Member Avatar for u8sand

Hey guys,

I was looking at a program that "extended" taskmanager by attaching a dll to the taskmanager's process. I was wondering how this is done and how they were able to add new features and everything. Before you tell me please be aware that I know what a dll is but have never figured out how to program one and how to use it. I also do not know much about windows programming without visual studio (if someone can give me a tutorial on that also). I know plenty of C++ though without all that windows stuff.

Thanks very much.

  • 2 Contributors
  • 2 Replies
  • 254 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by u8sand

Dani AI

Generated

Short primer (adds practical context to and builds on ’s CodeProject pointer):

There are two separate problems: 1) write the DLL (exported entry points, minimal DllMain), and 2) get Windows to load that DLL into another process (DLL injection). Common, supported mechanisms are (a) installing a global Windows hook (system loads your hook DLL into other processes) and (b) remote-thread + LoadLibrary (open the target process, write the DLL path into its memory, CreateRemoteThread to call LoadLibrary). Global hooks are convenient for UI-related work but must match the target process “bitness” and have other constraints. (learn.microsoft.com)

Typical CreateRemoteThread + LoadLibrary workflow (high level):

HANDLE h = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION |
                       PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, pid);
LPVOID mem = VirtualAllocEx(h, NULL, strlen(path)+1, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE);
WriteProcessMemory(h, mem, path, strlen(path)+1, NULL);
auto remoteLoad = (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryA");
HANDLE t = CreateRemoteThread(h, NULL, 0, remoteLoad, mem, 0, NULL);
WaitForSingleObject(t, INFINITE);

Study the CreateRemoteThread docs and error handling before trying this in the wild. (learn.microsoft.com)

Cautions and best practices: global hooks must be in a DLL and avoid heavy work in DllMain — DllMain runs under the loader lock, so don’t call LoadLibrary, create threads, or perform complex initialization there; instead export an Install/Uninstall function and run initialization after load. Also remember 32-bit vs 64-bit mismatch rules. (learn.microsoft.com)

Security, reliability and modern Windows notes: you need the right process access flags (and sometimes SeDebugPrivilege) to open and write into other processes; DEP/ASLR and protected-process/PPL / integrity levels can prevent or complicate injection; AppInit_DLLs is deprecated and unsafe — avoid relying on it. Test on the exact OS and architecture you target and prefer in-process extension (COM, IPC, or an external helper) when possible. (learn.microsoft.com)

Recommended Answers

All 2 Replies

Member Avatar for Ancient Dragon

maybe will help you

Member Avatar for u8sand

That is what i was talking about that attached to the process. But this doesn't explain it much its just source, but I will continue to look into it. If anyone has any other links. Please?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.