Injecting and executing code in external process

[monoceres]

This is based on trancexx's work in this thread.

It's an example of executing a function from the winapi in another process (MessageBoxW).

It's not very useful at the moment, but this could very well be used to inject code that does whatever.

I commented pretty much so it should be quite easy to follow how it works.

The basic structure is:

1. Allocate memory in the target process for code and strings.

2. Generate the machine code.

3. Copy the code and strings to the process.

4. Start executing the code using CreateRemoteThread

Download: RemoteMessageBox.au3

Enjoy

[FireFox]

@monoceres

Really nice ! It could be very useful

I think I will work on something with this !

Cheers, FireFox.

[monoceres]

Thanks.

Good luck, no idea what you could do with it in the current form though

[trancexx]

What if I do:

$processname = @AutoItPID

and lose

_WinAPI_WaitForSingleObject($hThread)

Wouldn't that be multithreading?

If so only inter-thread (one way is enough) communication is needed to have it as a... something great.

[ProgAndy]

What if I do:

$processname = @AutoItPID

and lose

_WinAPI_WaitForSingleObject($hThread)

Wouldn't that be multithreading?

If so only inter-thread (one way is enough) communication is needed to have it as a... something great.

You don't need this code for multi-threading in AutoIt. Some time ago i made an example for multi-threading (here it is). The only thing you have to consider is that you have to create the function for the Thread in a compiled language and put it into a DLL (e.g. use FreeBasic) Edited May 21, 2009 by ProgAndy

[trancexx]

You don't need this code for multi-threading in AutoIt. Some time ago i made an example for multi-threading (here it is). The only thing you have to consider is that you have to create the function for the Thread in a compiled language and put it into a DLL (e.g. use FreeBasic)

Yes, I know about that code (even suggested it recently in one particular occasion). I actually dismantled it completely and that resulted in finding it to be buggy (I think I remember enough of that process to replicate found collisions, ...will see).

Btw, congratulations on MVP status. Very much earned IMHO.

Edited May 23, 2009 by trancexx

[UEZ]

2 silly questions:

1) what is the goal of code injection?

2) what is MVP exactly? Congratulations to ProgAndy, BrettF and TheSaint... for MVP status.

UEZ

Edited May 21, 2009 by UEZ

[monoceres]

1) what is the goal of code injection?

The example doesn't fill much purpose, it's simply an example for us that like messing around with windows on a lower level.

However code injection in general has many uses, hooking internal workings, extending functionality, debugging etc.

Oh and there's also the many malicious uses, but I'm not worried since the kiddies that uses autoit to write crap won't understand this anyway.

Edit: MVP is much valuable person or something like that, it's a kind of acknowledge if you are useful for the community.

Edited May 21, 2009 by monoceres

[UEZ]

The example doesn't fill much purpose, it's simply an example for us that like messing around with windows on a lower level.

However code injection in general has many uses, hooking internal workings, extending functionality, debugging etc.

Oh and there's also the many malicious uses, but I'm not worried since the kiddies that uses autoit to write crap won't understand this anyway.

Edit: MVP is much valuable person or something like that, it's a kind of acknowledge if you are useful for the community.

Thanks for the explanation.

I meant the shortcut for MVP.

UEZ

[yehia]

2 silly questions:

1) what is the goal of code injection?

2) what is MVP exactly? Congratulations to ProgAndy and TheSaint...

UEZ

i can only answer the MVP one

an mvp have a larger storage on the forum account and like ahmmm. a premium account but for no money (i think)

[UEZ]

Thanks, but what does MVP mean (shortcut for)?

Microsoft V.... Professional? Most Valuable Poster? ...

Anyway, it is not so important...

UEZ

Edited May 21, 2009 by UEZ

[lordicast]

MVP Means : Most Valuable Player

Edited May 21, 2009 by lordicast