Click here to Skip to main content
Click here to Skip to main content

Inject My DLL Into a Process

, 25 Jul 2009 CPOL
Rate this:
Please Sign up or sign in to vote.
A Windows Mobile Spy.


Sometimes, we need to run code in another module, without having the source code such as Microsoft Word, Microsoft Excel or any other module. How can this be done? In such cases, what can you do if your manager asks you to change style dialog inside Microsoft Process.

Using the Code

First of all, we have to talk about kernel mode. Kernel mode means how you can have access inside any process in the system like kernel system process.

So to have this power, there are some undocumented functions inside coredll.dll like:

extern "C" {
	BOOL    SetKMode(BOOL fMode);
	DWORD   SetProcPermissions(DWORD);
	LPVOID  MapPtrToProcess (LPVOID lpv, HANDLE hProc);
	DWORD   PerformCallBack4(PCALLBACKINFO pcbi, ...);	//execute function 
							//inside process

The first two functions give you access to the other process:

BOOL bMode = SetKMode(TRUE);
DWORD dwPerm = SetProcPermissions(0xFFFFFFFF);

Imagine yourself inside note.exe and that you want to load any DLL. You will surely call LoadLibrary(L”xxx.dll”);

But if you want to Load library but don't have the source code, you should use the performcallback function:

HANDLE hProcess=GetProcessHandle(L"notes.exe");//get handle
Now I will put my DLL into the present process and you can
function inside this DLL.
cbi.hProc = hProcess;
cbi.pfn = (FARPROC)MapPtrToProcess(GetProcAddress
	(GetModuleHandle(L"COREDLL"), L"LoadLibraryW"), hProcess);
cbi.pvArg0 = (LPVOID)MapPtrToProcess(L"\\windows\\mydll.dll", GetCurrentProcess());
HINSTANCE hInst = (HINSTANCE)PerformCallBack4(&cbi, 0,0,0);

The first statement is just to get a handle to a specific process. Now you can call the CallBack function through sending handle and your DLL which you want to copy in Process Address space ….

Note: Sometimes PerformCallBack does not work well. "Be careful."

To check if mydll.dll now attaches inside note.exe, go to remote process view.


Now your DLL attaches into note.exe, so my mission now is to subclass the edit control. To get a handle, I have to open note.exe and open RemoteSpy tools like this:

spy_small.JPG - Click to enlarge image

To get this handle programmatically:

/***********to execute your function *********************/
HWND m_hWnd=::GetForegroundWindow();//handle for note
m_hWnd=::GetWindow(m_hWnd,GW_CHILD);//handle for InkX
m_hWnd=::GetWindow(m_hWnd,GW_CHILD);//handle for richink
cbi.hProc = hProcess;
cbi.pfn = (FARPROC)MapPtrToProcess(GetProcAddress
	(hInst, L"SubClassEdit"), hProcess);//my function inside DLL
cbi.pvArg0 = m_hWnd;//handle of richedit control
hInst = (HINSTANCE)PerformCallBack4(&cbi, 0,0,0);

If you are sure "note" its foreground window call GetForegroundWindow() function, otherwise I recommend to use FindWindow(L"Worker","Note") to obtain a window handle for more information about FindWindow function.

Now you can jump to any specific control inside note.exe, in our case we need to go for "richink" by using getwindow function.

Don't forget you have to check if handle is correct before calling the callback function.

Let me talk about callback function parameters:

  1. hProc: Handle for specific Process, in our case we talk about note.exe
  2. pFn: The function inside this process, which we want to call
  3. pvArg0: Function argument, SubClassEdit function takes handle m_hWnd
_declspec(dllexport) void SubClassEdit(HWND m_editHandle)

Look inside mydll.dll:

Now let us talk about mydll.dll. It is very simple. Just have one function to subclass like this:

__declspec(dllexport) void SubClassEdit(HWND m_editHandle)
	g_pOldWndProc = (WNDPROC)GetWindowLong(m_editHandle, GWL_WNDPROC);
	SetWindowLong(m_editHandle, GWL_WNDPROC, (LONG)EditTopmostProc);
LRESULT EditTopmostProc(HWND hWnd, UINT uMsgs, WPARAM wParam, LPARAM lParam)
		if ( uMsgs == WM_KILLFOCUS )//
			MessageBox(hWnd,buffer,L"you saved",MB_OK);
			 return CallWindowProc(g_pOldWndProc, hWnd, 
					uMsgs, wParam, lParam); //Info
		 return CallWindowProc(g_pOldWndProc, 
					hWnd, uMsgs, wParam, lParam); //Info

In SubClass theory, you should take and save the old procedure handle to use it.

g_pOldWndProc = (WNDPROC)GetWindowLong(m_editHandle, GWL_WNDPROC);

g_pOldWndProc now has the original pointer for richink procedure.

Now you can set your procedure instead of the original one:

SetWindowLong(m_editHandle, GWL_WNDPROC, (LONG)EditTopmostProc);

In EditTopmostProc, I want to replace WM_KILLFOCUS, otherwise I will call the original one:

CallWindowProc(g_pOldWndProc, hWnd, uMsgs, wParam, lParam); //Info

Sure you can replace any function...


... and click ok.


Points of Interest

In this sample, you can learn about subclassing. Subclassing is a technique that allows an application to intercept messages destined for another window. An application can augment, monitor, or modify the default behavior of a window by intercepting messages meant for another window. Subclassing is an effective way to change or extend the behavior of a window without redeveloping the window. Subclassing the default control window classes (button controls, edit controls, list controls, combo box controls, static controls, and scroll bar controls) is a convenient way to obtain the functionality of the control and to modify its behavior. For example, if a multiline edit control is included in a dialog box and the user presses the ENTER key, the dialog box closes. By subclassing the edit control, an application can have the edit control insert a carriage return and line feed into the text without exiting the dialog box. An edit control does not have to be developed specifically for the needs of the application.

You can also learn about PerformCallBack which is a Microsoft technique to execute code inside another process.

How Does This Help Someone Else

This can be used if somebody wants a custom control inside an external process, like adding a right to left feature in some editable control.


  • 25th July, 2009: Initial post


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

Software Developer (Senior)
Jordan Jordan
Mobile Developer with deep Experience in Handheld Device Pocket Pc, Smart Phone in Win32, MFC With more than 8 years ago."Arabizer, Hook Function, Poom, Wirless Application, and low level Application". By C++ MFC and win32

Comments and Discussions

GeneralExcellent and very usefull Pinmemberhjgode27-Jan-10 19:14 
Generalgood man Pinmembermoayyaed102427-Jul-09 22:26 
GeneralGood job PinmemberDr.Luiji27-Jul-09 22:02 
GeneralExcellent PingroupMd. Marufuzzaman26-Jul-09 8:50 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web01 | 2.8.1411023.1 | Last Updated 25 Jul 2009
Article Copyright 2009 by emranallan
Everything else Copyright © CodeProject, 1999-2014
Layout: fixed | fluid