Click here to Skip to main content
15,881,803 members
Articles / Desktop Programming / Win32

Injection into a Process Using KnownDlls

,
Rate me:
Please Sign up or sign in to vote.
4.82/5 (22 votes)
6 Feb 2012CPOL10 min read 70.1K   2.3K   73  
In his article, we will consider an interesting, universal and rarely used method of code injection into a Windows process using KnownDlls sections. To demonstrate the method work we will develop a sample project to inject into all running processes and intercept some calls from ws2_32.dll.
#include "stdafx.h"

#include "Service.h"
#include "InjectDll.h"
#include "Win32Utils.h"
#include "common.h"
#include "ServiceManager.h"
#include <shlobj.h>


inline void InstallService(
    const std::wstring& system_directory, 
    const std::wstring& source_file,
    const std::wstring& serv_name)
{
    std::wstring cur_folder(utils::GetCurrModulePath());
    std::wstring serv_path;
    serv_path += L"\"" + cur_folder + SERVICE_NAME + L".exe" +  L"\"";
    scm::ServiceManager manager(serv_name);
    UNTHROW(manager.SMInstallService(serv_path));
    UNTHROW(manager.SMStartService());
    // create symbolic link

    std::wstring dest_file(system_directory);
    if(!CreateSymbolicLink(source_file.c_str(), dest_file.append(L"\\").append(DLL_NAME).c_str(), NULL))
        throw std::runtime_error("Symbolic link can't be create");

}

inline void UninstallService(
    const std::wstring& source_file, 
    const std::wstring& serv_name)
{
    scm::ServiceManager manager(serv_name);
    UNTHROW(manager.SMStopService());
    UNTHROW(manager.SMRemoveService());
#ifdef _WIN64
    bool isX64 = true;
#else
    bool isX64 = false;
#endif
    dll_inj::SectionInjecter injecter(isX64, DLL_NAME);
    UNTHROW(injecter.DeleteSection());
    // delete symbolic link
    if(!DeleteFile(source_file.c_str()))
        throw std::runtime_error("Symbolic link can't be delete");
}

void StartService()
{
    SERVICE_TABLE_ENTRY ServiceTable[1];
    ServiceTable[0].lpServiceName = SERVICE_NAME;
    ServiceTable[0].lpServiceProc = (LPSERVICE_MAIN_FUNCTION)ServiceMain;

    StartServiceCtrlDispatcher(ServiceTable);
}

int wmain( int , wchar_t *argv[] )
{
    try
    {    
        using namespace dll_inj;
        std::wstring serv_name(SERVICE_NAME);
        wchar_t* arg_key = argv[1];

        // take windows directory
        wchar_t system_directory[MAX_PATH];
#ifdef _WIN64
        UINT uSize = GetSystemDirectoryW(system_directory, sizeof(system_directory));
        if(0 == uSize)
        {
            std::cout << "Can't take system directory";
            return -1;
        }
#else        
        if (!SHGetSpecialFolderPathW(NULL, system_directory, 0x0029, FALSE))
        {
            std::cout << "Can't take system directory";
            return -1;
        }
#endif        //
        std::wstring source_file(system_directory);
        source_file.append(L"\\");
        source_file.append(DEF_MODULE_NAME);
        if(arg_key != 0 && wcscmp(arg_key, L"-install") == 0 )
        {
            InstallService(system_directory, source_file, serv_name);
        }
        else if(arg_key != 0 && wcscmp(arg_key, L"-uninstall") == 0)
        {
            UninstallService(source_file, serv_name);
        }
        else if(arg_key == 0)
        {
            StartService();
        }
        else
        {
            throw std::runtime_error("Service was ran with incorrect parameters");
        }
    }
    catch (const std::exception&)
    {
    }
    return 0;
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Chief Technology Officer Apriorit Inc.
United States United States
ApriorIT is a software research and development company specializing in cybersecurity and data management technology engineering. We work for a broad range of clients from Fortune 500 technology leaders to small innovative startups building unique solutions.

As Apriorit offers integrated research&development services for the software projects in such areas as endpoint security, network security, data security, embedded Systems, and virtualization, we have strong kernel and driver development skills, huge system programming expertise, and are reals fans of research projects.

Our specialty is reverse engineering, we apply it for security testing and security-related projects.

A separate department of Apriorit works on large-scale business SaaS solutions, handling tasks from business analysis, data architecture design, and web development to performance optimization and DevOps.

Official site: https://www.apriorit.com
Clutch profile: https://clutch.co/profile/apriorit
This is a Organisation

33 members

Written By
Software Developer (Junior) ApriorIT
Ukraine Ukraine
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Comments and Discussions