DLL Injection fails with code 127

Question

I am trying to do some dll injection. I think I tried everything I could but cound not solve the problem unfortunately. I always get ERROR CODE 127 which means ERROR_PROC_NOT_FOUND. I am using Windows 7 64 bit.

#include <iostream>
#include <Windows.h>
#include <TlHelp32.h>

using namespace std;

char FileToInject[] = "theDll.dll";
char ProcessName[] = "calc.exe";

typedef HINSTANCE (*fpLoadLibrary)(char*);

bool InjectDLL(DWORD processId);

int main() {
    DWORD processId = NULL;

    PROCESSENTRY32 pre32 = {sizeof(PROCESSENTRY32)};
    HANDLE hProcSnap;
    cout << "BEFORECreateToolhelo32Snapshot:" << GetLastError() <<endl;
    while(!processId) {

            system("CLS");
            cout << "Searching..." << endl;
            hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
            cout << "CreateToolhelo32Snapshot:" << GetLastError() <<endl;

            if(Process32First(hProcSnap, &pre32)) {

                    do {

                        if(!(strcmp(pre32.szExeFile, ProcessName))) {

                           processId = pre32.th32ProcessID;
                           break;

                        }

                    }
                    while(Process32Next(hProcSnap, &pre32));
            }
            Sleep(1000);
    }
    cout << GetLastError() <<endl;
    while(!InjectDLL(processId)) {
        cout << "DLL Injection failed" << endl;
        Sleep(1000);
    }

    cout << "DLL Injected successfully" << endl;
    getchar();
    CloseHandle(hProcSnap);

    return 0;
}

bool InjectDLL(DWORD processId) {

    HANDLE hProc;
    LPVOID paramAddr;
    cout << "START:" << GetLastError() <<endl;
    HINSTANCE hDll = LoadLibrary("KERNEL32");
    cout << "LoadLibrary:" << GetLastError() <<endl;

    fpLoadLibrary LoadLibraryAddr = (fpLoadLibrary)GetProcAddress(hDll, "LibraryLoadA");
    cout << "LoadLibraryArr:" << GetLastError() <<endl;
    hProc = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
    cout << "OpenProcess:" << GetLastError() <<endl;
    char DllPath[250] = "C:\\Hacks\test.dll";

    paramAddr = VirtualAllocEx(hProc, 0, strlen(DllPath) + 1, MEM_COMMIT, PAGE_READWRITE);
    cout << "VirtualAlloxEx:" <<GetLastError() <<endl;
    bool MemoryWritten = WriteProcessMemory(hProc, paramAddr, DllPath, strlen(DllPath) + 1, NULL);
    cout << "WriteProcessMemory:" << GetLastError() <<endl;
    CreateRemoteThread(hProc, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryAddr, paramAddr, 0, 0);
    cout << "CreateRemoteThread:" <<GetLastError() <<endl;
    CloseHandle(hProc);
    return MemoryWritten;
}

The output is the following:

Searching...
CreateToolhelp32Snapshot: 18 ERROR_NO_MORE_FILES
LoadLibrary:18 ERROR_NO_MORE_FILES
LoadLibraryArr:127 ERROR_PROC_NOT_FOUND
OpenProcess:127 ERROR_PROC_NOT_FOUND
VirtualAlloxEx:127 ERROR_PROC_NOT_FOUND
WriteProcessMemory:127 ERROR_PROC_NOT_FOUND
CreateRemoteThread:5 ACCESS DENIED
DLL Injected successfully

The program finds the calc.exe as a process with no problem, but after that something goes wrong. Could someone please help me with this?

Thank you,

Tamas

Answer 1

This is one problem:

char DllPath[250] = "C:\\Hacks\test.dll";

The last backslash is not escaped. Change to:

char DllPath[250] = "C:\\Hacks\\test.dll";

The function is called LoadLibraryA() , not LibraryLoadA() :

fpLoadLibrary LoadLibraryAddr =
    (fpLoadLibrary)GetProcAddress(hDll, "LibraryLoadA");

A few other suggestions:

• Only check GetLastError() if the previous WINAPI function failed.
• Only continue processing if the previous WINAPI code (or other code) succeeded.

Answer 2

In

fpLoadLibrary LoadLibraryAddr = (fpLoadLibrary)GetProcAddress(hDll, "LibraryLoadA");

you should rather resolve the string LoadLibraryA . The

OpenProcess:127 ERROR_PROC_NOT_FOUND
VirtualAlloxEx:127 ERROR_PROC_NOT_FOUND (<-- sic)
WriteProcessMemory:127 ERROR_PROC_NOT_FOUND

errors are caused because you're using GetLastError even though these functions maybe didn't even fail. So before calling GetLastError , make sure that these functions yield an error return value (NULL or the like).