Cheat Engine

[Polynomial]

I'm injecting some code into another process using VirtualAllocEx, WriteProcessMemory and CreateRemoteThread. I've tested this with some infinite loop code (a few nops and a jmp) which works perfectly, creating a thread that eats up 100% of my CPU time on one core.

What I'd like to do is call an API such as MessageBoxA from the remote process, but because of ASLR and the fact that the remote process may not be the same each time (I'm injecting into multiple versions of the same process) I'm having trouble detecting the address of such APIs so that they can be called from my injected code.

I'm guessing I'd need to identify the location of the IAT, then scan it for the address of the API that I want to call, somehow identifying it in the list. Any ideas how I'd go about this?

[tombana]

You could do it through the IAT of the remote process, or use CreateToolhelp32Snapshot to get a list of remote modules.
If you get the correct address of 'GetProcAddress' and put it in the code stub then you can get the other addresses with the code from there.

[atom0s]

You can obtain the API (MessageBoxA) address inside your current application and inject a block to call the address. You can

Heres a small example I wrote for someone a while back:

[Polynomial]

I can get the base address of the module without using GetProcAddress, since I'm coding in .NET and the Process class provides a list of loaded modules. However, I don't know how to get the relative address from base to the exported function I want. Any ideas on how to do this?

[atom0s]

Calculate it based on where your allocation is and where you are writing it inside your 'cave'.

Your VirtualAllocEx call will return the base of your cave.

API Address - Cave Base + Offset in cave - 4

[Polynomial]

I know how to calculate that offset, but it's the API address I need to find. I know the base address of the module, but not the actual address of the API. I can find the address of the ASCII names in the DLL image, but I don't know how they map to the address.

[tombana]

[Polynomial]

I'm coding this in .NET, so GetProcAddress won't work

[atom0s]

[justa_dude]

The above suggestions work, but they're all kind of a pain to implement. Writing a native DLL for injection is just so much easier.

Otherwise, I'd probably look to inject a script engine (lua, underc, perl, python, ruby, whatever) if the target app is running on a system that either already has the script engine/libraries installed or can be made to install them. Then you can wrap the processes of creating remote memory for a script, writing the script to remote memory, asking the interpreter to execute the script and freeing the memory in a trivially simple function. All of the scripting languages I can think of include dynaloading and win32 api support.

Lastly, there are a few just-in-time compilers. If you go down the path you're heading, I /highly/ recommend looking into them. The process of writing and patching shell-code (i.e., the replace-strings in Wicca's btFunction) is ugly, error-prone, and very difficult code to maintain.

Cheers,
adude

[Polynomial]

[justa_dude]

[angelababy]

Then you can wrap the processes of creating remote memory for a script, writing the script to remote memory, asking the interpreter to execute the script and freeing the memory in a trivially simple function.

[Polynomial]

[justa_dude]

It may not be a function of ASLR, but it is a fact that dlls are not always mapped into the same virtual address space from one process to the next. It is also a fact that getmodulehandle is only intended to retrieve information related to the calling process.