Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Problems DllMain #135

Closed
luismk opened this issue Jan 14, 2020 · 10 comments
Closed

Problems DllMain #135

luismk opened this issue Jan 14, 2020 · 10 comments

Comments

@luismk
Copy link

luismk commented Jan 14, 2020

I'm trying to implement
this is all in C ++ for C #
https://github.com/luismk/ProjectG/blob/master/ProjectG/Main.cpp
I've done 98% of the codes, but main dll doesn't work
I've tried everything, but for some reason I can't
maybe i'm doing it wrong
the point is not affected at all
I even put a dump code if the method was called by the executable

Could someone give me a light?

image

@3F
Copy link
Owner

3F commented Jan 14, 2020

@luismk
I'm not sure what are you trying, but just to be sure DllMain is not supported and we don't have the urgent plans to support this soon (at least by me).

Please use P/Invoke export functions instead.
Or Please clarify your problem.

@luismk
Copy link
Author

luismk commented Jan 14, 2020

what I am trying to do is edit an application's memory while it is running
when arriving at DLLMAIN attach would go through the memory editing method
Is there any other point I can use instead of DLLMAIN?

@3F
Copy link
Owner

3F commented Jan 14, 2020

LoadLibrary + GetProcAddress:
https://github.com/3F/DllExport/wiki/Examples

I am trying to do is edit an application's memory while it is running

WriteProcessMemory ? or maybe this https://github.com/3F/Conari ?

@marcussacana
Copy link

marcussacana commented Jan 31, 2020

Is very, but very idiot, but keeping in mind that the program that you will load the dll is yours, you can hook the LoadLibrary and manually call a certain dll export of your dll;
If isn't your program, well, I think you can forget about implement the DLLMain in your C# program; because you will need do reverse engineering to replace the DLLMain functionality and we know that this is not very cool...
If you only want a function to be called in your dll automatically, I think you can do a dll wrapper to any library of your target program, like the d3d9.dll; dinput8.dll and etc, then when your program use the dll he will call your library.
The dll unload event can be 'emulated' using hooks too, maybe hook the ExitProcess for example

@gitlsl
Copy link

gitlsl commented Feb 2, 2020

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

@3F
I think they want to implement DllMain by c# or give a hook when the dll is attach/detach

@3F
Copy link
Owner

3F commented Feb 2, 2020

@gitlsl,

That's I said above.
Currently, only IMAGE_EXPORT_DIRECTORY related records.

I have some ideas, but more likely I will consider this task only within the new project as I already voiced in other threads.

@luismk
Copy link
Author

luismk commented Feb 3, 2020

@marcussacana suggesting a library extension? I have the same dll in another C / C ++ language
but as I deal better with Csharp I found it easier to implement it again,
as @gitlsl suggested the main dll should be accepted in C #
it would make life easier, I hope new development update ^^

@gitlsl
Copy link

gitlsl commented Feb 3, 2020

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    return dllmainincsharp(hModule,ul_reason_for_call,lpReserved);
    
}

can we do some shellcode make the unmanaged dllmain code like above ,
then export a dllmainincsharp in c#?

@3F
Copy link
Owner

3F commented Apr 19, 2020

@gitlsl, Read this #45 (comment)

@3F
Copy link
Owner

3F commented Apr 19, 2020

I close this issue as duplicate of #5 since this is finally about supporting the DllMain entry point. Please continue there and follow the news.

@3F 3F closed this as completed Apr 19, 2020
@3F 3F added the duplicate label Apr 19, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants