why my DLL injection works the first time but fails on subsequent attempts

56 views Asked by At

Iam trying to inject a DLL to notepad++ that shows a msg "DLL injected successfully!". in the first run it works but if I want it to show it again i have to closh Notepad and open it again(it does not work on the same process twice)

I have tried to unload the DDL after it run and free the memory but it doesnt work either

my DLL:

#include <iostream>
#include <windows.h>
#define DLL_EXPORT
#include "mydll.h"
extern "C"
{
    DECLDIR void Share()
    {
        MessageBox(NULL, L"DLL injected successfully!", L"DLL Message", MB_OK);
    }
}
BOOL APIENTRY DllMain(HANDLE hModule, // Handle to DLL module
    DWORD ul_reason_for_call,
    LPVOID lpReserved) // Reserved
{

    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        // A process is loading the DLL.
        Share();
        FreeLibraryAndExitThread(static_cast<HMODULE>(hModule), 0);
        break;
    }
    return TRUE;

}

My DLL injection code:


#include <Windows.h>
#include <winerror.h>
#include <stdio.h>

int main(int argc, char* argv[])
{
    char szDLLPathToInject[] = { <DLL PATH> };
    int nDLLPathLen = lstrlenA(szDLLPathToInject);
    int nTotBytesToAllocate = nDLLPathLen + 1; // including NULL character.

    // 0. Open The process
    HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, <PID>);
    if (!hProcess)
    {
        fprintf(stderr, "Failed to open process. Error code: %d\n", GetLastError());
        return 1;
    }

    // Check if the DLL is already loaded in the target process
    HMODULE hModule = GetModuleHandleA("MyDLL.dll");
    if (hModule)
    {
        fprintf(stderr, "DLL is already loaded in the target process.\n");
        CloseHandle(hProcess);
        return 1;
    }

    // 1. Allocate heap memory in the remote process
    LPVOID lpHeapBaseAddress1 = VirtualAllocEx(hProcess, NULL, nTotBytesToAllocate, MEM_COMMIT, PAGE_READWRITE);
    if (!lpHeapBaseAddress1)
    {
        fprintf(stderr, "Failed to allocate memory in remote process. Error code: %d\n", GetLastError());
        CloseHandle(hProcess);
        return 1;
    }

    // 2. Write the DLL path in the remote allocated heap memory.
    SIZE_T lNumberOfBytesWritten = 0;
    if (!WriteProcessMemory(hProcess, lpHeapBaseAddress1, szDLLPathToInject, nTotBytesToAllocate, &lNumberOfBytesWritten))
    {
        fprintf(stderr, "Failed to write to remote process memory. Error code: %d\n", GetLastError());
        VirtualFreeEx(hProcess, lpHeapBaseAddress1, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return 1;
    }

    // 3.0. Get the starting address of the function LoadLibrary
    // which is available in kernel32.dll
    LPTHREAD_START_ROUTINE lpLoadLibraryStartAddress = (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(L"Kernel32.dll"), "LoadLibraryA");
    if (!lpLoadLibraryStartAddress)
    {
        fprintf(stderr, "Failed to get the address of LoadLibraryA. Error code: %d\n", GetLastError());
        VirtualFreeEx(hProcess, lpHeapBaseAddress1, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return 1;
    }

    // 3.1. Call LoadLibrary in the remote process and pass the remote heap memory
    // which contains the DLL path to load.
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, lpLoadLibraryStartAddress, lpHeapBaseAddress1, 0, NULL);
    if (!hThread)
    {
        fprintf(stderr, "Failed to create remote thread. Error code: %d\n", GetLastError());
        VirtualFreeEx(hProcess, lpHeapBaseAddress1, 0, MEM_RELEASE);
        CloseHandle(hProcess);
        return 1;
    }

    // Wait for the thread to complete
    WaitForSingleObject(hThread, INFINITE);

    // Clean up
    CloseHandle(hThread);
    VirtualFreeEx(hProcess, lpHeapBaseAddress1, 0, MEM_RELEASE);
    CloseHandle(hProcess);

    return 0;
}
0

There are 0 answers