working dll injector. It's coded in C++ 6.0.
attachment too big and "I'm not worthy enough to post an url." Wtf.
Here it is anyways www dot mediafire dot com/?1njci5mnnmm
I have used it with a dll cheat I made for counter-strike and it never had any problems.
|
|
| Back to top |
|
 |
Anden100 Grandmaster Cheater
Reputation: 0
Joined: 20 Apr 2007 Posts: 668
|
Posted: Mon Mar 30, 2009 2:21 pm Post subject: |
|
|
The source code you posted works just fine for me, and im running Vista Business...
This is the source for the .dll i inject:
| Code: | #include <windows.h>
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved){
if (ul_reason_for_call == DLL_PROCESS_ATTACH){
MessageBox(NULL, "Something", "Hello!", 0);
}
return TRUE;
} |
|
|
| Back to top |
|
 |
Maskote Expert Cheater
Reputation: 1
Joined: 10 Feb 2007 Posts: 134 Location: Somewhere breaking my neck
|
Posted: Mon Mar 30, 2009 5:28 pm Post subject: |
|
|
Anden, I tested the DLL that I made with an Injection Software and my DLL worked. So the problem is obviously in my c++ injector.
Oh and himpula, I tried your Injector, but what ever I do, the injector never find the DLL...
I changer the process to notepad.exe :
| Code: | | #define APP_EXE "notepad.exe" //change this!!! |
And the DLL to mine :
| Code: | char dllname[MAX_PATH];
GetModuleFileName(0, dllname, MAX_PATH);
dllname[strlen(dllname)-3] = 0;
strcat(dllname, "C:\\Users\\Maskote\\Desktop\\Hacking.dll"); |
But the injector always fail when finding my DLL. There are no errors during the compilation.
Am I using it the wrong way ? (I'm in the main.cpp)
_________________
Major Trainers Created : 4
Currently Working On : Perfectioning my C++ knowledge.
Want me to create a trainer for a specific game? PM me, maybe I'm bored and I'll help you  |
|
| Back to top |
|
 |
sloppy Expert Cheater
Reputation: 0
Joined: 17 Aug 2008 Posts: 123
|
Posted: Mon Mar 30, 2009 7:18 pm Post subject: |
|
|
| Unless it has changed in Vista.. shouldn't the path to your desktop folder be "?:\Documents and Settings\[user]\Desktop"? Try using SHGetFolderPath / GetOpenFileName.
|
|
| Back to top |
|
 |
Maskote Expert Cheater
Reputation: 1
Joined: 10 Feb 2007 Posts: 134 Location: Somewhere breaking my neck
|
Posted: Tue Mar 31, 2009 3:20 pm Post subject: |
|
|
Omg, I just found something. Since the beginning, I was always testing my injection codes on Notepad or the Calculator. SoI tried on msnmsgr.exe (MSN Messenger) and the injection worked! But still, I have a major problem, 1 time out of 4, the injection works. The other times, they say that the injection was succesful but my message box never appear (my dll is supposed to show a MessageBox). And yes my DLL works properly, tested it with an Injection Software...
What is causing that?
Sloppy --> "?:\Documents and Settings\[user]\Desktop" makes no difference.
Thanks for helping me guys, I can feel that I'm damn close to get it to work.
EDIT : I finaly got it. It was a weird thing. Most of the time, the injector did NOT allocate enought space for the DLL... fixed everything and now it works like a charm. There is only one more thing I need to know... Normaly, for the DLL, I just put : "C:\\Users\\Maskote\\... ". But today I sent the injector to one of my friend so he can test if I really fixed the problem. To do this, I changed the path "C:\\Users\\Maskote\\Desktop\\Hacking.dll" to "Hacking.dll" and joigned the DLL with the exe and sent him the whole thing in a Compressed Archive. I told him to extract the DLL and the Exe at the same place... But, as you predicted, it did not work... I tested it on my computer and it did not work either, I always have to know the full path to the DLL... How can I fix this ?
_________________
Major Trainers Created : 4
Currently Working On : Perfectioning my C++ knowledge.
Want me to create a trainer for a specific game? PM me, maybe I'm bored and I'll help you  |
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|