MessageBox not being called from DllMain after Injection

721 views Asked by At

Goal

I am trying to inject an x64 DLL into the w3wp.exe process (IIS worker process) in order to debug my DLL with Visual Studio.

What I have done

I am using Extreme Injector V3 to do this. After selecting the debug build of my DLL and the w3wp.exe process from the process list in Extreme Injector, I click on Inject and am greeted with a MessageBox telling me that the injection completed successfully.

What I expect

I should see a MessageBoxA(0, "injected", 0, 0) from the DllMain. However, I don't see no such thing!

The code of the DLL

int __stdcall DllMain(HMODULE base, unsigned long reason, void* args)
{
    if (reason == DLL_PROCESS_ATTACH)
    {
        return 1;
    }
    return 0;
}
1

There are 1 answers

0
GuidedHacking On

What I expect I should see a MessageBoxA(0, "injected", 0, 0) from the DllMain. However, I don't see no such thing!

Your code doesn't call MessageBox(), it just returns 1 on injection.

Despite being not recommended, if you're just doing it for experiment purposes the code should look like:

int __stdcall DllMain(HMODULE base, unsigned long reason, void* args)
{
    if (reason == DLL_PROCESS_ATTACH)
    {
        MessageBoxA(0, "injected", 0, 0);
    }
    return 0;
}

If that doesn't work you need to try a different injector, make sure your injector is running as administrator.

If w3wp.exe is running as NT AUTHORITY\SYSTEM you may need higher permissions