|
lol.
|
|
|
|
|
Hi everybody,
Could you give me the answer which concern to inject code to other process.My questions are:
[1]Must Windows API function have the same address in all process?
[2]Why would crash when a remote thread proceduer directly call Windows API function?
Now I show my code:
<br />
DWORD __stdcall RemoteThreadProc(LPVOID lParam) <br />
{ <br />
LoadLibraryA(NULL);
return 0; <br />
}<br />
<br />
DWORD Inject(HANDLE hTargetProcess)<br />
{<br />
LoadLibraryA(NULL);
<br />
DWORD dwWriteBytes;<br />
DWORD dwThreadSize = 5000; <br />
<br />
void* pRemoteThread = VirtualAllocEx(hTargetProcess, 0, <br />
dwThreadSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);<br />
<br />
if (!WriteProcessMemory(hTargetProcess, pRemoteThread, <br />
RemoteThreadProc, dwThreadSize, 0)) {<br />
return 0;<br />
}<br />
<br />
HANDLE hRemoteThread = CreateRemoteThread(<br />
hTargetProcess, NULL, 0, (DWORD (__stdcall *)(void *))pRemoteThread,<br />
NULL, 0, &dwWriteBytes);<br />
<br />
if (!hRemoteThread) {<br />
return -1;<br />
}<br />
<br />
return 1;
}<br />
As far as known, Windows API function have same address in all process, but I can`t make sure it. For example, the address of "LoadLibraryA" is 0x7c801d77 in some process which I tested.[I get the address by printf(TEXT("%x"), LoadLibraryA ); ].
If Winsows API function have same address in all process, there are no reason to crash when the remote thread proceduer call API function .
Please give me an answer or an illumination.
Thank you.
|
|
|
|
|
Injecting functions written in high level programming language this way is unsafe, when they are relocated, some addresses change. It's safer to call
HANDLE hRemoteThread = CreateRemoteThread(<br />
hTargetProcess, NULL, 0, LoadLibraryA,<br />
pRemotelyAllocatedStringContainigPathToTheDll, 0, &dwWriteBytes);
And in the DllMain of this dll call your RemoteThreadProc.
Anyway, as far as I understand the comments in your code, WriteProcessMemory is the part that fails. What process do you try inject your code to?
Are you sure that you have sufficient rights?
-- added at 6:56 Wednesday 28th November, 2007
One more thing. Do you compile it in debug mode? If so, at the address of your function you'll see:
jmp some_other_address
Then WriteProcessMemory will copy just these 5 (6?) bytes and some "other" data, not useful for you instead of your function's body.
|
|
|
|
|
Dear maciu2020,
I know your method of injection. I just want to learn my code why to crash.In addition, I have step up the privilege of process`s handle before the to call the function 'Inject'.
In you code, LoadLibraryA is a parameter of CreateRemoteThread. Given the address of LoadLibraryA is 0x7c801d77, the following code is ok.
<br />
HANDLE hRemoteThread = CreateRemoteThread(<br />
hTargetProcess, NULL, 0, 0x7c801d77,<br />
pRemotelyAllocatedStringContainigPathToTheDll, 0, &dwWriteBytes);<br />
Why it`s ok ??? There is only one reason which the address of LoadLibraryA is same in all process! In other words, LoadLibraryA==0x7c801d77 in process A and LoadLibraryA==0x7c801d77 in process B at the same time. Do you agree with my opinion ???
This is the key of my question, which, in my code, local calling LoadLibraryA is jmp/call 0x7c801d77 and the calling LoadLibraryA in remote thread proceduer is also jmp/call 0x7c801d77. Why the latter must crash?
|
|
|
|
|
Actually the address may vary, windows sets it while loading kernel32.dll.
But on each machine, all processes share kernel32.dll functions' addresses.
DWORD __stdcall RemoteThreadProc(LPVOID lParam)<br />
{<br />
__asm<br />
{<br />
push 0<br />
call DWORD PTR LoadLibrary<br />
}<br />
}
should be ok...as long as you compile your program with optimizations on.
It would be definitely OK if you wrote the whole thing in assembly to ensure that compiler won't insert there something you don't want it to.
push 0<br />
call DWORD PTR LoadLibrary<br />
retn 0
generates the same code, no matter where it's placed.
If it still doesn't work, can you disassembly RemoteThreadProc and post here?
|
|
|
|
|
deng0jun wrote: LoadLibraryA(NULL); //crash!!! Why crash???
Why would you expect it not to crash?
"Normal is getting dressed in clothes that you buy for work and driving through traffic in a car that you are still paying for, in order to get to the job you need to pay for the clothes and the car and the house you leave vacant all day so you can afford to live in it." - Ellen Goodman
"To have a respect for ourselves guides our morals; to have deference for others governs our manners." - Laurence Sterne
|
|
|
|
|
I guess, because LoadLibraryA checks if it's argument is 0. And to indicate this, he wrote that the same LoadLbraryA(NULL), when placed in own process, just fails, doesn't crash.
|
|
|
|
|
DavidCrow wrote: Why would you expect it not to crash?
Because calling 'LoadLibraryA(NULL);' is ok in local process.
|
|
|
|
|
But what does it do?
"Normal is getting dressed in clothes that you buy for work and driving through traffic in a car that you are still paying for, in order to get to the job you need to pay for the clothes and the car and the house you leave vacant all day so you can afford to live in it." - Ellen Goodman
"To have a respect for ourselves guides our morals; to have deference for others governs our manners." - Laurence Sterne
|
|
|
|
|
Hello everybody.
I'm a MFC developer and I have a problem; i could not read a xml file in mfc (vs 6.0, c++). I don't know the differences reading a text file with reading a xml file, in mfc. Also; i don't know the xml open-read-write methods of the MFC (if there is??? ). How can I open and read xml files? Please help me.
Thanks in advance.
Sahan Askin
|
|
|
|
|
use tinyXML library in your project. it will ease your job
|
|
|
|
|
Thanks very much for your reply. I'm researching tinyxml now.
|
|
|
|
|
sahanaskin wrote: Thanks very much for your reply. I'm researching tinyxml now.
search cmarkup class in Codeproject, that it's another robust class available for XML handlling
"Opinions are neither right nor wrong. I cannot change your opinion. I can, however, change what influences your opinion." - David Crow Never mind - my own stupidity is the source of every "problem" - Mixture
cheers,
Alok Gupta
VC Forum Q&A :- I/ IV
Support CRY- Child Relief and You
|
|
|
|
|
|
|
Hi Friends,
In socket programming I want to connect double byte charcters.
Earlier we used recv() function for single byte charcter.
If we use double byte chracter in below recv function, its coming as a question mark symbol.
If anybody knows how can I handle double byte charcter in Scoket programing(recv function),Please let me know.
My codesnippet:
while( bytesRecv == SOCKET_ERROR ) {
bytesRecv = recv( ConnectSocket, recvbuf, 64, 0 );
if ( bytesRecv == 0 || bytesRecv == WSAECONNRESET || CheckTimeOut()) {
return CloseListen();
}
}
Note:Here recvbuf works for singel byte not for doublebyte charcters.
Thanks in advance.
|
|
|
|
|
Raghavendra Pise wrote: Note:Here recvbuf works for singel byte not for doublebyte charcters.
You need to do some studying on character encoding, thinks like Unicode etc. Here is just one example[^]
|
|
|
|
|
In addition to led mike's reply...
Sockets work in bytes, that's it. If you need to work with any other types
then you need to do the multiplication yourself to calculate the number of bytes
for a given type.
recv() is confusing with its char* type - it actually has nothing to do with
"characters" - it's just what the BYTE type was at the time it was designed.
It's ancient, and most wish it would go away.
Mark
Mark Salsbery
Microsoft MVP - Visual C++
|
|
|
|
|
Hii all,
can anybody help me in reading event log files via windows APIs and c++.
Thanks in adavance...
T@SU
|
|
|
|
|
|
Thanks for your informatiion... but i what i am looking for..
i have to read AppEvent.Evt from ..system32/config and i have to extract the description... of error
thanks alot
T@SU
|
|
|
|
|
T@su wrote: i have to read AppEvent.Evt from ..system32/config...
You do not read the event file(s) directly. There is an API for doing that. Hans' article goes over all of this very well.
"Normal is getting dressed in clothes that you buy for work and driving through traffic in a car that you are still paying for, in order to get to the job you need to pay for the clothes and the car and the house you leave vacant all day so you can afford to live in it." - Ellen Goodman
"To have a respect for ourselves guides our morals; to have deference for others governs our manners." - Laurence Sterne
|
|
|
|
|
i am using dshow to play a video. (i am using dx9)
top of my project, i set,
#include <dshow.h>
#include <d3d9.h>
#include <vmr9.h>
...
in Debug, the program runs successfully,
when i changed to release, it has link error,
error LNK2001: unresolved external symbol _CLSID_NullRenderer
error LNK2001: unresolved external symbol _IID_ISampleGrabber
error LNK2001: unresolved external symbol _CLSID_SampleGrabber
error LNK2001: unresolved external symbol _IID_ICaptureGraphBuilder2
when i change Debug again, it can not be complied with the link error also.
do you have any idea?
thanks.
Lei
|
|
|
|
|
|
thx. it works.
|
|
|
|