Dll Injection - CreateRemoteThread dll not showing message box - c++

Question

I'm trying some DLL injections but I have some problems :/
When I run this program I get the message "Remote Thread Created", so everything should works ok and the DLL should be loaded. But the DLL doesn't show any messageBox (it should just show a message box when loaded)
This is the code:
#include <windows.h>
#include <stdio.h>
int main(int argc, TCHAR* argv[]){
char buffer[] = "C:\\drivers\\inject.dll";
int procID = 1056;
HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, false, procID);
if(process == NULL){
printf("Cannot get handle to process.");
getchar();
return -0x1;
}
LPVOID addr = (LPVOID) GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");
if(addr == NULL){
prinf("Cannot get address of function \'LoadLibraryA\'.");
getchar();
return -0x1;
}
LPVOID arg = (LPVOID) VirtualAllocEx(process, NULL, strlen(buffer), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
if(arg == NULL){
printf("Cannote write memory.");
getchar();
return -0x1;
}
int n = WriteProcessMemory(process, arg, buffer, strlen(buffer), NULL);
if(n == 0x0){
printf("Cannot write on process address space.");
getchar();
return -0x1;
}
HANDLE threadID = CreateRemoteThread(process, NULL, 0x0, (LPTHREAD_START_ROUTINE) addr, arg, NULL, NULL);
if(threadID == NULL){
printf("Cannot create remote thread.");
getchar();
return -0x1;
} else {
printf("Remote Thread Created.\n");
}
CloseHandle(process);
getchar();
return 0x0;
}
DLL (.cpp):
#define BUILD_DLL
#include "simple_dll.h"
// a sample exported function
void DLL_EXPORT SomeFunction(const LPCSTR sometext)
{
MessageBoxA(0, sometext, "DLL Message", MB_OK | MB_ICONINFORMATION);
}
extern "C" DLL_EXPORT BOOL APIENTRY DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
SomeFunction("DLL_PROCESS_ATTACH");
break;
case DLL_PROCESS_DETACH:
SomeFunction("DLL_PROCESS_DETACH");
break;
case DLL_THREAD_ATTACH:
SomeFunction("DLL_THREAD_ATTACH");
break;
case DLL_THREAD_DETACH:
SomeFunction("DLL_THREAD_DETACH");
break;
}
return TRUE; // succesful
}
DLL (.h):
#ifndef __MAIN_H__
#define __MAIN_H__
#include <windows.h>
/* To use this exported function of dll, include this header
* in your project.
*/
#ifdef BUILD_DLL
#define DLL_EXPORT __declspec(dllexport)
#else
#define DLL_EXPORT __declspec(dllimport)
#endif
#ifdef __cplusplus
extern "C"
{
#endif
void DLL_EXPORT SomeFunction(const LPCSTR sometext);
#ifdef __cplusplus
}
#endif
#endif // __MAIN_H__
Can someone please explain me why I don't get the messagebox?

Answer 1

First off, MessageBoxA() is not safe to call in DllMain().
You should never perform the following tasks from within DllMain:
...
Call functions in User32.dll or Gdi32.dll. Some functions load another DLL, which may not be initialized.
...
In any case, just because CreateRemoteThread() succeeds in creating a remote thread does not guarantee that LoadLibraryA() will succeed when the remote thread calls it. Which, in this situation, is likely the culprit, because the DLL path string you are allocating in the remote process is not null-terminated properly, so LoadLibraryA() is likely failing. You need to use strlen(buffer)+1 when allocating the string and when copying the characters into it.
Also, not related to your problem, but if VirtualAllocEx() succeeds, regardless of whatever happens with the remote thread, you need to free the allocated string when you are done using it, or else it will be leaked. Also, don't use PROCESS_ALL_ACCESS, that is way too many permissions to ask for, you should request only the specific permissions you actually need.
Try something more like this:
#include <windows.h>
#include <stdio.h>
int main(int argc, TCHAR* argv[]){
const char buffer[] = "C:\\drivers\\inject.dll";
const size_t bufferSize = strlen(buffer) + 1;
int procID = 1056;
HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, procID);
if (hProcess == NULL){
printf("Cannot get handle to process.");
getchar();
return -1;
}
LPVOID addr = (LPVOID) GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");
if (addr == NULL){
prinf("Cannot get address of function \'LoadLibraryA\'.");
CloseHandle(hProcess);
getchar();
return -1;
}
LPVOID arg = (LPVOID) VirtualAllocEx(hProcess, NULL, bufferSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
if (arg == NULL){
printf("Cannote allocate memory in process address space.");
CloseHandle(hProcess);
getchar();
return -1;
}
BOOL n = WriteProcessMemory(hProcess, arg, buffer, bufferSize, NULL);
if (n == FALSE){
printf("Cannot write to process address space.");
VirtualFreeEx(hProcess, arg, 0, MEM_RELEASE);
CloseHandle(hProcess);
getchar();
return -1;
}
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE) addr, arg, NULL, NULL);
if (hThread == NULL){
printf("Cannot create remote thread.");
VirtualFreeEx(hProcess, arg, 0, MEM_RELEASE);
CloseHandle(hProcess);
getchar();
return -1;
}
printf("Remote Thread Created.\n");
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
VirtualFreeEx(hProcess, arg, 0, MEM_RELEASE);
CloseHandle(hProcess);
getchar();
return 0;
}