[Autogenerated] OK.
So what do I have here, I've created a new console application called Injector.
That has some initial code to grab from the command line,
the process, that He would like to inject the DLL into and the path,
to the DLL So, only need these two parameters here.
We can work with then There's an example,
DLL here I created which only simply prints a message box,
just pops up, a message box, to indicate that it,
is coming from a specific process which should be our
target process if all goes well.
So this is already here, just to make it simpler.
And Now we need to do the actual work.
So the first thing we need to do is The same thing we did.
In the example, in the memory management course.
Please refer to that course.
If some of the next code feels uncomfortable or unfamiliar.
The first thing we need to do is to allocate, a buffer, in the target process.
But before that we first have to be able to open,
a handle, to our target process.
Let's use open process here.
Our target process, is going, to be our first command line argument.
Let's just grab, that first and then try.
To open, a handle, to the process.
We need to ask for process VM operation,
to be able to allocate memory, and process V M R,
to be able to write into that process, address space.
So here's our process, ID If we can't open a handle,
to the process, and obviously something,
is wrong could be a bad process, ID Or maybe we have,
we don't have enough permissions for that purpose or our opening process,
and just display whatever get error has to say and
We're just going to be out here.
It's not really something.
We can deal with.
Once we have a handle, to the process,
we can move over to the Next stage which is allocating
a buffer into the target process.
I'm going to call the virtual AOC E X function.
To perform that operation into the target process.
I don't care which address that fs into that process.
This site should be a single page Let's go with four kg
bytes The location type would be a commit,
and reserve, we want to just commit a bunch of memory,
to use and We have to use the real right,
protection for these two to have any good effect.
So if we can't do that for whatever reason, let's just bail out very simply.
It should actually work because we have a powerful
enough handle for this purpose.
Next, we need to write process memory here.
To write the path of the DLL into the target process
into the address we just allocated.
So the base address is going to be buffer,
the actual thing you want to write, is whatever is an arc V,
two which is the second parameter on the command line,
the size is basically the length of the string that's
going to be good enough the memory there,
is zeroed out.
So the null terminator, is going to be there automatically no need.
To actually write it.
And the last parameter.
Is how many bytes were actually written which I don't really care.
So now,
that we have that we can move over to that specific thing we would
like to do here which is to utilize an a PC.
But the first thing we need to do is to get a list of all the threads,
in the process in question because we want to increase our
chances of having this work by queuing an a PC,
to all the threats, in the target process.
So for that we have to create some kind of function here.
That will provide a list of all the thread, IDs in the process.
I'm going to Add the vector here in my includes,
I'm going to have a function, that returns,
a vector of the words of, of ideas.
That I'm going to Call something like uh get thread, IDs for process.
We're going to accept the process, ID and try,
to provide the list of thread I idea S for this process.
And then We'll iterate over these idea S in our main function.
So how do I do it, how do I get all the threads of particular process.
The simplest thing,
to do is to use the tool help LP I which has its own header where
you can have a snapshot of parts of the system.
In this case, we're going to be looking at a snapshot of of threats.
This is what we are interested in the second parameter.
Is the process, ID But in fact, you can't filter by a process,
ID in terms of threads, it, only works for enumerating modules.
And heaps.
So in fact, we have to iterate over all the threads.
In the process, and then just go so not in the process,
but really in the entire system,
and just select those that are part of the process we're interested in.
Um I'm not going to do any error checking here, just to Save some time.
It shouldn't be very problematic because it's a fairly
standard function unless your system, is really low on memory.
This is unlikely, to fail.
So what you need?
To do here, is then iterate over the information.
This is done using this structure called thread entry,
32 We first need to initialize, that using the size parameter here.
To have the size of the structure.
And then We need to use Thread, 32 first to get our first thread,
which is going, to be part of the ID idea process or the system process.
In some cases, we don't really care about those.
I'm not going to to Even try looking at that thread.
I'm just going to use wire here.
To use the more common function which is just iterating over the next thread.
So snapshot, and T E so here, is where we're going to check the process.
ID If the process ID,
is the one we're interested in then We need to add that to a
vector of ID SS let's add the vector of IDs here.
Let's call that T, IDs and Just go ahead.
And add the T IDs here by using push back.
We need to take the thread,
ID from the structure which is the one shown right here.
In fact, that is it, the only thing left,
to do is to close the handle, to be Nice.
Close the handle, that snapshot, and return the T IDs So, that is it.
Now we have the list of thread, I idea S which we can use.
OK, great.
So now we can Go ahead.
And iterate over these thread, I, idea S let's see call get thread,
IDs get T IDs How do you guys call that function.
So we have get thread, I idea SS for process fine,
be ad here, and We're going to iterate over that by using a simple range,
based four here.
Essentially iterating over these thread,
IDs The next thing, to do in order for us,
to be able to call queries C.
We need to have a handle, to the thread, which is powerful enough.
So let's go ahead.
And perform an open thread here.
To try, to open, a handle, to the thread.
In question.
And If you look up the documentation for Q or a PC,
your find that thread, set, contact, is the access mask,
you require in order for Q, user a PC, to be able to work.
So I'm going to provide the thread, ad here,
and try, to open, a handle, to that thread.
If that works,
we can use that Otherwise we'll have to Just move on to the next thread.
So if that works, we want to call the function Q, user a PC.
So here's Q U, to a PC, the first fun, the first parameter,
is the function, to run,
we know that function should be load library because
it has the same binary layout as,
as an a PC function just accepting some point or some pointer size value.
Let's just call that load library, and Let's go ahead.
And and find,
that So here's load labor how do we get that We're going to
use the same trick we use in that example,
in the memory management course,
we're going to call get program address and Ask the module
which is kernel 32 this is where load library,
is defined.
We're going to Ask for the function, load library,
a Specifically the asking version because we did copy here.
An asking string as the path, the let That's going to be good enough.
So we get some value here.
The type doesn't really matter.
Its just a generic pointer, the only thing we need to do here,
to make the compiler happy is just go ahead.
And use the cast here.
To cast, that to an APC function pointer,
then we have the thread, and We have the data which is supposed,
to be the path, to the DLL, which of course,
is buffer.
That's the buffer we allocated in the target process,
and Just again for the compiler.
To be Happy.
We have to cast, that to a your word pointer,
which means uh a normal 32 or 64-bit value the size of a Python 64-bit process.
That's going to be a 64-bit value, and that is It.
If that works.
Then great, otherwise not so great, but let's just write that code a PC,
to thread, and just display the thread, I idea regardless,
to be nice.
We're going to close the handle, to the thread.
We just managed to open successfully, and Essentially,
we're done the only thing.
They have to do again, to be nice, is to close the handle,
to the process, and that should be it.
Let's try it out.
So, first let's run something.
To inject such as Notepad which is uh the usual suspect in these cases.
Let's look for Notepad the processor, these 16164 We need to remember,
that So going back here, to our code Let's go ahead.
And Open this in the terminal, just to be Nice.
We open the terminal here within the Visual Studio environment If you,
you're using SS 22 22 otherwise we can do that from the command line
from the outside which is of course perfectly fine.
In fact, maybe we should actually go to the outside because it will be easier.
And to just increase the font size.
We don't have to write this command, Windows as an administrator.
It's completely optional.
So just go ahead.
And change here, to the correct directory We have module eight here X,
64 debug this is what we've been building here,
are these various executive, word We've seen so far.
One of them, is uh is injector, of course,
and We have the DLL here called simple dot DLL.
So we have injector here.
We need to provide the process.
ID which was 16164 our me correctly.
And then the path, to the DLL,
is actually going to be the same thing as we see here.
We need to provide the full path because we don't have any idea
what the current directory of the target process.
Is So we don't want to provide real path because it's going to be interpreted,
in the wrong way.
Its going to be interpreted compared to the target process,
not to our console Windows here or our own injector process for that matter.
So we have simple DLL here.
And here it goes.
So you can see We have a bunch of a PCs being cued,
to the thread, and We hope that This one would work indeed it did you.
Can see that The message box pops up with the
Notepad You can see it indicates it.
Is coming from process 16164 which is the Notepad process,
Notepad Now going back to its Notepad way.
So this was an interesting example of using a PC for DLL loading,
in the target process.