Jump to content
  • Advertisement
Sign in to follow this  
Falcon22

Problem with loading a DLL through a code cave

This topic is 2087 days old which is more than the 365 day threshold we allow for new replies. Please post a new topic.

If you intended to correct an error in the post then please contact us.

Recommended Posts

Hello,

 

I am trying to load a certain dll from inside a certain .exe of which I don't have the source code.

So I tried to do it with a code cave which seemed like a good option, but I am experiencing some trouble.

 

This is what I have so far:

 

I first load the .exe in ollydebugger then I select the exe module with ALT + E. 

 

then I make sure I have at least 5 bytes of free space somewhere in the stack, in this case I did that by replacing the following asm commands with NOP's:

004BF23B                                 8BF2             MOV ESI,EDX
004BF23D                                 8BD8             MOV EBX,EAX
004BF23F                                 94               XCHG EAX,ESP

After that I go to the bottom to find some free space and add this code:

0052152A                                    90               NOP
0052152B                                    68 87155200      PUSH some.00521587 ; ASCII "some.dll"
00521530                                    E8 42349B76      CALL kernel32.LoadLibraryA
00521535                                    90               NOP
.....					    8BF2             MOV ESI,EDX
.....         	                            8BD8             MOV EBX,EAX 
.....	                                    94               XCHG EAX,ESP
00521536                                    68 FDF04B00      PUSH <some.codecave.Return>
0052153B                                    C3               RETN

I declared the ASCII somewhere above this code in the stack, also in some free space. The "codecave.Return" label is attached to the command right below the free space I made, so it would normally come after "XCHG EAX, ESP".

 

Finally I replaced the 5 bytes of free space with this command:

004BF23B                                   E9 E7220600      JMP <some.codecave.MyCodeCave>

which makes it jump straight to the beginning of the code you see in the second code window.

 

then I right click and do "copy all modifications to executable", when another window which shows the selection of what I modified appears,  I right click again and do "save" and I enter another name than the original.

 

So when I have the dll in the same folder as the edited executable it still doesnt load it, the executable doesnt even start.

 

I hope someone can tell me what I did wrong.

 

Thanks alot in advance!

Edited by Falcon22

Share this post


Link to post
Share on other sites
Advertisement

If you loaded it in a debugger to see why it fails to start it would be helpful in tracking down the error.

 

What stands out to me:

#1: 00521535 and then 00521536?  You moved 5 bytes to address 00521536.  Why aren’t they showing?  68 FDF04B00      PUSH <some.codecave.Return> should be on 0052153B.  Could be an OllyDbg patching error.

#2: Why the PUSH on 00521536 followed by a RETN?  Without seeing what was originally on 004BF240 this could be correct or wrong, but there is a safe way to not care either way: 00521536    JMP 004BF240.  When you inject code, you replace a part with a JMP, add the replaced part to your jumped-to location, and then JMP back to just after the part you replaced.  This is probably your error.

 

 

L. Spiro

Share this post


Link to post
Share on other sites

Hi,

 

Thanks for the reply,

 

Dont mind the addresses they are not accurate.

I also tried it once with a JMP to the address after my JMP to the code cave and that also didn't work.

Share this post


Link to post
Share on other sites

LoadLibrary returns its result in EAX. You're clobbering the register with your injected code. Try PUSHing EAX onto the stack prior to the LoadLibrary call and POPing it back off afterwards.

Share this post


Link to post
Share on other sites

I believe Windows calling convention allows EAX, ECX and EDX to be used as volatiles (i.e. the called function will not back them up, and the caller must assume they got clobbered and back them up if they need to be preserved).  You should save all three just in case.

Share this post


Link to post
Share on other sites

@ApochPiQ 

 

Still did the same thing, it just doesnt start. This is what I replaced this time:

004BF1F7                                        00CC             ADD AH,CL
004BF1F9                                        8BC8             MOV ECX,EAX
004BF1FB                                        85C9             TEST ECX,ECX

with this:

004BF1F7                                            E9 38230600      JMP <some.codecave.MyCodeCave>
004BF1FC                                            90               NOP
004BF1FD <codecave.ReturnFromCodeCave>              75 FF            JNZ SHORT some.004BF1FE

and the codecave:

00521534 <codecave.MyCodeCave>                      50               PUSH EAX
00521535                                            68 1B155200      PUSH some.0052151B
0052153A                                            E8 38345874      CALL kernel32.LoadLibraryA
0052153F                                            58               POP EAX
00521540                                            90               NOP
00521541                                            02E1             ADD AH,CL
00521543                                            8BC8             MOV ECX,EAX
00521545                                            85C9             TEST ECX,ECX
00521547                                            90               NOP
00521548                                           ^E9 B0DCF9FF      JMP <some.codecave.ReturnFromCodeCave>

Thanks in advance

Edited by Falcon22

Share this post


Link to post
Share on other sites
Sign in to follow this  

  • Advertisement
×

Important Information

By using GameDev.net, you agree to our community Guidelines, Terms of Use, and Privacy Policy.

GameDev.net is your game development community. Create an account for your GameDev Portfolio and participate in the largest developer community in the games industry.

Sign me up!