Can pipeline be used in sharing Dll in different process?

Question

Hello all, Before I get into to my question,let me explain what I am exactly doing.I have a main Process say ProcessA,I have hooked ProcessA and also injected dll(say myDll.dll) into the process space of ProcessA.Now at one point ProcessA kicks on another process which is ProcessB.Both the process A and B are in totally different Process memory space.I want to share the myDll.dll(which is inserted in processA sapce) in ProcessB(actually ProcessB's processSpace).Can it be done using pipe line method or any other suitable method. thanks in advance.

Answer 1

The code of DLL will be automatically shared by different processes. For optimization only you should choose a good base address of the DLL (see http://msdn.microsoft.com/en-US/library/f7f5138s.aspx).

To share data between processes you can for example use Shared Memory objects or just place some variables which you need to share to a section which you mark as shared (see http://support.microsoft.com/kb/100634 and http://msdn.microsoft.com/en-us/library/h90dkhs0.aspx for details). To mark section ".SHAREDSECTIONNAME" as shared you can use

#pragma comment(linker, "/section:.SHAREDSECTIONNAME,RWS")

To have no conflicts in writing/reading from the shared memory you should use a named Event or Mutex exactly like in all other cases of multiprocess communication.

UPDATED based on the comment: If you create the child process yourself you receive the handle to the child process with full rights. So you have enough rights to make DLL infection with respect of CreateRemoteThread API. Here is a working code in C which start CMD.EXE and inject a MyTest.dll in the address space:

#include <Windows.h>

int main()
{
    STARTUPINFO si = { sizeof(STARTUPINFO) };
    PROCESS_INFORMATION pi = {0};
    TCHAR szCommandLine[4096] = TEXT("CMD.EXE");
    BOOL bIsSuccess;
    DWORD dwStatus;
    LPCTSTR pszLibFile = TEXT("C:\\Oleg\\MyTest\\Release\\MyTest.dll");
    PTSTR pszLibFileRemote = NULL;
    HANDLE hThread = NULL;
    int cb;
    HMODULE hModule = NULL;

    bIsSuccess = CreateProcess (NULL, szCommandLine, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);

    // Calculate the number of bytes needed for the DLL's pathname
    cb  = (1 + lstrlen(pszLibFile)) * sizeof(TCHAR);

    __try {
        PTHREAD_START_ROUTINE pfnThreadRtn;

        // Allocate space in the remote process for the pathname
        pszLibFileRemote = (PTSTR) VirtualAllocEx (pi.hProcess, NULL, cb, MEM_COMMIT, PAGE_READWRITE);
        if (pszLibFileRemote == NULL) __leave;  // error

        // Copy the DLL's pathname to the remote process's address space
        if (!WriteProcessMemory (pi.hProcess, pszLibFileRemote, (PVOID) pszLibFile, cb, NULL)) __leave;

        // Get the real address of LoadLibraryW in Kernel32.dll
        // Real address of Kernel32.dll in dwProcessId and in our Process MUST be the same !!!
        // Remote Process MUST have Kernel32.dll loaded (SMSSS.EXE and System havn't)!!!
#ifdef UNICODE
        pfnThreadRtn = (PTHREAD_START_ROUTINE) GetProcAddress (GetModuleHandle(TEXT("Kernel32")), "LoadLibraryW");
#else
        pfnThreadRtn = (PTHREAD_START_ROUTINE) GetProcAddress (GetModuleHandle(TEXT("Kernel32")), "LoadLibraryA");
#endif
        if (pfnThreadRtn == NULL) __leave;

        // Create a remote thread that calls LoadLibraryW(DLLPathname)
        hThread = CreateRemoteThread (pi.hProcess, NULL, 0, pfnThreadRtn, (LPVOID)pszLibFileRemote, 0, NULL);
        if (hThread == NULL) __leave;

        dwStatus = ResumeThread (pi.hThread);

        // Wait for the remote thread to terminate
        if (WaitForSingleObject (hThread, INFINITE) != WAIT_OBJECT_0) __leave;

        GetExitCodeThread (hThread, (PDWORD)&hModule);

        // hModule is the address in the destination process (CMD.EXE)
        // of the injected DLL
        // You can verify that it is really loaded for example with respect of 
        // Process Explorer (http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx)
    }
    __finally {
        // Free the remote memory that contained the DLL's pathname
        if (pszLibFileRemote != NULL)
            bIsSuccess = VirtualFreeEx (pi.hProcess, pszLibFileRemote, 0, MEM_RELEASE);

        if (hThread != NULL)
            bIsSuccess = CloseHandle (hThread);

        if (pi.hProcess != NULL)
            bIsSuccess = CloseHandle (pi.hProcess);

        if (pi.hThread != NULL)
            bIsSuccess = CloseHandle (pi.hThread);
    }

    return 0;
}