Dll injection not working in suspended process

2.5k views Asked by At

I'm using CreateRemoteThread api to inject a dll into a process. This works when the process is running state. But If I launch a process in suspended state using CreateProcess api and try to inject a dll into it, then dll injection is not working. But If I use createprocess without suspended flag, then I can able to inject the dll. Can anyone tell me the solution of this problem?

2

There are 2 answers

0
LeenLi On

It can not work because creating a process with suspended flag,it loads only ntdll.dll. kernal32.dll is not loaded yet, so you can not use createprocess to call LoadLibrary(in the kernal32.dll) in the remote suspended process. but you can use LdrLoadDll(in the ntdll.dll) instead. you can also use QueueUserAPC with LdrLoadDll ,too. it will works well~

1
user1150246 On

I meet the similar case. Not know the exact root cause, I suggest you to try to use QueueUserAPC api to do the injection.