Help DLL Injector Fails [C++] - Printable Version

PHP Code:

#include <windows.h>
#include <tlhelp32.h>
#include <shlwapi.h>
#include "cus.h"

#define CREATE_THREAD_ACCESS (PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ)

using namespace std;

//fr errorcode
DWORD dErr;
TCHAR sErrStatus[256];    
//

DWORD ProcID;
bool InjectSuccess;
bool hasProcID;

string sDLLStatus;
string sProcessStatus;
string sEndStatus = "Press [F2] to quit";
string sCusInjectStatus = "Press [F1] to inject DLL";

char* DLLName = NULL;
char* ProcName = NULL;
string sProcName;
string sDLLName;

bool getProcID(char* cPName,DWORD *idAdd);
bool InjectDLL(DWORD pID);
void UI();


int main()
{
    eigen::central("----------DLL INJECTOR---------");
    cout << endl;
    eigen::central("by Tomsen1410");
    cout << endl;
    eigen::central("-------------------------------");
    cout << endl;
    cout << endl;
    
    cout << "Type in process name: ";
    cin >> sProcName;
    ProcName = new char[sProcName.length()];
    strcpy(ProcName, sProcName.c_str());
    
    cout << endl;
    cout << "Type in the DLL name: ";
    cin >> sDLLName;
    DLLName = new char[sDLLName.length()];
    strcpy(DLLName, sDLLName.c_str());
    
    sDLLStatus = "-";
    sProcessStatus = "-";
    UI();
    while(!InjectSuccess){
    
        if(GetAsyncKeyState(VK_F1))
        {    
            hasProcID = getProcID(ProcName,&ProcID);
            InjectSuccess = InjectDLL(ProcID);
            if(InjectSuccess){sEndStatus = "";sCusInjectStatus = "";}
            UI();
            Sleep(100);
        }
        if(GetAsyncKeyState(VK_F2))
        {    
            return 0;
        }
    }
    Beep(1600,200);
    UI();
    cout << endl << endl;
    cout << "---INJECTED---"<<endl;
    for(int i=3;i>0;i--){
        cout << "Closing in " << i << endl;
        Sleep(1000);
    }

    
    return 0;
}

bool getProcID(char* cPName,DWORD *idAdd){

    bool isHere;
    PROCESSENTRY32 pe32;
    HANDLE hSnapShot;

    hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if(hSnapShot == INVALID_HANDLE_VALUE){
               dErr = GetLastError();
               FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, dErr, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)sErrStatus,0,NULL);return false;}
    pe32.dwSize = sizeof(PROCESSENTRY32);

    isHere = Process32First(hSnapShot,&pe32);

    while(isHere){

        if(strcmp(cPName,pe32.szExeFile) == 0){
            *idAdd = pe32.th32ProcessID;
            CloseHandle(hSnapShot);
            sProcessStatus = "--Fine--";
            return true;}
        isHere = Process32Next(hSnapShot,&pe32);
        pe32.dwSize = sizeof(PROCESSENTRY32);
    }

    CloseHandle(hSnapShot);
    sProcessStatus = "Process not found!";


    return false;
}

bool InjectDLL(DWORD pID){


    //check if DLL exists
    ifstream fDLL(DLLName);
    if(!fDLL){

            sDLLStatus = "File not found!";
            return false;}
    
   HANDLE Proc;
   HANDLE hWirt;
   char buf[50]={0};
   LPVOID RemoteString, LoadLibAddy;

   Proc = OpenProcess(CREATE_THREAD_ACCESS, FALSE, pID);

   if(!Proc)
   {    
       dErr = GetLastError();
       FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, dErr, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)sErrStatus,0,NULL);
       return false;
   }

   LoadLibAddy = (LPVOID)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
   if(LoadLibAddy == NULL){
       dErr = GetLastError();
       FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, dErr, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)sErrStatus,0,NULL);
       return false;}
   RemoteString = (LPVOID)VirtualAllocEx(Proc, NULL, strlen(DLLName)+1, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);
   if(RemoteString == NULL){
       dErr = GetLastError();
       FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, dErr, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)sErrStatus,0,NULL);
       return false;}
   if(WriteProcessMemory(Proc, (LPVOID)RemoteString, DLLName, strlen(DLLName)+1, NULL) == 0){
       dErr = GetLastError();
       FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, dErr, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)sErrStatus,0,NULL);
       return false;}
   hWirt = CreateRemoteThread(Proc, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, NULL, NULL);
   if(hWirt = NULL){
       dErr = GetLastError();
       FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, dErr, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)sErrStatus,0,NULL);
       return false;}
   sDLLStatus = "--Fine--";
   CloseHandle(Proc);   
   return true;
}

//
void UI(){

    system("CLS");
    eigen::central("----------DLL INJECTOR---------");
    cout << endl;
    eigen::central("by Tomsen1410");
    cout << endl;
    eigen::central("-------------------------------");
    cout << endl;
    cout << endl;
    cout << endl;
    cout << sCusInjectStatus << endl;
    cout << sEndStatus << endl << endl;
    cout << "Process Status: " << sProcessStatus << endl;
    cout << "DLL Status    : " << sDLLStatus << endl;
    if(sErrStatus != ""){
        cout << endl;
        cout << "Error: " << sErrStatus;}

}

PHP Code:

#include "main.h"

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    MessageBoxA(0, "test", "", 0);

    return TRUE;
}

Code:

#include <windows.h>
#include <iostream>
#include <tlhelp32.h>
#define MAXWAIT 10000
#include "injection.h"

using namespace std;

int main()
{
	char exename[MAX_PATH];
	char dllname[MAX_PATH];

	cout << "Welcome to PhyX injector v1.0" << endl;
	Sleep(1000);
	cout << "Please enter dll name Example: c:\\PhyX.dll\n" << endl;
	cin >> dllname;
	cout << "Dll name is:" << dllname << endl;
	Sleep(1000);
	cout << " Please enter window name of the processor example:notepad " << endl;
	cin >> exename;
	cout << "Widnow name is" << exename << endl;
	Sleep(1000);

	BOOL bFound;
	PROCESSENTRY32 pe;
	HANDLE hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
	pe.dwSize=sizeof(pe);
	bFound=Process32First(hSnap,&pe);
	do {
		if (strstr(pe.szExeFile,exename)) {
			insertDll(pe.th32ProcessID, dllname); // c:\\PhyX.dll
			cout << "Injection successful!" << endl;
		}else{ cout << "Injection failed!" << endl; }

		pe.dwSize=sizeof(pe);
		bFound=Process32Next(hSnap,&pe);
	} while(bFound);
	getchar();
}

Code:

bool insertDll(DWORD procID, char *dll)
{
	//Find the address of the LoadLibrary api, luckily for us, it is loaded in the same address for every process
	HMODULE hLocKernel32 = GetModuleHandle("Kernel32");
	FARPROC hLocLoadLibrary = GetProcAddress(hLocKernel32, "LoadLibraryA");

	HANDLE hProc = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_QUERY_INFORMATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_VM_OPERATION, FALSE, procID);

	printf("prochandle %d %d\n",hProc,procID);
	//Allocate memory to hold the path to the Dll File in the process's memory

	LPVOID hRemoteMem = VirtualAllocEx(hProc, NULL,strlen( dll)+1, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
	printf("%x\n",hRemoteMem);

	//Write the path to the Dll File in the location just created
	WriteProcessMemory(hProc, hRemoteMem, dll, strlen(dll)+1,0);

	//Create a remote thread that starts begins at the LoadLibrary function and is passed are memory pointer
	HANDLE hRemoteThread = CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)hLocLoadLibrary, hRemoteMem, 0, NULL);

	//Release the handle to the other process
	CloseHandle(hProc);

	return 0;
}