3

I saw a similar, but still different question to this, so just to clarify this is not a dupe of 13428881 (Calling a function in an injected DLL).

What I have at the minute: A DLL, injected into a target process, displaying a message box and fiddling around doing math.

What I want in the future: A DLL which can manipulate and toy with the internals of the target process.

The next step towards achieving the desired manipulation is to call a method in a remote thread within the process I'm injecting into.

Let's take an example: I have a C++ application, which has int main, let's say it looks like this:

int PrintText(string text)
{
    cout << text;
    return 1;
}

int main()
{
    while (true)
    {
        PrintText("From the DLL");
    }
}

Ok, so that's lovely, my target application is currently printing some text, and it seems to be doing so very happily. It's spamming it at an unbelievable rate, but I can slow it down using threads and sleeps etc if I need to. The fact is this isn't an issue, the code here hasn't been compiled or tested, and I've no intention of using this exact code. I'm actually working with a game.

Now, let's say I create a pointer to the method, PrintText, and that I know the address of it within that process. How do I go about calling it, externally, passing in arguments?

Locally, I believe it would look something like this:

int i;
int (*PrintSomeText)(string) = PrintText;

I could then call this function using a reference, like so:

i = operation("Text to be printed", PrintSomeText);

This should, by my theory, declare an integer called i, then define a pointer to a method which returns int, takes one string as a parameter, and the pointer stores the value of the pointer which was in PrintText. (Or something of that nature).

Very nice, so I can call my own functions via pointer, that's great, cracking in fact. I've truly astonished myself with this ability, and I do now feel like superman. I'll go save some babies or something, brb.

Back, so now I want to continue a little further, and take that next step. Let's say I know that the the method is at the address 100 in the target process (decimal, I will likely do it in hexadecimal, as I'm using CheatEngine / OllyDBG to find methods in the target process, but for this example we'll stay simple).

I presume that my injected DLL gets its own space entirely, does it have any higher access to the target process? How can I find this out?

Thanks for your time, Josh

Edit: A small note, I'm going through the C++ tutorial book, and it's proven so far to be very useful. I've noticed that I forgot to include my operation method, so apologies for that being missing. If it's required, let me know. Thanks!

Edit nr 2: I've just made some compilable code to test this out, since I wrote most of this free hand reading from the book without an IDE, and the IDE has finally configured itself, so here is the code I'm currently working with

#include "stdafx.h"
#include <iostream>

using namespace std;

int PrintText(char * Text)
{
    cout << Text << endl;
    return 1;
}

int _tmain(int argc, _TCHAR* argv[])
{
    int (*Print)(char*) = PrintText;
    char Text[] = "Hello, world!";
    PrintText(Text);
    int x = (*Print)("Oh my word, it really works!");
    cin.get();
    return 0;
}

Note I haven't yet made it run indefinitely, so yeah, please excuse that, I'll add it shortly.

4

1 回答 1

5

Dauphic 非常成功，我可以完全控制目标进程，正如我所希望的那样。所以，这就是我正在做的调用目标进程方法（对于任何未来的读者感兴趣）：

  1. 在内存中找到方法。为此，我首先禁用了ASLR（地址空间布局随机化），然后在目标程序中本地创建了一个指向我的方法的指针，然后使用 iostream 将指针转储到屏幕，现在我知道了方法的地址。

  2. 在要注入的 dll 中创建 typedef。这就是我有点卡住的地方，但我认识一些经常这样做的人，所以我设法摆脱了他们。就我而言，这就是 typedef 的外观：

    typedef int __printPrototype(char* text);

  3. 将目标应用程序中方法的地址绑定到注入的 dll 中的复制：

    int (*Print)(char*);
Print = (__printPrototype*)0x0041121C;
Print("I'm injecting myself into you.");

完美的！

感谢 dauphic 和一位名叫 DarkstaR 的好朋友。

于 2013-11-06T09:30:13.117 回答