C# .NET Dll Injector

[adaephon]

This is a Dll Injector I have been working on as part of my personal projects. It's entirely written in C# .NET (excepting the Dll to be injected - but the one included is just for demonstration) using pinvokes obviously.

It injects a dll into a target process using the CreateRemoteThread / LoadLibrary method. I've also added the functionality to call exports from the injected Dll. Credits go to Cypher for the idea behind how to find the address of the exported function, by loading module into this process as data and finding address locally, then calculating etc. .Net implementation is rather different than his code in post here: [Only registered and activated users can see links. ]

The ThreadFunc called by CreateRemoteThread can take one parameter. I've added the ability to call an export and pass it a parameter as well (rather than just calling an export with no parameters). It only supports structs (C# value types like int, short, char etc or structs such as struct MyStruct). I wrote some custom marshalling code to deal with structs containing variable length strings as well (string members need to be decorated with CustomMarshalAsAttribute).

The injector should work on x64 or x86 platforms. It's been tested to work on XP x86, Win 7 x64 as x86 and x64 and Vista x86 (not tested very thoroughly). If UAC is turned on I think it causes some problems, haven't tested that yet. On an x64 machine, compiling the launcher/tester program as Any Cpu will make it an x64 injector - it can only inject into x64 processes, and only inject x64 dlls. Compile as x86 to make it a 32bit injector. The included demo Stub.dll is x86 compiled.

Comments, criticisms, whatever are appreciated. Source code here: [Only registered and activated users can see links. ]

[flo8464]

Hmm, nobody is responding.
So I ll do, thanks for sharing and take my rep

[adaephon]

Thanks, I'm going to update it in the next day or so with a platform independent one, assuming I can get it working.