1

I'm using C++ to inject a DLL into a running process. A great source code base for this is here (it's the one I'm using). For a short example, you may use the code from this question. My problem is that after injection, the DLL is immediately unloaded again. I can observe loaded DLLs in x64Dbg for instance when the debugger is attached and it said the following:

Thread 7CC8 created, Entry: <kernel32.LoadLibraryA>
DLL Loaded: 0000000001110000 D:\MyDLL.dll
DLL Unloaded: 0000000001110000 mydll.dll
Thread 7CC8 exit

I debugged the injection and it always happened on CreateRemoteThread() or a similar method of setting up and running the thread.

Why is this happening and how to prevent the process from unloading the DLL? I've seen comments like this one suggesting to use GetModuleHandleEx but I'm not sure where to use it in the code and how. When finding the address of LoadLibrary in the target process or does it need to be called in the injected DLL? How would the method call look like then?

loadLibAddr = GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryA");

Another suggestion was to repeatedly call LoadLibrary but when exactly? The process already unloaded the DLL after the thread creation so I'm not sure how this could be done.

Reflective injection does not work (e.g. GetReflectiveLoaderOffset() returns 0). I'm also working with entirely 64-bit applications.

I know this is possible since I've seen a persistent injection happen by another application.

BullyWiiPlaza
  • 17,329
  • 10
  • 113
  • 185
  • 1
    Show your code. – Havenard Jun 22 '18 at 01:22
  • One thing that I already detected is that you are using the address of `LoadLibraryA` from your current process rather than the remote one, they are not the same. – Havenard Jun 22 '18 at 01:25
  • There are much easier ways of injecting DLLs if you ask me, take a look at `SetWindowsHookEx`. – Havenard Jun 22 '18 at 01:27
  • @Havenard: I'm using pretty much exactly the code from the `GitHub` repository https://github.com/OpenSecurityResearch/dllinjector since it is very configurable. – BullyWiiPlaza Jun 22 '18 at 01:31
  • I don't do Windows, but ... is your `DllMain` or whatever returning or something like that? – o11c Jun 22 '18 at 01:52
  • @o11c: Yes, it installs some hooks and then returns successfully. It's meant to do that but I'm still wondering why it gets unloaded and the hooks are also not in effect then. – BullyWiiPlaza Jun 22 '18 at 08:06
  • I suspect it was never really loaded, would have to analyze the relevant parts of the code. Either LoadLibrary fails or FreeLibrary is called, and it surely doesn't call itself. – Havenard Jun 22 '18 at 21:41
  • Maybe DllMain returns something it shouldn't? I don't remember if it matters but it's worth taking a look. – Havenard Jun 22 '18 at 21:43

0 Answers0