Showing posts with label programming. Show all posts
Showing posts with label programming. Show all posts

Tuesday, September 3, 2013

ProjectEuler #7 + Solution

Problem description:
Quote:By listing the first six prime numbers: 2, 3, 5, 7, 11, and 13, we can see that the 6th prime is 13.

What is the 10001st prime number?

Try to solve it by yourself and then look at the solution.

Solution:

Monday, September 2, 2013

Assembly Calculator + Source

Hello everyone,

After a long hassle, I began learning Assembly; I must say it is very challenging and it is definitely worth it.

Here is the source:
Code:
.data
    Hello:
        .asciz "1. Add\n2. Subtract\n3. Divide\n4. Multiplication\nOption:"
    first:
        .asciz "First Number:"
    second:
        .asciz "Second Number:"
    answer:
        .asciz "The answer is: %d\n"
    d:
        .ascii "%d\0"
    int1:
        .int 0
    int2:
        .int 0
    option:
        .int 1
.text

.globl _main

    _main:
        pushl $first
        call _printf
        addl $4, %esp

        pushl $int1
        pushl $d
        call _scanf
        addl $8, %esp

        pushl $second
        call _printf
        addl $4, %esp

        pushl $int2
        pushl $d
        call _scanf
        addl $8, %esp

        pushl $Hello
        call _printf
        addl $4, %esp

        pushl $option
        pushl $d
        call _scanf
        addl $8, %esp

        cmpl $1, option
        jz toadd
        cmpl $2, option
        jz subtract
        cmpl $3, option
        jz divide
        cmpl $4, option
        jz multiplication

        toadd:
        movl int1, %eax
        addl int2, %eax
        pushl %eax
        pushl $answer
        call _printf
        addl $8, %esp        
        jmp end        

        subtract:

        movl int1, %eax
        subl int2, %eax
        pushl %eax
        pushl $answer
        call _printf
        addl $8, %esp
        jmp end        

        divide:
        movl int1, %eax
        movl int2, %ebx
        xorl %edx, %edx
        idivl %ebx
        pushl %eax
        pushl $answer
        call _printf        
        addl $8, %esp
        jmp end        

        multiplication:                
        movl int1, %eax
        movl int2, %ebx
        imull %ebx
        pushl %eax
        pushl $answer
        call _printf
        addl $8, %esp

        end:
        call _getchar
        call _getchar
        ret

How do you assemble it?
Code:
as -o main.o main.s

How do you link it?
Code:
ld main.o -o main.exe -e_main -L"C:\Dev-cpp\lib" -lmsvcrt

Is there an easier method to assemble and link it?
Yes, there is. Open notepad and put this:
Code:
as -o main.o main.s
ld main.o -o main.exe -e_main -L"C:\Dev-cpp\lib" -lmsvcrt
Save it as build.bat[orwhatever.bat] and put it into the same folder as the source. Open the build.bat and it should compile.

Sunday, September 1, 2013

Simple Network Chat + Source

Hello fellow programmers,

It's a very simple chat program. The only problem is that the server doesn't handle multiple clients. I'll make one as soon as I gain in depth knowledge in Winsocks. If possible, can anyone link me to a guide to learn about handling multiple clients?

Client source:
Code:
/**

Program: Simple chat program
Author: Sri Krishna

**/

#include <iostream>
#include <windows.h>
#pragma comment(lib, "ws2_32.lib")

SOCKET sock;

void recvdata()
{
    while(1)
    {
        char msg[256];
        memset(msg, 0, 256);
        int r = recv(sock, msg, 256, 0);
        if(r == SOCKET_ERROR)
        {
            std::cout << "\n\nServer is disconnected\n\n";
            std::cin.ignore();
            std::cin.get();
            closesocket(sock);
            WSACleanup();
            exit(1);
        }
        else
            std::cout << "Friend: " << msg << std::endl;
    }
}

void senddata()
{
    while(1)
    {
        char msg[256];
        memset(msg, 0, 256);
        std::cin.get(msg, 256);
        int ret = send(sock, msg, strlen(msg), 0);
        if(ret == SOCKET_ERROR)
        {
            std::cout << "\n\nServer is disconnected\n\n";
            std::cin.ignore();
            std::cin.get();
            closesocket(sock);
            WSACleanup();
            exit(1);
        }
        std::cin.ignore();
    }
}

int main()
{
    WSADATA wsData;
    if(WSAStartup(MAKEWORD(2, 2), &wsData) != 0)
    {
        std::cout << "WSAStartup!\n";
    }
    else
    {
        sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
        if(sock == INVALID_SOCKET)
        {
            std::cout << "socket()\n";
            WSACleanup();
        }
        else
        {
            sockaddr_in sin;
            sin.sin_addr.S_un.S_addr = inet_addr("127.0.0.1");
            sin.sin_port = htons(626);
            sin.sin_family = AF_INET;

            while(connect(sock, (sockaddr*)&sin, sizeof(sin)) == SOCKET_ERROR)
                connect(sock, (sockaddr*)&sin, sizeof(sin));
            std::cout << "Connected to your friend\n\n";
            HANDLE hThread[2];
            DWORD thread1, thread2;
            hThread[0] = CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)recvdata, NULL, NULL, &thread1);
            hThread[1] = CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)senddata, NULL, NULL, &thread2);
            WaitForMultipleObjects(2, hThread, true, INFINITE);
        }
    }

    std::cin.ignore();
    std::cin.get();
    return 0;
}

Server source:
Code:
/**

Program: Simple chat program
Author: Sri Krishna

**/

#include <iostream>
#include <windows.h>
#pragma comment(lib, "ws2_32.lib")

SOCKET sock, acceptsock;

void recvdata()
{
    while(1)
    {
        char msg[256];
        memset(msg, 0, 256);
        int r = recv(sock, msg, 256, 0);
        if(r == SOCKET_ERROR)
        {
            std::cout << "\n\nServer is disconnected\n\n";
            std::cin.ignore();
            std::cin.get();
            closesocket(sock);
            WSACleanup();
            exit(1);
        }
        else
            std::cout << "Friend: " << msg << std::endl;
    }
}

void senddata()
{
    while(1)
    {
        char msg[256];
        memset(msg, 0, 256);
        std::cin.get(msg, 256);
        int ret = send(sock, msg, strlen(msg), 0);
        if(ret == SOCKET_ERROR)
        {
            std::cout << "\n\nServer is disconnected\n\n";
            std::cin.ignore();
            std::cin.get();
            closesocket(sock);
            WSACleanup();
            exit(1);
        }
        std::cin.ignore();
    }
}

int main()
{
    WSADATA wsData;
    if(WSAStartup(MAKEWORD(2, 2), &wsData) != 0)
    {
        std::cout << "WSAStartup!\n";
    }
    else
    {
        sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
        if(sock == INVALID_SOCKET)
        {
            std::cout << "socket()\n";
            WSACleanup();
        }
        else
        {
            sockaddr_in sin;
            sin.sin_addr.S_un.S_addr = INADDR_ANY;
            sin.sin_port = htons(626);
            sin.sin_family = AF_INET;

            while(bind(sock, (sockaddr*)&sin, sizeof(sin)) == SOCKET_ERROR)
                bind(sock, (sockaddr*)&sin, sizeof(sin));

            while(listen(sock, 1) == SOCKET_ERROR)
            {
                listen(sock, 1);
            }

            while(1)
            {
                acceptsock = SOCKET_ERROR;
                while(acceptsock == SOCKET_ERROR)
                {
        acceptsock = accept(sock, NULL, NULL);
                }
                std::cout << "Connected to your friend!\n\n";
                sock = acceptsock;
                break;
            }
        }
    }
    HANDLE hThread[2];
    DWORD thread1, thread2;
    hThread[0] = CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)recvdata, NULL, NULL, &thread1);
    hThread[1] = CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)senddata, NULL, NULL, &thread2);
    WaitForMultipleObjects(2, hThread, true, INFINITE);
    std::cin.ignore();
    std::cin.get();
    return 0;
}

Client code with C++ highlights: http://pastebin.com/Zbc7qwDc
Server code with C++ highlights: http://pastebin.com/R3stNU0v

Also, I need your guys' favor. The only way I can improve my knowledge is by receiving projects that require me to search for new methods and concepts. So, if possible, give me some tough projects or tough concepts to research. I need some concepts to learn....

Dynamic Database - ProjectEuler + Solution

Hello fellow members,

Before you talk about SQL connection and stuff, this has nothing to do with that.

My friend gave me an assignment to do this:
Code:
Make a program like this:
1. Add to database
2. Display databse
Option:

You should be able to add as many databases as you want. It should ask you for name, age, gender, and after it is registered, put the computer time in a string(which should be a string or whatever). All this information should be taken into a structure

When displaying the database, it should display like this:
--
<The registered time>
Name: Name
Age: 15
Gender: M

The 'Display database' option should print all the databases added.

I know this source code sucks, leave me alone:

Memory Patching with OllyDbg + Source

Hello fellow programmers,

Today, I'll be showing you a rather interesting technique known as memory patching; this method is also used in game hacking to patch the anti-hack and to modify instructions. You will understand what I mean as we proceed through the tutorial.

In this tutorial, we will be hacking minesweeper. I know you'll be thinking hacking minesweeper is really low and useless but you see, minesweeper is just an example but you can use this technique to patch anti-hack on online games and hack online games. Useful technique, isn't it? Now, I want to open minesweeper in cheat engine and get the time address. I'll show you how to get the time address with screenshots; if you already know how to use cheat engine, then you can skip it.

1. Open minesweeper in cheatengine.
2. Enter '0' in the textbox and click 'New Scan'
3. Click on any of the boxes. You'll see the time incrementing by 1.
4. Change the cheat engine's scan type to 'Increased value' and click 'Next Scan'. What this does is that it will check which address' value has been increasing.
5. Keep clicking 'Next Scan', until you have isolated to one address, which, if you followed the instructions correctly, should be the time address. The value of the address should update real time.
6. Double click on the address. It will add it to the listbox at bottom. Now, right click and click 'Find out what writes to this address'. It should give you one assembly instruction. This is the instruction inside minesweeper that updates the time value by 1.

[Image: 6234421.bmp]

This is the instruction I recieved from cheat engine:
Code:
01002FF5 - FF 05 9C570001  - inc [0100579C]

Explanation: The instruction is located in memory address(01002FF5) and it is INC(assembly instruction for increment) the value inside the 100579C(time address).

The C/C++ equivalent:
Code:
(*timeAddress)++;

Now, open up OllyDbg and open Minesweeper in it. Winmine.exe is located in system32 folder inside Windows.

After Minesweeper is loaded onto ollydbg, press control + G. This will ask us where in the ollydbg do you want to go to. We want to go to this: 01002FF5, where our instruction is located.

[Image: 6234428.bmp]

Now, the dark bracket line that covers 9 lines, including our incrememnt instruction is a function minesweeper calls. That functions' purpose is to update the time. Now, I want the game to not execute the function. So, lets write a DLL that will NOP(Assembly instruction for no operation) the function. Lets see what's actually calling time update function. You can do that by clicking the first instruction of the function which is
Code:
01002FE0  /$ 833D 64510001 >CMP DWORD PTR DS:[1005164],0

If you click on it, olly will tell us what's calling this instruction. Here is an image to help you out:
[Image: 6234425.bmp]

It's a local call from 01001d6c. Lets press control + G and go there or you can right click on that string and click 'Go to CALL from 01001d6c'. Once you go there, you will notice something interesting, if you know Win32 programming. You'll see WM_TIMER. WM_TIMER is a message.

This is the instruction:
Code:
01001D6C  |. E8 6F120000    CALL winmine.01002FE0    ;  Case 113 (WM_TIMER) of switch 01001D5B

That instruction uses CALL(assembly instruction to call a funtion or address in the program) to call the time update function. Now, lets write the DLL to NOP the function. It's very simple. You'll need two functions: VirtualProtect and memcpy

The instruction is protected. It's only for us to read and understand the code and not to edit it as we wish. So we will use VirtualProtect function to edit the privilages to PAGE_EXECUTE_READWRITE which will let us not only read the memory but also write to it.

VirtualProtect asks for:
Code:
VirtualProtect(WhichAddress, Size, WhatTypeOfProtection, ActualProtection);

We will pass in 01001D6C for WhichAddress, and 5 bytes for the size, and PAGE_EXECUTE_READWRITE for WhatTypeOfProtection so that we can use memcpy to write to the address. For the last parameter, we will pass the address of a DWORD to store the actual protection so we can bring the address back to the way it was after we use it. With me so far?

This is what the code will look like:
Code:
    DWORD dwOld;
    VirtualProtect((LPVOID)WM_TIMER_ADDRESS, 5, PAGE_EXECUTE_READWRITE, &dwOld);

WM_TIMER_ADDRESS is a definition for our 01001D6C.

Now, we want to memcpy the NOP bytes to the address. Now how will we do that? Simple. Let's create a BYTE array.

Code:
BYTE nops[] = {0x90, 0x90, 0x90, 0x90, 0x90};

0x90 is the hex exquivalent of the NOP instruction.

Now, let's copy the nops and patch the memory!

Code:
memcpy((void *)WM_TIMER_ADDRESS, nops, 5);

Now, we have to set the original protection type back to the way it was.

Code:
    VirtualProtect((LPVOID)WM_TIMER_ADDRESS, 5, dwOld, &dwOld);

I made a function called patch() to make it easier to understand.

Here is the full code:
Code:
#include <windows.h>

#define WM_TIMER_ADDRESS 0x01001D6C

BYTE nop[5] = {0x90, 0x90, 0x90, 0x90, 0x90};

void patch()
{
    DWORD dwOld;
    VirtualProtect((LPVOID)WM_TIMER_ADDRESS, 5, PAGE_EXECUTE_READWRITE, &dwOld);
    memcpy((void *)WM_TIMER_ADDRESS, nop, 5);
    VirtualProtect((LPVOID)WM_TIMER_ADDRESS, 5, dwOld, &dwOld);
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
{
    if(dwReason == DLL_PROCESS_ATTACH)
    {
        MessageBox(NULL, "Injected to Process!", "Injected!", MB_OK);
        patch();
    }
    return true;
}

Now, let's inject the DLL into Minesweeper and attach OllyDbg to it. After doing so, go the WM_TIMER call.

Before injection:
[Image: 6234420.bmp]

After injection:
[Image: 6234419.bmp]

W00t! w00t! Notice how the 5 nops were copied on to the address, essentially, cancelling the call to the timer update. Of course, there are different methods of stopping time. You can create a while loop which will always set the time address(0x0100579c) to zero.

Here is the source for it:
Code:
#include <windows.h>

void timezero()
{
    while(1)
    {
        __asm
        {
            mov eax, 0x0100579c
            mov [eax], 0
        }
    }
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
{
    if(dwReason == DLL_PROCESS_ATTACH)
    {
        MessageBox(NULL, "Injected to Process!", "Injected!", MB_OK);
        timezero();
    }
    return true;
}

This is a basic hack for a basic game but this technique can be used for other complex games. For example, I'm using this technique to patch XTrap(an anti-cheat program). Basically, step through the code and check for traces of XTrap activity and NOP it or use unconditional jumps. Online games load XTrap through a DLL using LoadLibrary by CALL'ing it from kernel32.dll. You can, of course, NOP the entire LoadLibrary call which, basically, prevents Xtrap.dll from loading.

If you have any questions or suggestions, don't hesitate to reply. You can private message for questions or add my MSN(PM for it).

Hope you learned something.

Saturday, August 31, 2013

Simple Port Scanner + Source

Hello fellow coders,
Information:
So, I have been bored for a while and I was flipping through 'My Threads' and saw the Simple port scanner thread I made a while ago; It wasn't the best because it had limitations. Limitations such as one port at a time. So I decided to crank it up to make it multiple ports at a time. Also, I would like to mention that I am still learning Network Programming, Sockets, and all that good stuff, so please use constructive criticism instead of flaming. :)


How to use it
-You have two options.
-Option 1 gives you the ability to scan list of ports. For example: 1337 - 1600 scans all the numbers between 1337 to 1600.
-Option 2 lets you choose specific ports; This is done by using Dynamic Memory Allocation. Cool

Source: http://pastebin.com/T0FBHaxs

Thanks,
Sri Krishna

P.S. I know the code isn't that great; So, please give me some way to optimize my code.

-TicTacToe 2D Arrays - C++

I coded this yesterday because I realized I haven't really created any game with C and because many people here are looking for 2d arrays help. This is a basic tic-tac-toe game with customizable size. You can make it 3x3, 5x5, 10x10 - your wish - by changing the rows and columns preprocessors to your like. This source could be helpful for beginners, like myself, trying to learning multi-dimensional arrays.

Also, for all of those who are using system("CLS"). I've included an alternate function using windows functions. Basically, it gets the output handle to the screen and gets the number of characters on the screen and fills them with ' '(spaces). Done.

With highlights: http://pastebin.com/b8NBK1qZ
#include 
#include 

#define b_col  3
#define b_row  3

void clear_screen()
{
 HANDLE output_handle = GetStdHandle(STD_OUTPUT_HANDLE);
 DWORD bytes_write, size;
 COORD coord = {0, 0};
 CONSOLE_SCREEN_BUFFER_INFO csbi;

 GetConsoleScreenBufferInfo(output_handle, &csbi);
 
 size = csbi.dwSize.X * csbi.dwSize.Y;
 
 FillConsoleOutputCharacter(output_handle, ' ', size, coord, &bytes_write);
 SetConsoleCursorPosition(output_handle, coord);
}

void clear_board(char game_board[][b_col])
{
 for(int i = 0; i < b_row; i++)
  for(int j = 0; j < b_col; j++)
   game_board[i][j] = '-';
}

void print_board(char game_board[][b_col])
{
 for(int i = 0; i < b_row; i++)
 {
  for(int j = 0; j < b_col; j++)
   printf("%c   ", game_board[i][j]);
  printf("\n\n\n");
 }
}

bool place_xo(char game_board[][b_col], int row, int col, char x_o)
{

 if(game_board[row - 1][col - 1] != '-') //if coordinates given is not empty
   return false;
 else
 {
  game_board[row - 1][col - 1] = x_o;
  clear_screen(); //clear screen. don't use system("CLS");
  print_board(game_board); //print board.
  return true;
 }
}

int check_row_col(char game_board[][b_col], char x_o, unsigned int f_row = 0, unsigned int f_col = 0)
{
 int counter = 0;
 if(f_row != 0) //checks rows
 {
  for(int i = 0; i < b_col; i++)
   if(game_board[f_row - 1][i] == x_o)
    counter++;
 }
 else if(f_col != 0) //checks columns
 {
  for(int i = 0; i < b_row; i++)
   if(game_board[i][f_col - 1] == x_o)
    counter++;
 }
 else if(f_col == 0 && f_col == 0) //diagonal
 {
  int d_col = 0;
  for(int d_row = 0; d_row < b_row; d_row++, d_col++)
   if(game_board[d_row][d_col] == x_o)
    counter++;
  if(counter == b_row)
   return counter;
  else
  {
   d_col = b_col;
   counter = 0;
   for(int d_row = 0; d_row < b_row; d_row++, d_col--)
    if(game_board[d_row][d_col - 1] == x_o)
     counter++;
  }
 }
 return counter;
}

bool win_or_not(char game_board[][b_col], char x_o)
{
 for(int i = 1; i < b_col; i++) //checks all columns
 {
  if(check_row_col(game_board, x_o, 0, i) == b_row)
  {
   printf("\n\n\n%c won the game", x_o);
   return true;
  }
 }

 for(int i = 1; i < b_row; i++) //checks all rows
 {
  if(check_row_col(game_board, x_o, i, 0) == b_row)
  {
   printf("\n\n\n%c won the game", x_o);
   return true;
  }
 }

 if(check_row_col(game_board, x_o, 0, 0) == b_row) //diagonal checks
 {
   printf("\n\n\n%c won the  game", x_o);
   return true;
 }

 return false;
}

int main()
{
 if(b_row != b_col)
  return -1;
 char game_board[b_row][b_col];
 bool win_not = false;
 int row, col;
 clear_board(game_board); //clear board
 print_board(game_board); //print board

 bool x_turn = true;

 do
 {
  printf("--It's %c's turn--\n\n", x_turn ? 'X' : 'O');

  printf("Row: ");
  scanf("%d", &row);

  printf("Column: ");
  scanf("%d", &col);

  if(row > b_row || col > b_col)
  {
   printf("\nOut of bounds.\n\n");
   continue;
  }

  if(!place_xo(game_board, row, col, x_turn ? 'X' : 'O')) //place the 'x' and 'o'. x_turn ? 'X' : 'O' returns based on the bool value of x_turn
  {
   printf("\nCannot put %c into row %d, col %d.\n\n", x_turn ? 'X' : 'O', row, col);
   continue;
  }

  win_not = win_or_not(game_board, x_turn ? 'X' : 'O');

  x_turn = !x_turn;
 }while(win_not == false);
 getchar();
 getchar();
 return 0;
}

-Process Terminator with GUI [WinAPI] + Source

I coded this a while back.
It's a Process Terminator that involves GUI(Graphic User Interface). GUI can be achieved through C++ Win32 coding. Google it. It's redundant but pretty neat.
--Problems--
Cannot kill system processes
Issues with right click

--Advantages--
Works like Jesus.

--Screenshot--
[Image: 4040867.bmp]

--Source--
main.cpp
resource.rc
resource.h

Peace

-ProjectEuler #1 + Solution

Problem Description:
If we list all the natural numbers below 10 that are multiples of 3 or 5, we get 3, 5, 6 and 9. The sum of these multiples is 23. Find the sum of all the multiples of 3 or 5 below 1000. Try it yourself before you look at the solution:
#include 

int main()
{
 unsigned int sum = 0;
 for(int i = 0; i < 1000; i++) //go through until 1000
  if(i % 3 == 0 || i % 5 == 0) //if it is divisble by 3 or 5
   sum += i; //add the number to sum.
 printf("Sum of natural numbers below 1000, that are divisible by 3 or 5 is %d", sum); //print the sum
 getchar();
 return 0;
}
Solution source: ProjectEuler #1 Output:
Sum of natural numbers below 1000, that are divisible by 3 or 5 is 233168
I'll start uploading more ProjectEulers; if you have any suggestions, comments, or questions, post 'em. ...Sri Krishna.

-DLL Injection Source + Tutorial

Hello,

Full source present below. I am Sri Krishna. I have already posted this tutorial long back in Hackforums. I thought it would be nice to share it here.

Here is a quick explanation of how DLL injection works. The concept is very simple. This encompasses a lot of very useful functions. Very good knowledge.

DLL injection is not really injecting the DLL but to load the DLL inside the targeted process. The function that is used to load a DLL is [a href="http://msdn.microsoft.com/en-us/library/ms684175(v=vs.85).aspx"]LoadLibrary[/a]. LoadLibrary takes one argument which is the path of the DLL. We pretty much know how to load a DLL. Now, we need to understand how to make the targeted process load our DLL.

Let's look at it in this perspective: If you want to load a DLL in general, you would call LoadLibrary(DLL_PATH);, however, if you want to LoadLibrary(DLL_NAME); inside a process, you would have to execute that function inside the targeted process, correct? Well, Windows has provided us with useful functions that can help us perform this task. The functions we will be using are OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.

We'll be using OpenProcess to open the target process. The information required to open the process is the Process ID(or PID). I suggest you look at the MSDN documentation for more information.

Here is what OpenProcess is asking:
OpenProcess(HowToOpen, InheritEverything(BOOL), Process ID);

Here is the actual code:
int ProcessID;

std::cin >> ProcessID;

HANDLE hProcess; //This will contain the handle to the process.

hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, ProcessID);



Now, hProcess contains the handle to the process, if OpenProcess doesn't return NULL. If OpenProcess returned NULL, then it failed. You can use [url=http://msdn.microsoft.com/en-us/library/ms679360(v=VS.85).aspx]GetLastError()[/url] function to get details of the failure.

if(hProcess == NULL)

 std::cout << "OpenProcess: " << GetLastError();

else

 //continue



Now, we need to allocate some memory in the targeted process for DLL path so we can pass it to LoadLibrary. We can do this by using VirtualAllocEx.

VirtualAllocEx might sound complicated but the arguments it takes are easy to understand and is perfect for this task. It's similar to malloc or new in C and C++, respectively. malloc/new only works in the process you are working with but with VirtualAllocEx you can "malloc" inside a target process!

What VirtualAllocEx is asking for:

VirtualAllocEx(HandleToTheProcess, WhereDoYouWantToAllocate, HowMuchDoYouWantToAllocate, AllocationType, ProtectionType);



That's essentially what it is asking us for. Now, lets follow along and legitimately fill in the arguments. Please, look up the MSDN Documention for MEM_RESERVE, MEM_COMMIT and PAGE_READWRITE for more information.

LPVOID vAlloc; //Stores our base address where the allocation occured.

vAlloc = VirtualAllocEx(hProcess, NULL, strlen(DLL_PATH) + 1, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

/*NULL in the second parameter lets the function choose where to allocate memory. We want to allocate

the string length of DLL path, so we can write to it. It's strlen(DLL_PATH) +1 because of the null-terminator. Thanks to PoZHx for reminding me! :)*/



If the function suceeded, vAlloc will contain the base address where the allocation occured. If it failed, it will return NULL. Of course, you can use GetLastError to get more information about why the function failed.

Now, we will write the DLL path in the allocated memory. Now, where in memory region was the memory allocated? Well, vAlloc contains the base address of our memory, so we'll just use that to write our DLL path to. We can do this by using WriteProcessMemory.

This is what WriteProcessMemory is asking:

WriteProcessMemory(WhichProcess, WhereInMemory, WhatToWrite, HowLongIsTheData, HowMuchDidIWrite); //the last parameter is not really needed



Now, lets write the actual code for the task:

WriteProcessMemory(hProcess, vAlloc, DLL_PATH, strlen(DLL_PATH), NULL); //this will pretty much write the DLL path to the process.



If the function suceeded, it will return a non-zero integer. Of course, you can use GetLastError if it returned NULL.

Now, that we have everything up and ready for us to execute our LoadLibrary function inside the process, lets execute it!

We'll need CreateRemoteThread function to create a seperate thread for our LoadLibrary while not pausing the main process thread. CreateRemoteThread is similar to CreateThread except CreateRemoteThread takes one extra parameter which is the handle to the process(I'm sure you guessed it!). We'll pass in our hProcess for that parameter.

What CreateRemoteThread is asking:

CreateRemoteThread(HandleToProcess, ThreadAttributes, StackSize, FunctionToExecute, ParametersToFunction, Flags, ThreadID);

/*For this task, we'll only worry about HandleToProcess, FunctionToExecute, and ParametersToFunction because that's all we need

to execute our thread in the targeted process*/



Now, lets write the actual code for this task:

CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibraryA, vAlloc, NULL, NULL);



If the function failed, it will return NULL. Of course, you can check GetLastError() ;).

However, there are times, rarely, when this function will fail. It's probably because the kernel32.dll is not loaded in the process. This is a problem because kernel32.dll is DLL that provides us the function LoadLibrary. There is a way to fix this problem. You can use [url=http://msdn.microsoft.com/en-us/library/ms683212%28v=VS.85%29.aspx]GetProcAddress[/url] to get the address of LoadLibrary inside kernel32.dll and we can just call the address.

Here is what GetProcAddress is asking for:

GetProcAddress(HandleToTheModuleWhereTheFunctionIsLocated, FunctionName);



Now, lets write the actual code:

LPVOID pAddr; //This will contain the address of LoadLibrary, if suceeded.

pAddr = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");



If suceeded, pAddr will contain the address to LoadLibraryA. If it didn't suceed, it will return NULL and we can use GetLastError ;) Now, lets use this address and pass it to CreateRemoteThread.


CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)pAddr, vAlloc, NULL, NULL);



After you finish creating the remote thread. Make sure to free the memory we have allocated using [url=http://msdn.microsoft.com/en-us/library/aa366894(v=vs.85).aspx]VirtualFreeEx[/url] and make sure to close the handle we have opened using OpenProcess using [url=http://msdn.microsoft.com/en-us/library/ms724211(v=VS.85).aspx]CloseHandle[/url].

Please check the MSDN documentation for more information. VirtualFreeEx is similar to free and delete in C and C++, respectively.

VirtualFreeEx(hProcess, vAlloc, NULL, MEM_RELEASE); //Must call this before closing handle.

CloseHandle(hProcess);



That's basically it! Now, you should, unless you don't speak English, understand how DLL injection works.

Here is the entire source of what we discussed; I added some error checking to help us out:
[url=http://pastebin.com/7AgCZAfx]DLL Injecton[/url]

Here is a source of a DLL to test if the Injector is working:

#include <windows.h>



BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)

{

 if(dwReason == DLL_PROCESS_ATTACH)

  MessageBox(NULL, "Injected to process!", "Injected!", MB_OK);

 return true;

}



Here is an advanced version of DLL Injector. It opens up a file dialog box and it also lists the process with process IDs: http://pastebin.com/pC8JDVvV

Hope you learned something... Sri Krishna. Please, give me some feedback.

-Introduction.

Hi,

This is website where there will be collaboration of useful tutorials and sources of various programming languages.

Feel free to browse the site to find the appropriate source for your desire and gain knowledge!

If you have any question or request of tutorial, message me. I will do my best to reply back and make a tutorial. :)

Thanks.

P.S. I am Sri Krishna from Hackforums