Rob-- / memoryjs

Read and write process memory in Node.js (Windows API functions exposed via Node bindings)
MIT License
632 stars 86 forks source link

DLL Injection #34

Closed Raphael0010 closed 2 years ago

Raphael0010 commented 5 years ago

Hi, do you have a date for the DLL injection feature ?

Rob-- commented 5 years ago

I've started working on it but run into some issues, as soon as I get them sorted I'll push them and let you know!

Raphael0010 commented 5 years ago

Thank's Rob !

crimson-med commented 5 years ago

@Rob-- Hello just wanted to know if there was any advancements on the DLL Injection as that is the only feature I miss in this library.

Rob-- commented 5 years ago

@crimson-med Hey! Really sorry I’ve been busy with uni coursework, haven’t been able to work on it since the last update. I believe there are other Node addons that allow you to inject DLLs into a process if you want it urgently! As soon as I get time I’ll take a look into it again, sorry!

Sent with GitHawk

crimson-med commented 5 years ago

@Rob-- Thanks a lot for the quick reply

Rob-- commented 2 years ago

This has been implemented (commit), example:

// inject dll
memoryjs.injectDll(processHandle, dllPath, (error, success) => console.log(error, success));

// unload dll (either with module name `module.szModule` or base address `module.modBaseAddr`)
memoryjs.unloadDll(processHandle, moduleNameOrBaseAddress, (error, success) => {
  console.log(error, success);
);

I've tested loading/unloading 32 bit and 64 bit DLLs in their respective target platform processes with no problems. Will leave some time before publishing to NPM incase there any comments about the functionality or implementation.

You can inject a DLL by passing the path to the file, and you can unload either by the name of the module (e.g. TestDLL.dll) or by passing the base address of the module (retrieved either through getModules and filtering by szModule or by using findModule , and then passing the module's modBaseAddr). Examples here.

It's important to note LoadLibrary increments the reference count to the module and FreeLibrary decrements the count. So it won't necessarily re-load the module, but if you call memoryjs.injectDll(pHandle, 'C:\\TestDLL.dll') twice for example, calling memoryjs.unloadDll(pHandle, 'TestDLL.dll') once will not suffice to unload the module from the process, you will need to call it until the reference count of the module is zero.

Relevant LoadLibrary docs: The system maintains a per-process reference count on all loaded modules. Calling LoadLibrary increments the reference count. Calling the FreeLibrary or FreeLibraryAndExitThread function decrements the reference count. The system unloads a module when its reference count reaches zero or when the process terminates (regardless of the reference count).

Relevant FreeLibrary docs: Frees the loaded dynamic-link library (DLL) module and, if necessary, decrements its reference count. When the reference count reaches zero, the module is unloaded from the address space of the calling process and the handle is no longer valid.