_InjectDll UDF

[Bounda]

it seems to detect other windows, like firefox and notepad, but it wont detect diablo.

[Drkgodz]

Yeah, I tried injecting the script, but it won't work. It says _InjectDll is not a functuion or something like that.

I tried the newest beta version too, but to no avail. Can y'all tell me which version y'all use? Thanks.

[Psibernetic]

I play a game called Eudemons Online... as mentioned before the idea of changing songs without alt-tabbing would be a good starting point for me... and idea how to implement this?...I undestand the injection...now how would I call my functions from the game?

Edited January 19, 2007 by Psibernetic

[locomaestro]

Now THAT is an example!

-mu

dude this is awesome , i was trying to find a way on how to do it in autoit since i only do it in c# but dude you can definetely make a good rootkit for autoit with this udf. thanks dude this is awesome i ll try to see if i can make another rootkit but this time in autoit

[onedayillpay]

can some one show me a short and simmple example

[lolp1]

Says it injects the DLL into diablo, but it doesn't, or does it wrong.

[onedayillpay]

with this tool i can view a list of dll's that are actave under a process like firefox. Procexp.exe www.sysinternals.com

Firefox has called about 50 to 60 dll's... maybe can some one give me a example using Firefox and _injecting a dll like um maybe kernel32.dll

i dont play diablo

[ptrex]

@onedayillpay

Procexp.exe www.sysinternals.com

You can do this without any external tool !!

Run this in the cmd :

taskList.exe /FI "IMAGENAME eq outlook.exe" /M

Enjoy !!

ptrex

[SmOke_N]

@onedayillpay

You can do this without any external tool !!

Run this in the cmd :

Enjoy !!

ptrex

ptrex, what OS's is this good on?

Edit:

Everything I read on it said XP... but whatever... fun times:

#include <array.au3>
$avArray = _ProcessGetExtended('outlook.exe')
_ArraySort($avArray, 0, 1)
_ArrayDisplay($avArray, 'DLLs')

Func _ProcessGetExtended($sExe, $bType = -1);-1 or Default for Dll's and 1 or True for Services attatched
    If ProcessExists($sExe) = 0 Then Return SetError(1, 0, 0)
    If Not FileExists(@SystemDir & '\tasklist.exe') Then Return SetError(2, 0, 0)
    Local $iPID, $sHoldData, $aArray
    If $bType = -1 Or $bType = Default Then
        $iPID = Run(@ComSpec & ' /c taskList.exe /FI "IMAGENAME eq ' & $sExe & '" /M', @SystemDir, @SW_HIDE, 2)
    Else
        $iPID = Run(@ComSpec & ' /c taskList.exe /FI "IMAGENAME eq ' & $sExe & '" /SVC', @SystemDir, @SW_HIDE, 2)
    EndIf
    While Not @error
        $sHoldData &= StdoutRead($iPID)
    WEnd
    If Not $sHoldData Then Return SetError(3, 0, 0)
    $aArray = StringRegExp($sHoldData, '(?s)(?i)=\s*.*?\d+\s+(.*?)$', 1)
    If IsArray($aArray) = 0 Then Return SetError(4, 0, 0)
    If StringInStr($aArray[0], ',') Then Return StringSplit(StringStripWS($aArray[0], 8), ',')
    If StringInStr($aArray[0], 'n/a') Then Return SetError(5, 0, 0)
    Local $aBackUp[2] = [1, $aArray[0]]
    Return $aBackUp
EndFunc

Edit2:

Had ArraySort() sorting 0 base oops....

Edit3:

Had to fix the array returned in case there was only 1 item found.

Edited March 7, 2007 by SmOke_N

[ptrex]

@SmOke_N

Indead only XP and above. But the beautifull part of it is, is that you can run it against a remote machine as well !!

Anywas I wanted eve to make it available in a UDF, but since you did I don't need to any more !!

Maybe you can extend your UDF with the following switches :

/S remote machine

/U user

/P password

/SVC service

This makes it than complete !!

Nice job.

regards,

ptrex

Edited March 7, 2007 by ptrex

[SmOke_N]

@SmOke_N

Indead only XP and above. But the beautifull part of it is, is that you can run it against a remote machine as well !!

Anywas I wanted eve to make it available in a UDF, but since you did I don't need to any more !!

Maybe you can extend your UDF with the following switches :

/S remote machine

/U user

/P password

/SVC service

This makes it than complete !!

Nice job.

regards,

ptrex

I used this: http://www.wilderssecurity.com/showthread.php?t=40123 as a reference...

Yeah, I tested it on w2k pro and a no go lol...

I have to edit again, if only 1 item is found (more than likely services) it will return 0.

[ptrex]

@SmOke_N

If you edit / add the missing stuff and release a new version of your handy UDF it would please a lot of people.

Best to release it in a new POST because it doesn't belong here I think.

Anyway thanks for share so far.

regards,

ptrex

[A. Percy]

Yeah, I thought about that a little later than I should've. When I get up tomorrow I'll add a function that returns a PID from a hWnd and then clip off the top part of the Inject function so that it takes a PID; that way, people can do it any way they want.

This worked for me:

expandcollapse popup

#include-once

Func _InjectDllByHwnd($hWnd, $dllpath)
    ;make sure the user passed valid parameters
    If $hWnd <= 0 Then
        SetError(-1)
        Return False
    ElseIf StringLen($dllpath) <= 4 Or StringRight($dllpath, 4) <> ".dll" Then
        SetError(-2)
        Return False
    EndIf
    
    Local $pid, $pHandle, $pLibRemote, $modHandle, $LoadLibraryA, $hThread
    
    ;get the pid from the window provided
    $pid = DllCall("user32.dll", "int", "GetWindowThreadProcessId", "hwnd", $hWnd, "int_ptr", 0)
    If IsArray($pid) Then
        $pid = $pid[2]
        _InjectDllByPid($pid, $dllpath)
    Else
        SetError(-3)
        Return False
    EndIf
    
EndFunc

Func _InjectDllByPid($pid, $dllpath)
    ;make sure the user passed valid parameters
    If $pid = 0 Then
        SetError(-1)
        Return False
    ElseIf StringLen($dllpath) <= 4 Or StringRight($dllpath, 4) <> ".dll" Then
        SetError(-2)
        Return False
    EndIf
    
    Local $pHandle, $pLibRemote, $modHandle, $LoadLibraryA, $hThread
    
    ;open dll that we'll be using
    Local $kernel32 = DllOpen("kernel32.dll")
    
    ;open the process for writing
    $pHandle = DllCall($kernel32, "int", "OpenProcess", "int", 0x1F0FFF, "int", 0, "int", $pid)
    If IsArray($pHandle) And $pHandle[0] > 0 Then
        $pHandle = $pHandle[0]
    Else
        SetError(-4)
        Return False
    EndIf
    
    $pLibRemote = DllCall($kernel32, "int", "VirtualAllocEx", "int", $pHandle, "short", 0, "int", 0x1000, "int", 0x1000, "int", 4)
    If IsArray($pLibRemote) Then
        If $pLibRemote[0] > 0 Then
            ;debug
            ConsoleWrite("0x" & Hex($pLibRemote[0], 8) & @CR)
            $pLibRemote = $pLibRemote[0]
        Else
            SetError(-5)
            Return False
        EndIf
    Else
        SetError(-6)
        Return False
    EndIf
    
    For $i = 0 To StringLen($dllpath)
        $ret = DllCall("kernel32.dll", "int", "WriteProcessMemory", "int", $pHandle, "int", $pLibRemote + $i, "int_ptr", Asc(StringMid($dllpath, $i + 1, 1)), "int", 1, "int", 0)
        If IsArray($ret) Then
            If $ret[0] = 0 Then
                SetError(-7)
                Return False
            EndIf
        Else
            SetError(-8)
            Return False
        EndIf
    Next
    
    $modHandle = DllCall($kernel32, "long", "GetModuleHandle", "str", "kernel32.dll")
    If IsArray($modHandle) Then
        If $modHandle[0] > 0 Then
            $modHandle = $modHandle[0]
        Else
            SetError(-9)
            Return False
        EndIf
    Else
        SetError(-10)
        Return False
    EndIf
    
    $LoadLibraryA = DllCall($kernel32, "long", "GetProcAddress", "long", $modHandle, "str", "LoadLibraryA")
    If IsArray($LoadLibraryA) Then
        If $LoadLibraryA[0] > 0 Then
            $LoadLibraryA = $LoadLibraryA[0]
        Else
            SetError(-11)
            Return False
        EndIf
    Else
        SetError (-12)
        Return False
    EndIf
    
    $hThread = DllCall($kernel32, "int", "CreateRemoteThread", "int", $pHandle, "int", 0, "int", 0, "long", $LoadLibraryA, "long", $pLibRemote, "int", 0, "int", 0)
    If IsArray($hThread) Then
        ConsoleWrite($hThread[0] & @CR)
        If $hThread[0] > 0 Then
            $hThread = $hThread[0]
        Else
            SetError(-13)
            Return False
        EndIf
    Else
        SetError(-14)
        Return False
    EndIf
    
    DllCall($kernel32, "int", "VirtualFreeEx", "int", $pHandle, "int", $pLibRemote, "int", 0x1000, "int", 0x8000)
    DllCall($kernel32, "int", "CloseHandle", "int", $hThread)
    DllCall($kernel32, "int", "CloseHandle", "int", $pHandle)
    
    DllClose($kernel32)
    
    Return True
EndFunc
oÝ÷ ØLZ^jëh×6
#include "_InjectDll.au3"

$ret = _InjectDllByPid(ProcessExists( "Calculator.exe" ), "c:\mytest.dll")
$err = @error
If $err < 0 Then
    MsgBox(16, $ret, $err)
Else
    MsgBox(64, $ret, "YUP!")
EndIf

[malu05]

I play a game called Eudemons Online... as mentioned before the idea of changing songs without alt-tabbing would be a good starting point for me... and idea how to implement this?...I undestand the injection...now how would I call my functions from the game?

Hmm.. i really wonder about that too..

I know that "DllCall" is used for the call but that isnt application specified.

Or is it supposed to be called from within the target application and therefor needed to inject some code too?

Like finding the memory location for a exact KeyInput shortcut from the application and then inject the code to go through the dll or?

[onedayillpay]

#include "_InjectDll.au3"

$ret = _InjectDllByPid(ProcessExists( "Calculator.exe" ), "c:\mytest.dll")
$err = @error
If $err < 0 Then
    MsgBox(16, $ret, $err)
Else
    MsgBox(64, $ret, "YUP!")
EndIf

can some one show me were i can get some tools to write .Dll's and some source code for this test.dll' with some functions explained threw out the code...

[SmOke_N]

#include "_InjectDll.au3"

$ret = _InjectDllByPid(ProcessExists( "Calculator.exe" ), "c:\mytest.dll")
$err = @error
If $err < 0 Then
    MsgBox(16, $ret, $err)
Else
    MsgBox(64, $ret, "YUP!")
EndIf

can some one show me were i can get some tools to write .Dll's and some source code for this test.dll' with some functions explained threw out the code...

Take your pick at any lower level language... Google it.

[tip]

Hi,

Is this method can be used to make an autoit exe file with 7zip-32.dll in it which can be "dllcall"ed?

Regards

[JRowe]

No, for that you'll need this thread : http://www.autoitscript.com/forum/index.php?showtopic=51103

[tip]

Thanks but creator of that topic (Zedna) directed me here ...

Any ideas how can I read dlls directly from resources...

Edited October 25, 2008 by tip

[Skrip]

Can we get an example of a dll that would work?