0

I am having some C++ injection dificulties. I am using Win 7 x64, VS 2010

Here is the complete code I am trying to run: http://pastebin.com/avKS3r22

My questions:

  1. Line 62.

    dwSize = (DWORD)iCodeEnd - (DWORD)iCode; //subtract the function from the limiter to obtain the function's size
    

    Why is dwSize equal to 4294966986 (I think it is the max value for DWORD) when it should be 224 or 0xE0 if iCodeEnd is 0x01151570 and iCode is 0x01151490? Are there any specific properties I need to set for my project (I created an empty win32 project without Unicode)?

  2. Line 92.

    if(!(hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, HREAD_START_ROUTINE)lpAddr, prmAddr, 0, NULL)))
    

If I manualy set dwSize to 224, I get a "Couldn't create remote thread!". Am I wrong about the value of dwSize? Or is it something else?

Please note: This is my first C++ application (please provide more detailed answers). The code is not mine, I just rewrote it to learn the basics. The original version is working fine under my platform.

9
  • 2
    For your first C++ application, you chose a 200-line legacy loaded mith macros? Do yourself a favor: get a C++ book and start with HelloWorld.
    – Beta
    Oct 7, 2012 at 13:33
  • I have seen some Introduction videos. And I think I actualy did a "Helloworld", so this is actualy my second app. It is just that the subject is very interesting and I know other languages like C#, Python, PHP... So I thought I would give C++ a try.
    – Drug
    Oct 7, 2012 at 13:41
  • 1
    @Drug, Completely agree with Beta, you aren't learning C++ at all with this code, just a bit of Windows API programming, which is something completely different.
    – john
    Oct 7, 2012 at 13:46
  • @Drug How do you know that values of iCode, iCodeEnd and dwSize are what you say they are? It would be strange if you are right about the values so I think you must have made a mistake somewhere. BTW 4294966986 is not the maximum DWORD value, close but not exactly right.
    – john
    Oct 7, 2012 at 13:49
  • I can see the values when I run the code in debug mode.
    – Drug
    Oct 7, 2012 at 13:56

1 Answer 1

0
  1. Making iCodeEnd and iCode both static makes the compiler place the functions in memory one after another. This fixes the dwSize to be just right.
  2. On win7 injecting into processses from the \windows\system32 folder such as notepad fails with "Access denied" error (even with UAC disabled).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.