7 DLL injection techniques in Microsoft Windows

In this article, I am going to list half a dozen DLL injection techniques that can be used by a user mode process running on MS Windows. There could be more techniques but I am sharing with you the techniques that I had first hand experience with.

1. AppInit_DLLs

People used to rely on the AppInit_DLLs registry key. The OS loader queries this value and loads the DLLs specified there when a process is created. I have not used this technique in a long while (last time I used it was on Windows XP) and I heard it is now restricted or discontinued because it was widely used by malware.

2. SetWindowsHookEx API

The SetWindowsHookEx API installs an application-defined hook procedure into a given hook chain. There are various supported hook chains (CBT, Journal, Window messages, keyboard, mouse, etc).

When using the SetWindowsHookEx API, you are instructing the operating system to inject your custom hook DLL into other process where it is relevant. The Windows hooks work when the other processes import / use functionality from USER32.dll.

Continue reading

LICEcap – Record your desktop and create animated GIFs

LICEcap, from Cockos Incorporated, is a nice and free tool that allows you to record your desktop screen activity and later save the activity as an animated GIF. This comes in handy when you are creating a small tutorial of some sort.
The nice thing about LICEcap is that it is not only free but also supports Windows and macOS.

Features and options:

  • Record directly to .GIF or .LCF.
  • Move the screen capture frame while recording.
  • Pause and restart recording, with optional inserted text messages.
  • Global hotkey (shift+space) to toggle pausing while recording
  • Adjustable maximum recording framerate, to allow throttling CPU usage.
  • Basic title frame, with or without text.
  • Record mouse button presses.
  • Display elapsed time in the recording.

You might also like:

Batchography: Number counting in Batch files

This is yet another article about Batch files. In this article, I am going to show you how to do number counting loops in Batch files.

For more advanced Batch scripting topics, please grab a copy of the Batchography book.

batchography-good-res

Let’s get started! Continue reading

Hiew+ – Editing process memory with Hiew hex editor

What’s is Hiew+

Hiew+ is based on the FsPlus project. FsPlus is an implementation of an idea that allows you to access non disk files as if they were disk files. Hiew+ is a real life example of FsPlus where we take Hiew (an excellent hex editor) and turn it into an excellent process editor. Each process will be viewed as a file with a size as much as SYSTEM_INFO.lpMaximumApplicationAddress returns. In theory FsPlus should work with any hex editor to provide process memory editing, but this release is just Hiew ready.

Hiew+ editing the process memory of a process being debugged by IDA Pro

Usage

To use FsPlus, you need to inject FsPlus.dll into Hiew’s process memory so that the APIs are hooked. After APIs are hooked, FsPlus will recognize and treat in a different manner any file name that has the following form: “pid|1234” where 1234 is a given PID. To make the usage even simpler, I provid a small GUI (FsPlusGui) to allow you launch Hiew conveniently.

In fact, Hiew+ can be considered as a nice addition to your reverse engineering tools arsenal (IDA Pro‘s debugger or any other debugger, etc.).

Here’s a screenshot of the FsPlusGui:

You will need to double click on a process to have Hiew or the desired process launched with FsPlus support.
Make sure you specify the settings correctly in FsPlus.ini:

[settings]
title=Hiew+ (c) lallous <lallousz-x86@yahoo.com>
hookdll=.\fsPlus.dll
launch=c:\hiew\hiew32.exe

Features

After you run it successfully, you will be able to start editing processes as if you were editing files. The catch is every process virtual address is now a physical offset in Hiew.

Modules as IMAGE_SECTION_HEADERs

For your convenience we have created additional IMAGE_SECTION_HEADER structures in the PE header of the main process, so that each loaded module is view as a PE section:

Textual information about process’ modules

In addition to viewing modules as PE sections, you will have an actual representation of all loaded modules just after the end of the PE header:

flower separator
batchography-good-resDo you want to master Batch Files programming? Look no further, the Batchography is the right book for you.

Available in print or e-book editions from Amazon.
flower separator

No Read Errors

To avoid reading errors and such, any unreadable memory page is filled with “BAD!” pattern.

Physical and Logical disk editing

This is not something added by FsPlus, rather it is a undocumented feature of Hiew32 where you can use Hiew to edit/view logical and physical disk sectors:

Conclusion

Download – Release date: late 2008

This tool has been tested with Windows Vista (32) and Windows XP SP2 and with Hiew 7.29.
Hope you find this tool useful as Hiew itself.
Note: Please don’t contact me if you run into trouble. This tool is no longer supported.

You might also like:

3 easy steps to setting up a zero configuration multi-platform web server with NodeJS and local-web-server

In this technical post I am going to illustrate how you can use the simple local-web-server package for NodeJS to start your web server in a few commands.

Let’s get started!

Step 1 – Installation

First, install NodeJS from http://nodejs.org/download/

If you are using Windows, then make sure you download the MSI package because it is so easy to install.

Keep the default options as you’re installing:

image

After installing NodeJS, open an elevated command prompt (i.e: run cmd.exe as Administrator) and type the following command in order to install the local-web-server package:

npm install -g local-web-server

You should see something like this:

image

No errors imply that the package has been successfully installed! Continue reading

Batchography: Changing the MAC address on Windows – A free Batch script

batchography-good-resIn a previous post entitled “How to get unlimited free Internet at Airports“, I showed you how to circumvent the time limit imposed by the “free” Wi-Fi connections in certain airports.

For that trick to work, you were required to update the MAC address of your computer each time the free time is over.

In this blog post, I am going to share with you the ChangeMACAddressBatch script that I wrote with the help and instructions from the excellent Batchography book.

The script makes use of various recipes illustrated in the Batchography book (in Chapter 4) and uses the various Batch scripting language syntax (Chapters 1 and 2) and methodologies (Chapter 3). Therefore, I will not be explaining the script’s contents or how it works because it will become evident if you read the Batchography book.

flower separator

Get the book from Amazon:

  • Paperback editionbtn-buy-on-amazon
  • E-book editionbtn-buy-on-amazon

flower separator

How to use the script interactively

To begin with, you need to run the script with administrative privileges.

Running the script as an administrator


On Windows 8 and above, just press Win+X and choose “Command Prompt (Admin)” like this:

chg-mac-run-elevated-command-prompt

Otherwise, if you are using the Windows Explorer window, then right-click on your script and choose “Run as Administrator”:

chg-mac-run-as-admin

Starting the script

When you first run the script, you will be presented with the main menu that will show you a list of all the adapters you have on your system.

On my laptop for instance, I have 4 adapters:

  • An Ethernet adapter
  • 2 x VMWare virtual adapters
  • A Wi-Fi adapter

Using the keyboard, type the adapter number that you want to inspect and/or change its MAC address:

chg-mac-main-menu

Let’s press “4” in this case and go inside that adapter’s information screen. Continue reading

Keyboard shortcuts to work in a remote desktop Windows Machine from your MacBook

macos-rdp-1In this blog post, I am going to share with you how to get the missing keyboard keys that let you work in MS Windows via the remote desktop client under Mac OS X with the MacBook’s keyboard.

What is important to know is that when using a MacBook’s keyboard, you don’t have all the keys that you usually have on a PC keyboard.

Essentially, you are missing the following keys:

  • HOME / END.
  • DEL key. This is different from the MacBook’s “Delete” key (which is equivalent to the “Backspace” key).
  • INS Key.
  • Page Up / Page Down.
  • The “Windows” key.

Continue reading