calling an managed dll from an unmanaged dll file (that is injected into the running process)

Question

Could not figure out how to call a function in managed dll file using the unmanaged dll.

Currently,I was able to inject an unmanaged dll into a running process and calling an managed dll(and to mention mainly i am a newbie to c++) using that as shown below.

 #include "stdafx.h"
 #include <Windows.h>
 #include "dllmain.h"

 BOOL APIENTRY DllMain( HMODULE hModule,
                   DWORD  ul_reason_for_call,
                   LPVOID lpReserved  )
{
switch (ul_reason_for_call)
  {
     case DLL_PROCESS_ATTACH:
    {
    LoadManagedProject(L"C:\\Users\\nagaganesh.kurcheti\\Desktop\\ExampleProject.dll");
    DisplayPid();
     break;
    }  
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
    break;
}
return TRUE;
}

void DisplayPid()
{
DWORD pid = GetCurrentProcessId();
wchar_t buf[64];
wsprintf(buf, L"Hey, it worked! Pid is %d", pid);
MessageBox(NULL, buf, L"Injected NEW MessageBox", NULL);
}

AND FROM DLL MAIN I AM CALLING A FUNCTION THAT HANDLES THE INJECTION PROCESS THAT LOOK LIKE:-

DllExport void LoadManagedProject(const wchar_t * managedDllLocation)
 {
HRESULT hr;
ICLRMetaHost* pClrMetaHost = NULL;
ICLRRuntimeInfo* pClrRuntimeInfo = NULL;
ICLRRuntimeHost* pClrRuntimeHost = NULL;
hr = CLRCreateInstance(CLSID_CLRMetaHost, IID_ICLRMetaHost, (LPVOID*)&pClrMetaHost);
if (hr == S_OK)
{


    hr = pClrMetaHost->GetRuntime(L"v4.0.30319", IID_PPV_ARGS(&pClrRuntimeInfo));
    if (hr == S_OK)
    {           
        BOOL fLoadable;
        hr = pClrRuntimeInfo->IsLoadable(&fLoadable);
        if ((hr == S_OK) && fLoadable)
        {                
            hr = pClrRuntimeInfo->GetInterface(CLSID_CLRRuntimeHost,
                IID_PPV_ARGS(&pClrRuntimeHost));
            if (hr == S_OK)
            {
                hr = pClrRuntimeHost->Start();
                if (hr == S_OK)
                {
                    MessageBox(NULL, L"HR=SOK45STTIME", L"Injected MessageBox", NULL);

                    DWORD result;
                    hr = pClrRuntimeHost->ExecuteInDefaultAppDomain(
                        managedDllLocation,
                        L"ExampleProject.Example",
                        L"EntryPoint",
                        L"Argument",
                        &result);
                    if (hr == S_OK)
                    {
                        MessageBox(NULL, L"HR=SOK6STTIME", L"Injected MessageBox", NULL);
                    }

                }
            }
        }
    }
}
}

I was not able to inject this process after a number of tries . Can i get what mistake that i have made or suggest any better approach of calling a managed dll(c# ) using unmanaged dll that is injected to a running process. Thank you in advance.

UPDATE :

If it is not possible this way , could you suggest any best approach of injecting managed dll into a running process. Thank you

Answer 1

You can achieve this by injecting managed dll into unmanaged process using EasyHook here is sample code:

#include <easyhook.h>
#include <string>
#include <iostream>
#include <Windows.h>

DWORD gFreqOffset = 0;
BOOL WINAPI myBeepHook(DWORD dwFreq, DWORD dwDuration)
{
    std::cout << "\n    BeepHook: ****All your beeps belong to us!\n\n";
    return Beep(dwFreq + gFreqOffset, dwDuration);
}

// EasyHook will be looking for this export to support DLL injection. If not found then 
// DLL injection will fail.
extern "C" void __declspec(dllexport) __stdcall NativeInjectionEntryPoint(REMOTE_ENTRY_INFO* inRemoteInfo);

void __stdcall NativeInjectionEntryPoint(REMOTE_ENTRY_INFO* inRemoteInfo)
{
    std::cout << "\n\nNativeInjectionEntryPointt(REMOTE_ENTRY_INFO* inRemoteInfo)\n\n" <<
        "IIIII           jjj               tt                dd !!! \n"
        " III  nn nnn          eee    cccc tt      eee       dd !!! \n"
        " III  nnn  nn   jjj ee   e cc     tttt  ee   e  dddddd !!! \n"
        " III  nn   nn   jjj eeeee  cc     tt    eeeee  dd   dd     \n"
        "IIIII nn   nn   jjj  eeeee  ccccc  tttt  eeeee  dddddd !!! \n"
        "              jjjj                                         \n\n";

    std::cout << "Injected by process Id: " << inRemoteInfo->HostPID << "\n";
    std::cout << "Passed in data size: " << inRemoteInfo->UserDataSize << "\n";
    if (inRemoteInfo->UserDataSize == sizeof(DWORD))
    {
        gFreqOffset = *reinterpret_cast<DWORD *>(inRemoteInfo->UserData);
        std::cout << "Adjusting Beep frequency by: " << gFreqOffset << "\n";
    }

    // Perform hooking
    HOOK_TRACE_INFO hHook = { NULL }; // keep track of our hook

    std::cout << "\n";
    std::cout << "Win32 Beep found at address: " << GetProcAddress(GetModuleHandle(TEXT("kernel32")), "Beep") << "\n";

    // Install the hook
    NTSTATUS result = LhInstallHook(
        GetProcAddress(GetModuleHandle(TEXT("kernel32")), "Beep"),
        myBeepHook,
        NULL,
        &hHook);
    if (FAILED(result))
    {
        std::wstring s(RtlGetLastErrorString());
        std::wcout << "Failed to install hook: ";
        std::wcout << s;
    }
    else 
    {
        std::cout << "Hook 'myBeepHook installed successfully.";
    }

    // If the threadId in the ACL is set to 0,
    // then internally EasyHook uses GetCurrentThreadId()
    ULONG ACLEntries[1] = { 0 };

    // Disable the hook for the provided threadIds, enable for all others
    LhSetExclusiveACL(ACLEntries, 1, &hHook);

    return;
}

Or you can find more details at original source