Dll injection and hooking - C / C++ / MFC Discussion Boards

Clever stuff - thanks Thumbs Up | :thumbsup:

Hi,

At work I only have Visual C++ 6.0 this seems like old compiler as everyone is using Visual Studio

I have to automate the importing of data from a .txt file to an EXCEL spreadsheet

I think using OLE is the answer

My question is, is this do-able with Visual C++ 6.0

Thanks

Excel, at least recent ones, can open a CSV file.

So presuming the txt file isn't already CSV all you would need to do is read it, parse it, then output in in CSV.

ForNow wrote:

My question is, is this do-able with Visual C++ 6.0

See if this gives you any ideas.

"One man's wage rise is another man's price increase." - Harold Wilson

"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons

"Show me a community that obeys the Ten Commandments and I'll show you a less crowded prison system." - Anonymous

I am using the wizard to set up this app the program will go to the DATA menu selection on the EXCEL spreadsheet and select import external data

My question when using the wizard to set up the project will the selection be ATL COM AppWizard or WIN32 console application

Visual C++ 6 will do the job just fine.

Steve

OLE api is Win32/C, and every C compiler (including msvc of VC6) can handle it.

Nuclear launch detected

Hello once again,I have been working on some project for a while now and I needed to hook a creation of processes,I have that code(hook/detour)

C++

BOOL WINAPI CreateProcH::CreateProcessInternalW	(	HANDLE 	hToken,
												 LPCWSTR 	lpApplicationName,
												 LPWSTR 	lpCommandLine,
												 LPSECURITY_ATTRIBUTES 	lpProcessAttributes,
												 LPSECURITY_ATTRIBUTES 	lpThreadAttributes,
												 BOOL 	bInheritHandles,
												 DWORD 	dwCreationFlags,
												 LPVOID 	lpEnvironment,
												 LPCWSTR 	lpCurrentDirectory,
												 LPSTARTUPINFOW 	lpStartupInfo,
												 LPPROCESS_INFORMATION 	lpProcessInformation,
												 PHANDLE 	hNewToken 
												 )
	clogf("start %x ref: %x",realCreateProcessInternalW,&realCreateProcessInternalW);
	BOOL res = FALSE;
	res = realCreateProcessInternalW(hToken,lpApplicationName,lpCommandLine,lpProcessAttributes,lpThreadAttributes,bInheritHandles,dwCreationFlags,lpEnvironment,lpCurrentDirectory,lpStartupInfo,lpProcessInformation,hNewToken);
	if(res == FALSE)
		return res;

	Sleep(100);//let it load

	vector<wchar_t*> ::iterator it;
	for(it = pubvPaths.begin(); it < pubvPaths.end(); it++)
	{	
		if(!CDetour::InjectDll(lpProcessInformation->hProcess,*it))
			clogf("InjectDll(lpProcessInformation->hProcess,*it) FAILED!");
		clogf("Strlen %d Injecting dll: %ls",lstrlenW(*it),*it);
	}
	clogf("hThread: %d hProcess: %d dwThreadId: %d dwProcessId: %d",lpProcessInformation->hThread,lpProcessInformation->hProcess,lpProcessInformation->dwThreadId,lpProcessInformation->dwProcessId);
	return res;
};

LOG:

[Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: start 7d843e8 ref: 741285ac
[Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: Strlen 103 Injecting dll: C:/Users/JEAN/SplitPLayGUI-build-desktop-Qt_4_8_1_for_Desktop_-_MSVC2010__Qt_SDK__Debug/CreateProcH.dll
[Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: hThread: 5360 hProcess: 5376 dwThreadId: 8376 dwProcessId: 1388

but the process fails to create or crashes not sure what is wrong,
So I just commented out

C++

if(!CDetour::InjectDll(lpProcessInformation->hProcess,*it))
    clogf("InjectDll(lpProcessInformation->hProcess,*it) FAILED!");

and everything logged the same way but the process actually created and ran, here is CDetour::InjectDll

C++

bool CDetour::InjectDll(HANDLE hProcess ,wchar_t * pwstrDll)
{
	LPVOID RemoteString, LoadLibAddy;

	if(!hProcess)
		return false;

	LoadLibAddy = (LPVOID)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryW");
	if(!LoadLibAddy)
	{
		clogf("GetProcAddress(GetModuleHandle(L\"kernel32.dll\"), \"LoadLibraryW\") FAILED WITH %d!",GetLastError());
		return false;
	}
	RemoteString = (LPVOID)VirtualAllocEx(hProcess, NULL, (lstrlenW(pwstrDll)*2)+2, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);
	if(!RemoteString)
	{
		clogf("VirtualAllocEx(hProcess, NULL, lstrlenW(pwstrDll)+2, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE); FAILED WITH %d!",GetLastError());
		return false;
	}
	if(WriteProcessMemory(hProcess, (LPVOID)RemoteString, pwstrDll,(lstrlenW(pwstrDll)*2)+2, NULL) == 0)
	{
		clogf("WriteProcessMemory(hProcess, (LPVOID)RemoteString, pwstrDll,lstrlenW(pwstrDll)+2, NULL) FAILED WITH %d!",GetLastError());
		return false;
	}
	if(CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, NULL, NULL) == NULL)
	{
		clogf("CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, NULL, NULL) FAILED WITH %d!",GetLastError());
		return false;
	}

	return true;
}

I hope someone else could figure it out ,thanks in advance Smile | :)

Since nobody replied I made a much deeper research on my own, and found out that I can't really use the same DLL injection way that is used when the process is already loaded.

this simple program supposed to run the command ls
but the output is 1 and 2.can someone explain to me why ls not working ?

C++

#include <stdio.h>
main()
{
    int pid,stat;
    if((pid=fork())==0)
      {
        execl("/bin/","ls",NULL);
        printf("1");
	exit(1);
      }
    else
      {
         wait(&stat);
         printf("2");
      }
}

The first argument to execl should contain the full path to the executable you want to run:

C

execl("/bin/ls","ls",NULL);

i understant that if i have parameters i shoud write
execl("/bin/date", "date", "-u", NULL);
how can i write the same thing with execv ?

Also execl returns a value that can help you tell why it isn't working.

Such as '2' which seems to pretty much always mean that it couldn't find the file it needed to execute.

Hello Friends

I am having a file in binary mode.Now, I want to read it So that I can get the format of that File.

Is ther any way in MFC or Win32 to reverse it ?

Thanks In Advance.
regards
yogesh

Unless you know the format of the file contents there is not really any way to do it. You can try some guesswork and logical tests (I have done similar in the past) but it is really down to looking at the content, and figuring out what each byte or set of bytes is supposed to represent.

One of these days I'm going to think of a really clever signature.

What do you mean with getting the format? If it's a binary file and you don't know how to interpret its contents, I don't think you can get a format.

Regarding the reversion, thats quite easy, although I don't see the point in doing it. You could use the functions fread(), frwite() and the like to read it into a large enough char array, loop through it from back to front and write it byte by byte into a new file (assuming is is small enough to fit into memory).

thanks Guys For your valuable replies.

yogeshs wrote:

Is ther any way in MFC or Win32 to reverse it ?

Reverse engineer, or reverse the contents?

"One man's wage rise is another man's price increase." - Harold Wilson

"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons

"Show me a community that obeys the Ten Commandments and I'll show you a less crowded prison system." - Anonymous

There is a free game development tool called "Wolf RPG Editor". Details on the following site,

http://www.silversecond.com/WolfRPGEditor/[^]

The problem is that its been written in Japanese. Using Resource Hacker[^] I managed to translate one of the configuration tools that came with it. For reference here are screenshots of my efforts,

BEFORE,
http://img507.imageshack.us/img507/4545/configjapanese.jpg[^]

AFTER,
http://img811.imageshack.us/img811/3365/configenglish.jpg[^]

My next plan is to try and work with a few friends to translate the rest of the tool. Basically, it revolves around changing the text in the dialog boxes. The problem I'm facing is how to manage such a team effort.

Does anyone know a way (or utility) to extract the resources from a windows executable, split it into different files and then merge it all back together?

As useful as Resource Hacker is, its essentially a one-man tool. I'm looking for something that would let me work with a version control system for this.

On the legal side of things, I've been led to understand that the original developer has granted permission for translation efforts (admittedly, hearsay from others). The way I see things, since its a free tool and because I'm only translating it, there shouldn't be any trouble.

-chronodekar

There's a bunch of commercially availble tools for the job, you could check out Deja Vu, SDL Passolo or Idiom. If you google around for Flexytrans, you may find that one (it should be for free if you manage to find it).

The more elaborate tools have loads of functions for working in teams. For the simpler ones, use the Clipboard to export the strings to text files.

Compile same code twice, why the result(exe) is not same。both release mode and debug mode exist the same problem。if want to get same result, how to setting to the project, such as compile option。

What did you do, exactly, to get to this observation? Usually, when you build a project, you overwrite the previous build, so there's nothing to compare it to.

The differences are probably superficial. For example, an exe or dll contains a date-time stamp which specifies the time it was linked.

Steve

Can you explain little more please. What do you mean that result is not same? output?you just clear all in build option and rebuild the solution again.

I suppose you are compiling with VS. What differs is a timestamp added by compiler (more precisely, by linker). I don't remember where, but I think is somewhere in IAT. You can patch those bytes (I think is a __int64, most likely a FILETIME) either by patching the binary or by setting system time (not sure since you don't know when exactly the linking occurs).

Nuclear launch detected