May 6, 2018 04:26 AM
(This post was last modified: May 6, 2018 02:36 PM by hansbald.)
I was just playing around with an open-source process hollowing source code and ran into a problem.
The RunPE works just fine for a test "Hello World" app. But if I try to inject a bigger app that uses user32.dll and kernel32.dll, the injected program crashes with exception code 0xC0000142.
If my understanding is correct that is because user32.dll or/and kernel32.dll don't get loaded correctly.
Im currently trying to figure this out. If anyone has a nudge for me on how to ensure the dll's get loaded I would be very grateful :)
I'm currently learning C++ for university (Computer Science/Security) and don't want to just copy pastee, im trying to really understand it.
Here is the code:
https://github.com/m0n0ph1/Process-Hollo...sHollowing
Thanks in advance!
EDIT:
Code of the file im trying to inject:
Nevermind I fixed it.
For people wondering in the future:
You obviously cant inject console apps into gui apps (and vice versa) with this method :)
The RunPE works just fine for a test "Hello World" app. But if I try to inject a bigger app that uses user32.dll and kernel32.dll, the injected program crashes with exception code 0xC0000142.
If my understanding is correct that is because user32.dll or/and kernel32.dll don't get loaded correctly.
Im currently trying to figure this out. If anyone has a nudge for me on how to ensure the dll's get loaded I would be very grateful :)
I'm currently learning C++ for university (Computer Science/Security) and don't want to just copy pastee, im trying to really understand it.
Here is the code:
https://github.com/m0n0ph1/Process-Hollo...sHollowing
Thanks in advance!
EDIT:
Code of the file im trying to inject:
Code
#include "Windows.h"
int main()
{
HINSTANCE hDLL = LoadLibraryA("User32.dll");
vMessageBoxA MsgBox = (vMessageBoxA)GetProcAddress(hDLL, "MessageBoxA");
MsgBox(0, (LPCTSTR)"Hello World!", (LPCTSTR)"Hello World! Dynamiically loadded!!", 0);
FreeLibrary(hDLL);
return 0;
}Nevermind I fixed it.
For people wondering in the future:
You obviously cant inject console apps into gui apps (and vice versa) with this method :)

