DLL injection in C #

DLL injection in C #

In fact, DLL injection is very simple. It is nothing more than calling APIs such as virtualallocex, writeprocessmemory, OpenProcess, and createremotethread. Because I learned C #, I also want to take a look at the article C, however, after searching for a long time on the Internet, I did not find an article. Maybe it was because of the rise of C #. I didn't know much about C #, so I had to transplant it myself, because all programming languages are the same when using API functions, this makes it easy for us to transplant them. To learn C #, the concept of API calling should be very weak, C # usually does not call API functions, because these are already encapsulated. to end a process in VB, Vc, and other languages, you must first obtain the handle of the process, then, you can perform operations such as shutting down processes. To get a handle, you need to use the OpenProcess API function. to end a process, you need to use the terminateprocess API function, however, in C #, you do not need to know these API functions to complete the same function. I. Learning VB is a good choice. Okay! Next, let's start our C # DLL injection journey!

First, you must add the following API functions:

[Dllimport (kernel32.dll)]

Public static extern int virtualallocex (intptr hwnd, int lpaddress, int size, int type, int tect );

[Dllimport (kernel32.dll)]

Public static extern int writeprocessmemory (intptr hwnd, int baseaddress, string buffer, int nsize, int filewriten );

[Dllimport (kernel32.dll)]

Public static extern int getprocaddress (INT hwnd, string lpname );

[Dllimport (kernel32.dll)]

Public static extern int getmodulehandlea (string name );

[Dllimport (kernel32.dll)]

Public static extern int createremotethread (intptr hwnd, int attrib, int size, int address, int par, int flags, int threadid );







C # it is complicated to declare an API. Because it is to call an unmanaged DLL, you need to use dllimport to call an unmanaged DLL. There are many other attributes that I will not talk about here, I have a good introduction on the Internet. You can check it. However, it is very convenient to call C # itself to become a dynamic link library. Simply add a reference and it will be OK. A reference used to call DLL is as follows: using system. runtime. interopservices; Do not forget to add this. below is all the compiled code:

Using system;

Using system. Collections. Generic;

Using system. componentmodel;

Using system. Data;

Using system. drawing;

Using system. text;

Using system. Windows. forms;

Using system. runtime. interopservices;

Using system. diagnostics;

Namespace dllinject

{

Public partial class form1: Form

{

[Dllimport (kernel32.dll)] // declare an API Function

Public static extern int virtualallocex (intptr hwnd, int lpaddress, int size, int type, int tect );

[Dllimport (kernel32.dll)]

Public static extern int writeprocessmemory (intptr hwnd, int baseaddress, string buffer, int nsize, int filewriten );

[Dllimport (kernel32.dll)]

Public static extern int getprocaddress (INT hwnd, string lpname );

[Dllimport (kernel32.dll)]

Public static extern int getmodulehandlea (string name );

[Dllimport (kernel32.dll)]

Public static extern int createremotethread (intptr hwnd, int attrib, int size, int address, int par, int flags, int threadid );

Public form1 ()

{

Initializecomponent ();

}



Private void button#click (Object sender, eventargs E)

{

Int ok1;

// Int ok2;

// Int hwnd;

Int baseaddress;

Int temp = 0;

Int hack;

Int Yan;

String dllname;

Dllname = C :\\ DLL. dll;

Int dlllength;

Dlllength = dllname. length 1;

Process [] pname = process. getprocesses (); // gets all processes

Foreach (process name in pname) // traverses the process

{

// MessageBox. Show (name. processname. tolower ());

If (name. processname. tolower (). indexof (Notepad )! =-1) // As shown in notepad, the injection starts below

{



Baseaddress = virtualallocex (name. Handle, 0, dlllength, 4096, 4); // apply for memory space

If (baseaddress = 0) // If 0 is returned, the operation fails.

{

MessageBox. Show (failed to apply for memory space !!);

Application. Exit ();

}

Ok1 = writeprocessmemory (name. Handle, baseaddress, dllname, dlllength, temp); // write memory

If (ok1 = 0)

{



MessageBox. Show (failed to write memory !!);

Application. Exit ();

}

Hack = getprocaddress (getmodulehandlea (Kernel32), loadlibrarya); // obtain the loadlibarary address in kernek32.dll

If (hack = 0)

{

MessageBox. Show (unable to obtain the function entry point !!);

Application. Exit ();

}

Yan = createremotethread (name. Handle, 0, 0, hack, baseaddress, 0, temp); // create a remote thread.

If (Yan = 0)

{

MessageBox. Show (failed to create a remote thread !!);

Application. Exit ();

}

Else

{

MessageBox. Show (successfully injected DLL !!);

}



}



}



}

}