This topic is 2087 days old which is more than the 365 day threshold we allow for new replies. Please post a new topic.

## Recommended Posts

Hello,

I am trying to load a certain dll from inside a certain .exe of which I don't have the source code.

So I tried to do it with a code cave which seemed like a good option, but I am experiencing some trouble.

This is what I have so far:

I first load the .exe in ollydebugger then I select the exe module with ALT + E.

then I make sure I have at least 5 bytes of free space somewhere in the stack, in this case I did that by replacing the following asm commands with NOP's:

004BF23B                                 8BF2             MOV ESI,EDX
004BF23D                                 8BD8             MOV EBX,EAX
004BF23F                                 94               XCHG EAX,ESP


After that I go to the bottom to find some free space and add this code:

0052152A                                    90               NOP
0052152B                                    68 87155200      PUSH some.00521587 ; ASCII "some.dll"
00521535                                    90               NOP
.....					    8BF2             MOV ESI,EDX
.....         	                            8BD8             MOV EBX,EAX
.....	                                    94               XCHG EAX,ESP
00521536                                    68 FDF04B00      PUSH <some.codecave.Return>
0052153B                                    C3               RETN



I declared the ASCII somewhere above this code in the stack, also in some free space. The "codecave.Return" label is attached to the command right below the free space I made, so it would normally come after "XCHG EAX, ESP".

Finally I replaced the 5 bytes of free space with this command:

004BF23B                                   E9 E7220600      JMP <some.codecave.MyCodeCave>


which makes it jump straight to the beginning of the code you see in the second code window.

then I right click and do "copy all modifications to executable", when another window which shows the selection of what I modified appears,  I right click again and do "save" and I enter another name than the original.

So when I have the dll in the same folder as the edited executable it still doesnt load it, the executable doesnt even start.

I hope someone can tell me what I did wrong.

Edited by Falcon22

##### Share on other sites

If you loaded it in a debugger to see why it fails to start it would be helpful in tracking down the error.

What stands out to me:

#1: 00521535 and then 00521536?  You moved 5 bytes to address 00521536.  Why aren’t they showing?  68 FDF04B00      PUSH <some.codecave.Return> should be on 0052153B.  Could be an OllyDbg patching error.

#2: Why the PUSH on 00521536 followed by a RETN?  Without seeing what was originally on 004BF240 this could be correct or wrong, but there is a safe way to not care either way: 00521536    JMP 004BF240.  When you inject code, you replace a part with a JMP, add the replaced part to your jumped-to location, and then JMP back to just after the part you replaced.  This is probably your error.

L. Spiro

##### Share on other sites

Hi,

Dont mind the addresses they are not accurate.

I also tried it once with a JMP to the address after my JMP to the code cave and that also didn't work.

##### Share on other sites

LoadLibrary returns its result in EAX. You're clobbering the register with your injected code. Try PUSHing EAX onto the stack prior to the LoadLibrary call and POPing it back off afterwards.

##### Share on other sites

I believe Windows calling convention allows EAX, ECX and EDX to be used as volatiles (i.e. the called function will not back them up, and the caller must assume they got clobbered and back them up if they need to be preserved).  You should save all three just in case.

##### Share on other sites

@ApochPiQ

Still did the same thing, it just doesnt start. This is what I replaced this time:

004BF1F7                                        00CC             ADD AH,CL
004BF1F9                                        8BC8             MOV ECX,EAX
004BF1FB                                        85C9             TEST ECX,ECX


with this:

004BF1F7                                            E9 38230600      JMP <some.codecave.MyCodeCave>
004BF1FC                                            90               NOP
004BF1FD <codecave.ReturnFromCodeCave>              75 FF            JNZ SHORT some.004BF1FE


and the codecave:

00521534 <codecave.MyCodeCave>                      50               PUSH EAX
00521535                                            68 1B155200      PUSH some.0052151B
0052153F                                            58               POP EAX
00521540                                            90               NOP
00521543                                            8BC8             MOV ECX,EAX
00521545                                            85C9             TEST ECX,ECX
00521547                                            90               NOP
00521548                                           ^E9 B0DCF9FF      JMP <some.codecave.ReturnFromCodeCave>


Edited by Falcon22

##### Share on other sites
Are you increasing the size of the .exe file when you modify it?

##### Share on other sites

No, the size of the modded program is 412,672 bytes and the original also 412,672 bytes..

##### Share on other sites
Are you sure the bottom is actually some sort of executable region of code instead of say, the bss section?

##### Share on other sites

The lines which I refer to as "the bottom" contain this command:

0052151B   0000             ADD BYTE PTR DS:[EAX],AL


• ### Game Developer Survey

We are looking for qualified game developers to participate in a 10-minute online survey. Qualified participants will be offered a \$15 incentive for your time and insights. Click here to start!

• 11
• 15
• 21
• 26
• 11