Issue with CreateRemoteThread causing target process crash

66 Views Asked by At

I am encountering a problem when using CreateRemoteThread to inject a thread into a target process. The target process crashes without clear error messages, and I'm having trouble identifying the root cause. I've thoroughly reviewed my code and incorporated debugging statements, but I'm still stuck.

Code Overview:

game.cpp

int player = 10;

int main()
{
  while (1)
  {
    std::cout << "Number of player = "
              << player
              << " | address of "
              << &player << std::endl;
    Sleep(3000);
  }

  return 0;
}

injector.cpp

const WCHAR* TARGET_PROCESS_NAME = L"game.exe";
const DWORD MEMORY_ALLOCATION_SIZE = 1 << 12;

DWORD WINAPI HackThread(int * lpParameter)
{
  int *player = lpParameter;
  *player = 100;
  return 0;
}

int main()
{
  auto pid = getProcessId(TARGET_PROCESS_NAME);
  if (pid == 0)
  {
    std::cerr << "Error: Unable to find process " << TARGET_PROCESS_NAME << std::endl;
    return 1;
  }

  HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
  if (hProcess == NULL)
  {
    std::cerr << "Error: Unable to open process. Error code: " << GetLastError() << std::endl;
    return 1;
  }


  LPVOID lpBaseAddress = VirtualAllocEx(hProcess, nullptr, MEMORY_ALLOCATION_SIZE, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
  if (lpBaseAddress == nullptr)
  {
    std::cerr << "Error: Unable to allocate memory in the remote process. Error code: " << GetLastError() << std::endl;
    CloseHandle(hProcess);
    return 1;
  }

  DWORD oldProtect;
  if (!VirtualProtectEx(hProcess, lpBaseAddress, MEMORY_ALLOCATION_SIZE, PAGE_EXECUTE_READ, &oldProtect))
  {
    std::cerr << "Error: Unable to modify memory protection. Error code: " << GetLastError() << std::endl;
    VirtualFreeEx(hProcess, lpBaseAddress, MEMORY_ALLOCATION_SIZE, MEM_RELEASE);
    CloseHandle(hProcess);
    return 1;
  }

  int valueToSend = 0x00791000;
  if (!WriteProcessMemory(hProcess, lpBaseAddress, &valueToSend, sizeof(int), NULL))
  {
    std::cerr << "Error: Unable to write to remote process memory. Error code: " << GetLastError() << std::endl;
    VirtualFreeEx(hProcess, lpBaseAddress, MEMORY_ALLOCATION_SIZE, MEM_RELEASE);
    CloseHandle(hProcess);
    return 1;
  }

  HANDLE hThread = CreateRemoteThread(hProcess, nullptr, 0, (LPTHREAD_START_ROUTINE)HackThread, lpBaseAddress, NULL, nullptr);
  if (hThread == NULL)
  {
    std::cerr << "Error: Unable to create remote thread. Error code: " << GetLastError() << std::endl;
    VirtualFreeEx(hProcess, lpBaseAddress, MEMORY_ALLOCATION_SIZE, MEM_RELEASE);
    CloseHandle(hProcess);
    return 1;
  }

  WaitForSingleObject(hThread, INFINITE);

  // Clean up resources
  VirtualFreeEx(hProcess, lpBaseAddress, MEMORY_ALLOCATION_SIZE, MEM_RELEASE);
  return 0;
}

Problem Description:

I'm attempting to inject a thread into a target process using CreateRemoteThread. It like DLL injection but instead of DLL I only want to run a HackThread. However, the target process crashes without providing specific error details. I've ensured proper memory allocation, protection modification, and data writing. Additionally, I've added debugging statements, but I can't pinpoint the issue.

Specific Questions:

  • Can I use "DLL injection without DLL"?
  • What is the root of this cause?

Additional Context:

  • hThread != 0
  • lpBaseAddress != 0
  • Compiled in x86 debug mode

I appreciate any guidance or insights into resolving this issue. Thank you!

0

There are 0 best solutions below