DLL Injection - Getting started
DLL Injection - Getting started
What is DLL injection?
DLL injection is a powerful technique where we inject a DLL inside another process in order to execute our own code from within that process.
For example, if we injected a DLL with this code...
...into notepad, it would make notepad call that code, thus show the messagebox. And this is exactly what we're going to do in this tutorial.
Heed my words...
...DLL injection is anything but a safe method, and not knowing what you're doing could very easily result into a system wide disaster. Therefore it is highly recommended that you have at least a basic understanding of the Windows operating system and the c++ programming language before you continue.
Setup
With that out of the way, we can finally get started! Download our DLL injector here.
You will also need a c++ compiler to create the DLL to inject. I use Microsoft's Visual C++ IDE in this tutorial, but are free to use any compiler you like.
Create a new Win32 project and name it 'InjectDLL'.
For type, select 'DLL' and click 'Finish'.
A new project is created. Tap 'dllmain.cpp' open.
You should now see this piece of code:
As you can see, the compiler has generated the DllMain function for you. This is the very function that first gets called by a process when your DLL is injected into it. More precisely, the
part. So let's write the code for our MessageBox there.
Build the project.
Fire up notepad and the DLL injector. Hit the browse button of 'DLL Path' and find your "InjectDLL.dll". Click OK.
Now we're all set to inject, so click "Inject". This is what should happen:
Notepad shows a MessageBox 'Hello from notepad!'. Notepad's UI is frozen until you click "OK", just like any other application that shows a MessageBox. InjectDLL.dll is added to the injector's list of injected DLLs. From that list you can eject the DLL by selecting it and clicking the "Uninject" button. When you uninject a DLL, the 'case DLL_PROCESS_DETACH:' part of your DLL's code gets called. That's where you do all the required cleanup. In this case, we don't need any.
Conclusion
You now have successfully injected a DLL with your own code into an external process to manipulate it's behavior, forcing the poor notepad to create a MessageBox of your your liking.
But you have just scratched the surface here. Think outside the box. Like I said, with this technique you can wreak unlimited havoc inside a process. When you think about what you can/can't do with DLL injection, think about what you can/can't do with creating a function inside your own program and callintg it. There is no limits. You can, for example, call or intercept the functions that already exist(this is called hooking).
Remember to take great care when you use this technique. Like I said earlier, doing it wrong can cause unexpected, disastrous behavior.
Tutorial from:
UGSoft - Game Hacking Tutorials
DLL injection is a powerful technique where we inject a DLL inside another process in order to execute our own code from within that process.
For example, if we injected a DLL with this code...
Code:
MessageBox(NULL, L"Message Text", L"Message Title", MB_OK);
Heed my words...
...DLL injection is anything but a safe method, and not knowing what you're doing could very easily result into a system wide disaster. Therefore it is highly recommended that you have at least a basic understanding of the Windows operating system and the c++ programming language before you continue.
Setup
With that out of the way, we can finally get started! Download our DLL injector here.
You will also need a c++ compiler to create the DLL to inject. I use Microsoft's Visual C++ IDE in this tutorial, but are free to use any compiler you like.
Create a new Win32 project and name it 'InjectDLL'.
For type, select 'DLL' and click 'Finish'.
A new project is created. Tap 'dllmain.cpp' open.
You should now see this piece of code:
Code:
// dllmain.cpp : Defines the entry point for the DLL application.
#include "stdafx.h"
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
Code:
case DLL_PROCESS_ATTACH:
Code:
case DLL_PROCESS_ATTACH:
MessageBox(NULL, L"Hello from notepad!", L"notepad", MB_OK);
Fire up notepad and the DLL injector. Hit the browse button of 'DLL Path' and find your "InjectDLL.dll". Click OK.
Now we're all set to inject, so click "Inject". This is what should happen:
Notepad shows a MessageBox 'Hello from notepad!'. Notepad's UI is frozen until you click "OK", just like any other application that shows a MessageBox. InjectDLL.dll is added to the injector's list of injected DLLs. From that list you can eject the DLL by selecting it and clicking the "Uninject" button. When you uninject a DLL, the 'case DLL_PROCESS_DETACH:' part of your DLL's code gets called. That's where you do all the required cleanup. In this case, we don't need any.
Conclusion
You now have successfully injected a DLL with your own code into an external process to manipulate it's behavior, forcing the poor notepad to create a MessageBox of your your liking.
But you have just scratched the surface here. Think outside the box. Like I said, with this technique you can wreak unlimited havoc inside a process. When you think about what you can/can't do with DLL injection, think about what you can/can't do with creating a function inside your own program and callintg it. There is no limits. You can, for example, call or intercept the functions that already exist(this is called hooking).
Remember to take great care when you use this technique. Like I said earlier, doing it wrong can cause unexpected, disastrous behavior.
Tutorial from:
UGSoft - Game Hacking Tutorials
Ill try It...
Lol.
Idk why but it doesn't work ._.
Idk why but it doesn't work ._.
Originally Posted by ObeA
Lol.
Idk why but it doesn't work ._.
Idk why but it doesn't work ._.
Originally Posted by ObeA
Lol.
Idk why but it doesn't work ._.
Idk why but it doesn't work ._.
Code:
// dllmain.cpp : Defines the entry point for the DLL application.
#include "stdafx.h"
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
MessageBox(NULL, L"Hello from notepad!", L"notepad", MB_OK);
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
Originally Posted by ObeA
Code:
// dllmain.cpp : Defines the entry point for the DLL application.
#include "stdafx.h"
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
MessageBox(NULL, L"Hello from notepad!", L"notepad", MB_OK);
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
You've got some kind of error guys?
It's probably because you're trying to inject it to 64bit notepad, try injecting it into 32bit application, Notepad++ for example.
It's probably because you're trying to inject it to 64bit notepad, try injecting it into 32bit application, Notepad++ for example.
I really need to get read this, thanks.
Cool, 1 qeustion though: How would one see the source code of the game, isn't it needed to know how variables and such are named?
Thanks for the tutorial, even though you're banned.
thanks alot for your work
Similar Threads
- 3Last post
- 10Last post
- 2Last post
- 1Last post
- 1Last post