Cheat Engine

[talkerzero]

I'm trying to use WriteProcessMemory() to inject my code into another process at an address allocated by VirtualAllocEx, so I can call it with CreateRemoteThread(). Is this how I should do it?

(edit) Here's my new code. The target process keeps crashing when inject_thread() reaches CreateRemoteThread(), any idea why?

[hcavolsdsadgadsg]

First off: you never actually get the handle to the process you're trying to write too, you're just returning the process ID. Use OpenProcess to get it.

[talkerzero]

[hcavolsdsadgadsg]

See what GetLastError() has to say about it, I'll read it over in a bit.

[talkerzero]

[dnsi0]

[talkerzero]

[dnsi0]

[Dark Byte]

perhaps the call to DialogBox happens from a defered call using a IAT table, which you havn't copied to the exact same location as your injector program.

Perhaps the target process doesn't have a resource named IDD_DIALOG1 , or at least not the same resourceID

Perhaps the address of DlgProc isn't the same as in the target process

In short, the approach you're taking to inject a piece of code into the target its wrong. The method you're using does not allow function calling of any kind. (Sure you can do it by reading the relocation table of your injector to find out what addresses are relative and then change them after injection, and filling in the IAT table, but I think there are easier methods
edit: this is what dnsi says)

I recommend the following:
Write your MainThread in a seperate dll
Then inject that dll by calling CreateRemoteThread on the address of LoadLibrary with as parameter the address of a string with the full path to that dll. (written to the target process with WriteProcessMemory)

Then in the dll entrypoint do what you want

[hcavolsdsadgadsg]

Yep, you never use LoadLibrary(), which you will need for the method you're using. You want to allocate memory for your path string with VirtualAllocEx(), then write it with WriteProcessMemory().

Use GetProcAddress() to get the address of LoadLibrary() and finally call CreateRemoteThread().

[dnsi0]

[Dark Byte]

Why not just change the .dpr from program to library, and then compile.
That way it'll inject a lot better and works easier as well. (dialogs and forms work fine, e.g look at the injected pointer scan of ce, or the packet editor plugin example)

Anyhow, if you insist on .exe injection:
don't just copy the memory of the currently running executable to the target process. You don't want to copy the initialized data sections that then contain initialized pointers to structures. (e.g the code "if windowpointer=nil then createwindow else usewindow;" will mess up)
You will have to read from the binary .exe (and hope the compiler didn't strip out the relocation table, which is usually not used for .exe's so can be removed to save a few kb of space)
Then read the PE header to find out which sections there are, and allocate the memory regions accordingly with proper protection.
Then copy the physical memory of the exe to the virtual memory regions (note that they don't map 1 on 1)
And then try running the entry point. I don't know if it'll work, as resources and a hinstance might be problematic, but with some luck it'll launch

But again, just compiling the program as a .DLL fixes a lot of problems.
And in case you never noticed, with one simple define in the ce sourcecode (ceasinjectabledll) you can make Cheat Engine itself compile as a dll

[dnsi0]

[talkerzero]

I've already thought of DLL injection and don't wish to use it.

[sponge]

http://www.woodmann.com/collaborative/tools/index.php/ManualMap