.dll Injection and Patching

This page is under construction. USE AT YOUR OWN RISK!

Assembly Language Tutorial

Please choose a tutorial page: Fundamentals -- Information about C Tools Registers Simple Instructions Example 1 -- SC CDKey Initial Verification Example 2 -- SC CDKey Shuffle Example 2b -- SC CDKey Final Decode The Stack Stack Example Functions Example 3 -- Storm.dll SStrChr Assembly Summary Machine Code Example 4 -- Smashing the Stack Cracking a Game Example 5 -- Cracking a game Example 6 -- Writing a keygen .dll Injection and Patching Memory Searching Example 7 -- Writing a cheat for Starcraft (1.05) Example 7 Step 1 -- Displaying Messages Example 7 Step 1b -- Above, w/ func ptrs Example 7 Final Example 8 -- Getting IX86.dll files 16-bit Assembly Example 9 -- Keygen for a 16-bit game Example 10 -- Writing a loader

.dll injection is the easiest and most common way to write a hack.

To perform an injection, a process is told to load an attacker-controlled .dll file into its space. When loaded, the .dll file adds jumps (or "hooks") to certain places in the target program that automatically call functions in the .dll file. This allows the .dll file to capture specific events, such as packets being received, commands being typed, or anything else.

Injection

If you want a program to do it for you without reading any further, feel free to grab the one I wrote. It works well, but can't really be automated.

If you want to learn more about injection, feel free to browse my code here or download the code here. It's my first (and only) Windowsy program, so it might be valuable some day! But seriously, be gentle, and if you think you can improve it I'd welcome the change.

Basically, a program calls CreateRemoteThread() in the foreign process, giving it some code. The code given simply calls LoadLibrary() on your selected .dll file, which loads it into the program's address space.

If you want any more details about how injection works, check out Richter's book or my source code. It's been a long time, and I've always just used that program.

Patching

When loaded, the .dll file, in DLL_PROCESS_ATTACH, typically overwrites sections of the program's code, using WriteProcessMemory(), to point to itself. The overwritten code must also be run before the hack is (or after, but I generally do it before). Otherwise, the commands will never be run, and the program will likely misbehave.

What I typically do is declare an array of characters that will hold the overwritten code as well as a jump to my custom function. This might be an assembly function to be overwritten:

<< insert assembly here >>

Once overwritten, the function will look something like this:

<< insert assembly with extra call >>

Note how the 5 bytes, insert bytes here were overwritten to add the call. Also note that, because it's a "call", the current address is pushed on the stack. As a result, the stack won't be in the same position. However, a call is used so that the function can easily be returned to. Later, we'll discuss some strategies with getting around this problem.

So what we need is a buffer containing this code:

<< insert overwritten assembly >>
jmp HackFunction

Which translates to this machine code, stored in C code:

char *wrapper = " <<< insert machine code >> \xe9\x??\x??\x??\x??"

Where the last four bytes are the distance between that buffer and the wrapper function.

.......... to be continued ................

This page is under construction. USE AT YOUR OWN RISK!

Questions

Feel free to edit this section and post questions, I'll do my best to answer them. But you may need to contact me to let me know that a question exists.