🔒 Locked

DLL Injection/Remote Function Execution/Hooking

Started by DarkSparky Oct 27, 2008 at 5:52 PM 3 replies 850+ views

Original Post

Oct 27, 2008 at 5:52 PM

Hey guys, im trying to get an anticheat running for my game, however, i have hit a snag. I currently inject with some code that my friend has written, which basically injects some asm to execute the function, copy the arguments, and then copy back the return value of that function. At the moment we're having issues with it as it is a huge heap of code which is confusing to say the least. Is there any easy way to inject a dll (LoadLibraryA), and then execute two more functions which take structures as arguments, taking into account different dll load addressing, and then ensuring that the program uses the hooked functions rather than the normal API? Thanks

DarkSparky

Author

DarkSparky

Oct 28, 2008 at 9:20 AM

Anyone?

ddn3

124

ddn3

Oct 28, 2008 at 1:25 PM

There are plenty of resources on the net on dll injection, its not an uncommon technique.

Maybe this tutorial will help:

http://www.codeproject.com/KB/DLL/DLL_Injection_tutorial.aspx

Enjoy!

-ddn

DarkSparky

Author

DarkSparky

Oct 30, 2008 at 8:18 AM

Quote:
Original post by ddn3
There are plenty of resources on the net on dll injection, its not an uncommon technique.

Maybe this tutorial will help:

http://www.codeproject.com/KB/DLL/DLL_Injection_tutorial.aspx

Enjoy!

-ddn

Thanks

Any idea on remote function execution, when you don't know the start address of the other library?

LessBread

558

LessBread

Oct 30, 2008 at 12:22 PM

Assuming that you've already injected your dll into the target process, if you know the name of the dll you're looking for there and you expect that it's already loaded, then you can use GetModuleHandle to obtain it's start address in the target process. With that you can use GetProcAddress to locate the functions in the dll that you're interested in calling. One advantage of using GetModuleHandle is that you don't have to call FreeLibrary afterward. If GetModuleHandle returns null then the dll isn't loaded and you'll have to call LoadLibrary to load it (and FreeLibrary to unload it).

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.