digitalmars.D.learn - DLL Injection

valente500 (46/46) Feb 07 2012 I've been trying for a while now to inject a DLL written in D

maarten van damme (3/3) Feb 09 2012 does it ever go past the cast point? what happens when you try{}catch an...

valente500 (29/29) Feb 10 2012 Well if I change the DLL_PROCESS_ATTACH case to this:

maarten van damme (2/2) Feb 10 2012 strange, does this happen with the corresponding C version?

valente500 (5/5) Feb 10 2012 Everything works perfectly if I write the DLL in C++ (and I've

maarten van damme (31/31) Feb 11 2012 I've also injected some dll's and when I recompiled them they seemed to

s0beit (19/19) Nov 26 2012 I recently had this problem, and I think I've solved it for now

s0beit (10/29) Nov 26 2012 Actually completely disregard, what was actually happening was me

s0beit (18/18) Dec 01 2012 Alright, at the end of my long search I have finally concluded

js.mdnq (5/23) Dec 01 2012 Would it be possible for you to write wrapper in C that hooks

s0beit (10/37) Dec 01 2012 You can probably make something in D to do that, but I must be

s0beit (4/4) Dec 01 2012 Alright, I was finally able to give it a try:

maarten van damme (2/6) Dec 02 2012

s0beit (4/12) Dec 02 2012 Thanks! Please let me know the results if you end up trying it, I

maarten van damme (3/17) Dec 03 2012 Strangely, the main in my dll is getting executed multiple times and

s0beit (13/16) Dec 03 2012 mcvcr71.dll is probably loaded by your library, I don't know if D

maarten van damme (3/3) Dec 03 2012 Yes, that was the problem :p

"valente500" <valente500 live.com> writes:

I've been trying for a while now to inject a DLL written in D 
into another process, and I just haven't been able to get it 
working.

Here's the code for the DLL:


import std.c.windows.windows;
import core.sys.windows.dll;

__gshared HINSTANCE g_hInst;

extern (Windows)
BOOL DllMain(HINSTANCE hInstance, ULONG ulReason, LPVOID 
pvReserved)
{
    switch (ulReason)
    {
        case DLL_PROCESS_ATTACH:
			g_hInst = hInstance;
			dll_process_attach(hInstance, true);
			
			*cast(int*)0x22FF3C = 1337;
	    break;

        case DLL_PROCESS_DETACH:
			dll_process_detach(hInstance, true);
	    break;

        case DLL_THREAD_ATTACH:
			dll_thread_attach(true, true);
	   	break;

        case DLL_THREAD_DETACH:
			dll_thread_detach(true, true);
		break;
			
		default: break;
    }
    return true;
}



Basically I just copy and pasted the code from the DLL tutorial 
on the D website and added the *cast(int*)0x22FF3C = 1337; line. 
The process I'm injecting it into has a value at that address 
which I want to change.

The problem is that when I inject the DLL into the process with 
Winject (a DLL Injector), the value changes fine, but Winject 
complains "Injection seemed successful, but DLLMain() never 
returned (TIMEOUT)", and then the process crashes 30 seconds 
later.

I also tested it with another injector, and the process just 
freezes. So I'm wondering how to write a DLL that injects 
successfully.

Cheers.

Feb 07 2012

maarten van damme <maartenvd1994 gmail.com> writes:

does it ever go past the cast point? what happens when you try{}catch and
print the error out?
I've injected but with writeprocessmemory.

Feb 09 2012

"valente500" <valente500 live.com> writes:

Well if I change the DLL_PROCESS_ATTACH case to this:

case DLL_PROCESS_ATTACH:
	MessageBoxA(null, "Injected!", "DLL", MB_OK);
	
	g_hInst = hInstance;
	dll_process_attach(hInstance, true);
	
	try
	{
		*cast(int*)0x12FE6C = 1337;
	}
	catch(Exception e)
	{
		MessageBoxA(null, "Exception!", "DLL", MB_OK);
	}
	
	MessageBoxA(null, "Finished!", "DLL", MB_OK);
break;


then I get the "Injected!" and "Finished!" MessageBox()s popping 
up, but not the "Exception!", so yes the code does get past the 
cast line (but still crashes). The same thing happens even if I 
remove the try/catch block and the cast line altogether.

I changed my post-mortem debugger from the default Dr. Watson to 
Visual Studio's just-in-time debugger, and after it displays 
"Finished!", I get an unhandled win32 exception in the injected 
process.

And yer, I would normally use WriteProcessMemory() for something 
this trivial, but I want to eventually do some more advanced 
stuff.

Feb 10 2012

maarten van damme <maartenvd1994 gmail.com> writes:

strange, does this happen with the corresponding C version?
and what happens if you inject a D dll without changing that value?

Feb 10 2012

"valente500" <valente500 live.com> writes:

Everything works perfectly if I write the DLL in C++ (and I've 
never had any errors with C++ DLL's before that are similar to 
this one).

If I remove the cast line and MessageBox()'s in the D version, 
then I still get the error.

Feb 10 2012

maarten van damme <maartenvd1994 gmail.com> writes:

I've also injected some dll's and when I recompiled them they seemed to
crash the target program too.
this means that no C program will be able to load a dll written in D :s
the test I compiled was
import std.c.windows.windows;
import core.sys.windows.dll;

__gshared HINSTANCE g_hInst;

extern (Windows)
BOOL DllMain(HINSTANCE hInstance, ULONG ulReason, LPVOID pvReserved)
{
    switch (ulReason)
    {
case DLL_PROCESS_ATTACH:
    g_hInst = hInstance;
    dll_process_attach( hInstance, true );
    break;

case DLL_PROCESS_DETACH:
    dll_process_detach( hInstance, true );
    break;

case DLL_THREAD_ATTACH:
    dll_thread_attach( true, true );
    break;

default:
    dll_thread_detach( true, true );
    break;
    }
    return true;
}

with dmd version 2.055
It used to work. is this a bug/regression? I'm going to upgrade my dmd to
the newest level and try again

Feb 11 2012