process injection, maybe madshi can answer?

Posted on 2003-03-22
Medium Priority
Last Modified: 2010-04-16
{$IMAGEBASE $13140000}

function InjectExe(Process: LongWord; EntryPoint: Pointer): BOOL;
  Module, NewModule: Pointer;
  Size, BytesWritten, TID: LongWord;
  Result := False;
  Module := Pointer(GetModuleHandle(nil));
  Size := PImageOptionalHeader(Pointer(integer(Module) + PImageDosHeader(Module)._lfanew + SizeOf(dword) + SizeOf(TImageFileHeader))).SizeOfImage;
  xVirtualFreeEx(Process, Module, 0, MEM_RELEASE);
  NewModule := xVirtualAllocEx(Process, Module, Size, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);
  WriteProcessMemory(Process, NewModule, Module, Size, BytesWritten);
  if xCreateRemoteThread(Process, nil, 0, EntryPoint, Module, 0, @TID) <> 0 then Result := True;


the idea is to take the current running PE image and copy it exactly into another process and create a thread for it. this works perfectly in NT/2K/XP using both native api AND elicz's RT which allows xCreateRemoteThread etc to work on 95/98/ME.

the result is the PE image running inside another process.

now assuming elicz's code works perfectly, what would be the reason this doesn't work on 95/98/ME. does it have something to do with the image base being so high? (my guess)

let me know what other info you need to understand this better. I don't mind raising the points if anyone can fix it but I really just want to know why it doesn't work.
Question by:OpenSourceDeveloper
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 20

Accepted Solution

Madshi earned 500 total points
ID: 8193463
In the NT family you can tell Windows at which address you want the memory to be allocated, even if you allocate memory in another process. In the 9x family you (normally) can't even allocate memory in another process at all. Only using undocumented stuff you can do that in 9x - and in this case you can't specify where exactly it is allocated. Most probably it will be > $80000000. As a result your EntryPoint is not valid anymore. You have to calculate the new entry point. Another problem is that if you copy the DLL image data to another base address, it needs to be relocated. So it's not that easy in 9x. And btw, even in NT you will run into problems if the specified image base address is already in use in the other process. In that case your code will fail, too.

Regards, Madshi.

Author Comment

ID: 8200044
ahh ok you are right. if you specify a starting address then xVAE fails on 9x. if you specify nil then it works.

it would be nice if elicz had documented that.

thanks for your brilliance as usual. :)

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Creating an auto free TStringList The TStringList is a basic and frequently used object in Delphi. On many occasions, you may want to create a temporary list, process some items in the list and be done with the list. In such cases, you have to…
Hello everybody This Article will show you how to validate number with TEdit control, What's the TEdit control? TEdit is a standard Windows edit control on a form, it allows to user to write, read and copy/paste single line of text. Usua…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
In this video, Percona Solution Engineer Dimitri Vanoverbeke discusses why you want to use at least three nodes in a database cluster. To discuss how Percona Consulting can help with your design and architecture needs for your database and infras…
Suggested Courses
Course of the Month15 days, 7 hours left to enroll

741 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question