|
Hello all,
I'm injecting my DLL (Hooking) to explorer.exe using CreatRemoteThread, Now this works fine in windows XP but when i tried in Windows Server 2003, CreateRemoteThread fails with error code 5 (Access Denied), What permission do i need to set?
#include "windows.h"
#include "stdio.h"
#include <tlhelp32.h>
#include <shlwapi.h>
BOOL Inject_DLL(DWORD dwID)
{
HANDLE hToken = NULL;
HANDLE hProc = NULL;
HANDLE hThread = NULL;
BOOL bReturn = FALSE;
BOOL bLibLoaded = FALSE;
BOOL bWriteCheck = FALSE;
char szErrBuff[MAX_PATH] = "";
char szDllFolder[2 * MAX_PATH] = "";
char szDllPath[2 * MAX_PATH] = "C:\\DelDll\\DetourExample.dll";
void* pLibRemote = NULL;
HMODULE hKernel32 = NULL;
DWORD err = 0;
TCHAR szTemp[MAX_PATH] = "";
DWORD dwDesiredAccess;
TCHAR szError[MAX_PATH] = "";
dwDesiredAccess = PROCESS_CREATE_THREAD |
PROCESS_QUERY_INFORMATION |
PROCESS_VM_OPERATION|
PROCESS_VM_WRITE |
PROCESS_VM_READ;
hProc = OpenProcess(dwDesiredAccess, FALSE, dwID);
if(hProc == NULL || hProc == INVALID_HANDLE_VALUE)
{
MessageBox(NULL, "Cannot Open Process", "Error", MB_OK);
printf("Cannot Open Process\n");
goto Cleanup;
}
hKernel32 = GetModuleHandle("Kernel32");
if(hKernel32 == INVALID_HANDLE_VALUE || hKernel32 == NULL)
{
hKernel32 = LoadLibrary("Kernel32");
if(hKernel32 == INVALID_HANDLE_VALUE || hKernel32 == NULL)
{
MessageBox(NULL, "Cannot Load Kernel", "Error", MB_OK);
printf("Cannot Load Kernel32");
goto Cleanup;
}
else
{
bLibLoaded = TRUE;
}
}
pLibRemote = VirtualAllocEx(hProc, NULL, sizeof(szDllPath), MEM_COMMIT, PAGE_READWRITE );
if(pLibRemote == NULL)
{
MessageBox(NULL, "Virtual Alloc Failed", "Error", MB_OK);
printf("Virtual Alloc Failed\n");
goto Cleanup;
}
bWriteCheck = WriteProcessMemory(hProc, pLibRemote, (void*)szDllPath, sizeof(szDllPath), NULL );
if(bWriteCheck == 0)
{
MessageBox(NULL, "WriteProcess Memory Failed", "Error", MB_OK);
printf("WriteProcessMemory Failes\n");
goto Cleanup;
}
hThread = CreateRemoteThread( hProc,
NULL,
NULL,
(LPTHREAD_START_ROUTINE)GetProcAddress(hKernel32,"LoadLibraryA"),
pLibRemote,
NULL, NULL);
if(hThread != INVALID_HANDLE_VALUE && hThread != NULL)
{
WaitForSingleObject( hThread, INFINITE );
bReturn = TRUE;
}
else
{
DWORD err = GetLastError();
TCHAR szTemp[MAX_PATH] = "";
sprintf(szTemp, "CreateRemoteThread Failed, Error = %d", err);
MessageBox(NULL, szTemp, "Error", MB_OK);
}
Cleanup:
if(hThread != INVALID_HANDLE_VALUE && hThread != NULL)
{
CloseHandle(hThread);
hThread = NULL;
}
if(pLibRemote)
{
VirtualFreeEx(hProc, pLibRemote, sizeof(szDllPath), MEM_DECOMMIT);
pLibRemote = NULL;
}
if(hProc != INVALID_HANDLE_VALUE && hProc != NULL)
{
CloseHandle(hProc);
hProc = NULL;
}
if((hKernel32 != INVALID_HANDLE_VALUE && hKernel32 != NULL) && bLibLoaded)
{
FreeLibrary(hKernel32);
hKernel32 = NULL;
}
return bReturn;
}
int main()
{
BOOL bReturn = FALSE;
bReturn = Inject_DLL(3188);
return bReturn;
}
Thanks.
|
|
|
|
|
Use GetLastError[^] to determine the error code
I am a HUMAN. I have that keyword (??? too much) in my name........
 _AnsHUMAN_b>
|
|
|
|
|
thats what gothic_coder already told:- CreateRemoteThread fails with error code 5 (Access Denied) 
|
|
|
|
|
I would expect that you need to request administrator privileges to run this under Vista and beyond. As a simple test right click your exe file and select "run as administrator" to see if it works. If so then add administrator privilege to your manifest.
It's time for a new signature.
|
|
|
|
|
Some times you need to just have Debug Privileges to inject a DLL into another process when you get the "access denied". So, just grant yourself Debug Privileges.
I have done this on vista 32bit with no problems.
Problems come in with the same code in 64bit versions.
|
|
|
|
|
Thanks all,
Yes some other techie guys told me to raise the privileges, But doing that also won't make difference, Here's what i'm doing..
BOOL EnablePriv(LPCSTR lpszPriv)
{
BOOL bRet;
HANDLE hToken;
LUID luid;
TOKEN_PRIVILEGES tkprivs;
ZeroMemory(&tkprivs, sizeof(tkprivs));
if(!OpenProcessToken(GetCurrentProcess(), (TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY), &hToken))
return FALSE;
if(!LookupPrivilegeValue(NULL, lpszPriv, &luid)){
CloseHandle(hToken); return FALSE;
}
tkprivs.PrivilegeCount = 1;
tkprivs.Privileges[0].Luid = luid;
tkprivs.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
bRet = AdjustTokenPrivileges(hToken, FALSE, &tkprivs, sizeof(tkprivs), NULL, NULL);
CloseHandle(hToken);
return bRet;
}
|
|
|
|
|
Hi!
I've a vector of strings. I've to pass the strings in the vector to a function and there I've to replace some of the characters in the string. I've to return the rearranged string and store it in an array. I used the following code to do this:
stringc swapChars(stringc& str1)
{
std::string str(str1.c_str());
std::string strChar;
std::string strChar1;
int length = str.size();
stringstream ss;
stringstream ss1;
char chr =65 + rand() % 26;
char chr1 = chr;
ss << chr;
ss >> strChar;
str.replace((int)length/3,1,strChar);
while(chr == chr1)
{
chr = 65 + rand() % 26;
}
chr = chr + 32;
ss1 << chr;
ss1 >> strChar1;
str.replace((int)length*2/3,1,strChar1);
return str.c_str();
}
Above is the function where I'm rearranging the string. This is how I'm calling the above function:
vector<stringc> players;
array<stringc> nameFirstPart,nameSecondPart;
unsigned int t = time(NULL);
for(register int i = 0; i<players.size()-1; i++)
{
srand(t);
nameSecondPart.push_back(swapChars(players[++i]));
t++;
}
This is where i'm printing the string:
for(register int k = 0; k < nameSecondPart.size(); k++)
{
printf("%s \n",nameSecondPart[k].c_str());
}
While printing the strings I get unexpected and irrelevant strings or characters in between. Why it comes like this? How to avoid this?
|
|
|
|
|
T.RATHA KRISHNAN wrote: unexpected and irrelevant strings or characters in between
What do you intend, exactly?
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
I've to rearrange each string(stored in a vector),store it back to an array and print it. In addition to my strings some unexpected chars like 'w' "MN" are printed. I've to avoid these chars.
|
|
|
|
|
T.RATHA KRISHNAN wrote: I've to return the rearranged string and store it in an array
But you are not rearranging the string.
You are trying to replace some characters at particular positions (depending on the length of the input string) with some random characters.
If you really want to randomly rearrange the string then just use the standard library algorithm - std::random_shuffle[^].
Here is an example usage:
std::string s = "some test string";
std::random_shuffle(s.begin(), s.end());
std::random_shuffle(s.begin(), s.begin() + 5);
If you want to change some of the chars of your string then check out std::transform[^].
Also this snippet is from your code:
for(register int i = 0; i<players.size()-1; i++)
{
srand(t);
nameSecondPart.push_back(swapChars(players[++i]));
t++;
}
|
|
|
|
|
Replacing is what I want. But why some additional characters are getting printed. I'm reading the strings from a database and replacing some characters with some random chars. My database has 391 strings. If I print the size of the where I stored the rearranged strings, it prints 394. When I print the contents of the array some unexpected chars gets printed. Where do these additional strings come from?
|
|
|
|
|
I pointed out one of the problems with your for loop.
Also see the post[^] from Ash for the other problems.
You should really replace this loop with something normal like:
srand(time(0));
const int total_players = players.size();
for(int i = 0; i < total_players; ++i)
{
nameSecondPart.push_back(swapChars(players[i]));
}
Try with the loop above and see what happens. Also use your debugger, it is your friend!
And about your hand-crafted swapChars function, why not use std::transform?
|
|
|
|
|
There are several surreal elements to that last block of code...
- calling srand each time around the loop
- using register and std::vector::push_back() together
- the bounds checking on the for loop
Kids of today eh?
Cheers,
Ash
|
|
|
|
|
I've to get a random char to replace with each string. That's why I called srand() inside for loop. Can u please tell me if anything would happen seriously with this call?
|
|
|
|
|
T.RATHA KRISHNAN wrote: Can u please tell me if anything would happen seriously with this call?
Aren't you interested on anything that would happen waggishly?
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
Generally you only seed your random number generator once - there's not really a lot of point in doing it more than that. Every time you call it you effectively start another sequence of random numbers. There's no real problem calling it more than once provided the seed is different every time.
Cheers,
Ash
|
|
|
|
|
Aescleal wrote: There's no real problem calling it more than once provided the seed is different every time.
Provided the seeds wouldn't alter the statistical distribution of the generated numbers, I would say.
--Carlo The Nitpick
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
|
Aescleal wrote: Kids of today eh?
Regards,
Nuri
|
|
|
|
|
Aescleal wrote: several surreal elements
The Salvador Dali of C++. Who knows, this code might be worth a fortune in, say, a 100 years?
|
|
|
|
|
There's a chance for some stuff I wrote years ago then! Does infinite looping make me Escher?
|
|
|
|
|
Pls send me a copy urgentzly, and I'll add it to the inheritance for my son!
|
|
|
|
|
I did black box testing, now does it make me like Picasso?
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
I think I would be less artist and more of an Alan Turing myself. Some of the algorithms I wrote required infinite computational power...
|
|
|
|
|
And 'infinite computational power' carefully sidesteps your algorithms...
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
