Hello! I understand that starting with 8 dll injection can not be done, but is there an alternative?

  • 3
    You misunderstood. Loading dll has not gone away. - Abyx
  • one
    The availability of an alternative depends on why you need it. - Vladimir Martyanov
  • Maybe you heard about this ? - isnullxbh

1 answer 1

Everything is done perfectly! And on 8 and on 8.1 and on 10. If you need an example of a simple code injection, I can help with the code (I will update the message).

UPD

There are a lot of ways to download dlls, you can read about them in Richter’s book, here’s one of the simplest (works on win8 100%, only for x86 applications !!!):

bool load(const tstring & dllPath, const tstring & processName) { // Получение дескриптора процесса HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, false, t_proc.getID(processName)); if (process == NULL) { msg_er_full; return false; } //Из модуля kernel32.dll этого же процесса вытягиваем адрес функции LoadLibraryA LPVOID fp = (LPVOID)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA"); if (fp == NULL) { msg_er_full; if (!CloseHandle(process))msg_er_full; return false; } // Выделение участка памяти размером dll_name для последующей записи в память процесса. LPVOID alloc{}; if ((alloc = VirtualAllocEx(process, 0, dllPath.size(), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE)) == NULL) { msg_er_full; if (!CloseHandle(process))msg_er_full; return false; } // Запись Dll в память if (WriteProcessMemory(process, alloc, dllPath.c_str(), dllPath.size(), 0) == NULL) { msg_er_full; if (!CloseHandle(process))msg_er_full; return false; } // Создание "удаленного" потока в адресном пространстве открытого процесса и последующая подгрузка нашей Dll if (CreateRemoteThread(process, 0, 0, (LPTHREAD_START_ROUTINE)fp, alloc, 0, 0) == NULL) { msg_er_full; if (!CloseHandle(process))msg_er_full; return false; } return true; }
  • Why load LoadLibrary through GetProcAddress? (The minus is not mine.) - VladD
  • @VladD - I understand that the author needs to load a dll from a third-party application into its own, for some purpose - for example, I try this way to “hack” my application (looking for bugs and vulnerabilities) - Duracell
  • And, and therefore you use as little work as possible of the compiler, I understand. - VladD
  • @VladD - you mean it ... - Duracell
  • Wow, I thought the post office would receive an alert about the response. I did it at 8, but on windows 10 for some reason it doesn't work, in the afternoon I’ll give you the code - helldrg