Code Injection
Inject code with certain technique written in cpp.
- DLL Injection : InjectDll.cpp
- Memory Scanning : MemoryScanInjector.cpp
- DLL Injection with User APC : QueueUserAPC.cpp
DLL Injection
Inject dll with CreateRemoteThread and LoadLibrary.
VirtualAllocEx(pi.hProcess, NULL, dwLength, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(pi.hProcess, lpLibName, DLL_NAME, dwLength, &written);
HANDLE hThread = CreateRemoteThread(pi.hProcess, NULL, NULL, pLoadLibraryW, lpLibName, NULL, NULL);
WaitForSingleObject(hThread, INFINITE);Memory Scanning
Scan certain instructions and overwrite it.
ScanMemory inspects executable area, finds pattern and store the address to std::vector.
std::vector<LPVOID> list;
BYTE pattern[] = { 0x48, 0x63, 0x4D, 0xC8, 0x89, 0x08, 0x49, 0x63, 0x47, 0x50 }; //target opcode
ScanMemory(hProcess, pattern, sizeof(pattern), list);
BYTE code[] = { 0xC7, 0x00, 0x04, 0x00, 0x00, 0x00 }; // patch opcode
WriteProcessMemory(hProcess, list.back(), code, sizeof(code), NULL);Queue User APC
QueueUserAPC adds user-mode Asynchronous Procedure Call (APC).
Many anti-debugging agents watch CreateRemoteThread. In order to bypass this scenario, we can use APC to inject dll.
for (auto dwTid : tids) {
HANDLE hThread = OpenThread(THREAD_SET_CONTEXT, FALSE, dwTid);
if (hThread) {
QueueUserAPC(pLoadLibrary, hThread, (ULONG_PTR)lpAddress);
CloseHandle(hThread);
}
}