dcsimg
Results 1 to 10 of 10

Thread: VB6 - Process injection/API hooking

  1. #1

    Thread Starter
    Lively Member rm_03's Avatar
    Join Date
    Aug 2004
    Posts
    92

    VB6 - Process injection/API hooking

    Part 1) IAT Hooking. All imported functions (like kernel32.sleep()) by a module
    have an entry in its IAT (Import Address Table). By comparing the entry point of the
    target function with all the entries in the IAT, you can overwrite the IAT entry with a new function pointer.
    Next time the importing module calls the target function, it will be redirected to the new function.

    Part 2) Function redirection. By overwriting a function with a JMP instruction you can redirect any function to a new one.

    Part 3) Process injection and remote API hooking.
    You can inject any module into a process by getting its size (=> PE header),
    allocating memory in the remote process
    and copy the whole module with WriteProcessMemory() to the remote process.
    The aim now is to hook an API in the remote process.
    Because CreateRemoteThread() will cause VB code to run in a new thread (not good, as we all know),
    we simply do the same thing like in part 2, but with WriteProcessMemory().

    Note: The remote process needs to be written in VB, too.
    Attached Files Attached Files

  2. #2
    Old Member moeur's Avatar
    Join Date
    Nov 2004
    Location
    Wait'n for Free Stuff
    Posts
    2,712

    Re: VB6 - Process injection/API hooking

    Perhaps you could explain a little bit more about what you are doing here. For example let's discuss #3. The example program when run shows all running processes. I assume you are supposed to highlight a processes let's say calc.exe, and click inject. Of course injection fails (in german) because I did something wrong.

    Edit: i just saw the end of the post, the remote process needs to be written in VB. Why is that?

  3. #3

    Thread Starter
    Lively Member rm_03's Avatar
    Join Date
    Aug 2004
    Posts
    92

    Re: VB6 - Process injection/API hooking

    Perhaps you could explain a little bit more about what you are doing here
    I'm afraid of writing long messages, not so much practice in writing English

    Because of the runtime.
    Almost every function you use (like the left/right/mid functions) is stored in the runtime,
    but I guess, you know that.
    When starting a VB app, the runtime does some stuff I don't really know about, which won't allow you to use these functions in a new thread (sure, with some tricks you can, but they're not safe, At least in a standard exe).
    You could inject the VB runtime into the other process, but there's the risk that the address space is already used by another module.
    But even if it worked - it wouldn't be initialized.

    So what I did in example 3 was:
    1) Overwrite the remote function with a JMP instruction
    2) inject my own module to the remote process
    but don't execute code with CreateRemoteThread
    because it will executed in the first thread when the hooked API will be called.

  4. #4
    Lurker
    Join Date
    Jan 2005
    Location
    Everywhere
    Posts
    13,651

    Re: VB6 - Process injection/API hooking

    Quote Originally Posted by rm_03
    Because of the runtime.
    Sounds familiar moeur

  5. #5
    Junior Member
    Join Date
    Dec 2005
    Posts
    21

    Re: VB6 - Process injection/API hooking

    is it possible to hook CreateProcess/OpenProcess/CreateThread etc APIs in Kernel32.dll for shell32.dll module? I wish to intercept the execution of apps, before they really start to run, I need to decide whether I should let them run.

  6. #6
    Old Member moeur's Avatar
    Join Date
    Nov 2004
    Location
    Wait'n for Free Stuff
    Posts
    2,712

    Re: VB6 - Process injection/API hooking

    see this thread on how you can do that
    http://www.vbforums.com/showthread.php?t=324133

  7. #7
    Junior Member
    Join Date
    Dec 2005
    Posts
    21

    Smile Re: VB6 - Process injection/API hooking

    yes, I've already read all threads realted to hook/inject etc. but some uses external dlls(third party ones), or uses vc++.

    I wish to have all done in pure vb6

  8. #8
    Hyperactive Member
    Join Date
    Jul 2005
    Posts
    400

    Re: VB6 - Process injection/API hooking

    Does anyone know how to intercept an API in all processes? The examples that I've seen only work with a specific process.

  9. #9
    New Member
    Join Date
    Jun 2008
    Posts
    1

    Re: VB6 - Process injection/API hooking

    A very good work but...there is a system for hook 1 API in all language?
    This program if you hook a c++ program,the program crash T_T.
    Can you explain me what change?

  10. #10
    Member
    Join Date
    Sep 2008
    Location
    Turkey
    Posts
    37

    Re: VB6 - Process injection/API hooking

    Redirecthook is not working...
    Error : Variable not defined on RealAddr

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Featured


Click Here to Expand Forum to Full Width