Iam trying to inject a DLL to notepad++ that shows a msg "DLL injected successfully!". in the first run it works but if I want it to show it again i have to closh Notepad and open it again(it does not work on the same process twice)
I have tried to unload the DDL after it run and free the memory but it doesnt work either
my DLL:
#include <iostream>
#include <windows.h>
#define DLL_EXPORT
#include "mydll.h"
extern "C"
{
DECLDIR void Share()
{
MessageBox(NULL, L"DLL injected successfully!", L"DLL Message", MB_OK);
}
}
BOOL APIENTRY DllMain(HANDLE hModule, // Handle to DLL module
DWORD ul_reason_for_call,
LPVOID lpReserved) // Reserved
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
// A process is loading the DLL.
Share();
FreeLibraryAndExitThread(static_cast<HMODULE>(hModule), 0);
break;
}
return TRUE;
}
My DLL injection code:
#include <Windows.h>
#include <winerror.h>
#include <stdio.h>
int main(int argc, char* argv[])
{
char szDLLPathToInject[] = { <DLL PATH> };
int nDLLPathLen = lstrlenA(szDLLPathToInject);
int nTotBytesToAllocate = nDLLPathLen + 1; // including NULL character.
// 0. Open The process
HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, <PID>);
if (!hProcess)
{
fprintf(stderr, "Failed to open process. Error code: %d\n", GetLastError());
return 1;
}
// Check if the DLL is already loaded in the target process
HMODULE hModule = GetModuleHandleA("MyDLL.dll");
if (hModule)
{
fprintf(stderr, "DLL is already loaded in the target process.\n");
CloseHandle(hProcess);
return 1;
}
// 1. Allocate heap memory in the remote process
LPVOID lpHeapBaseAddress1 = VirtualAllocEx(hProcess, NULL, nTotBytesToAllocate, MEM_COMMIT, PAGE_READWRITE);
if (!lpHeapBaseAddress1)
{
fprintf(stderr, "Failed to allocate memory in remote process. Error code: %d\n", GetLastError());
CloseHandle(hProcess);
return 1;
}
// 2. Write the DLL path in the remote allocated heap memory.
SIZE_T lNumberOfBytesWritten = 0;
if (!WriteProcessMemory(hProcess, lpHeapBaseAddress1, szDLLPathToInject, nTotBytesToAllocate, &lNumberOfBytesWritten))
{
fprintf(stderr, "Failed to write to remote process memory. Error code: %d\n", GetLastError());
VirtualFreeEx(hProcess, lpHeapBaseAddress1, 0, MEM_RELEASE);
CloseHandle(hProcess);
return 1;
}
// 3.0. Get the starting address of the function LoadLibrary
// which is available in kernel32.dll
LPTHREAD_START_ROUTINE lpLoadLibraryStartAddress = (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(L"Kernel32.dll"), "LoadLibraryA");
if (!lpLoadLibraryStartAddress)
{
fprintf(stderr, "Failed to get the address of LoadLibraryA. Error code: %d\n", GetLastError());
VirtualFreeEx(hProcess, lpHeapBaseAddress1, 0, MEM_RELEASE);
CloseHandle(hProcess);
return 1;
}
// 3.1. Call LoadLibrary in the remote process and pass the remote heap memory
// which contains the DLL path to load.
HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, lpLoadLibraryStartAddress, lpHeapBaseAddress1, 0, NULL);
if (!hThread)
{
fprintf(stderr, "Failed to create remote thread. Error code: %d\n", GetLastError());
VirtualFreeEx(hProcess, lpHeapBaseAddress1, 0, MEM_RELEASE);
CloseHandle(hProcess);
return 1;
}
// Wait for the thread to complete
WaitForSingleObject(hThread, INFINITE);
// Clean up
CloseHandle(hThread);
VirtualFreeEx(hProcess, lpHeapBaseAddress1, 0, MEM_RELEASE);
CloseHandle(hProcess);
return 0;
}