Simple DLL injection does not work using AppInit_DLL. DllMain () does not receive a call

Question

I wrote the simplest injection dll. Here is the complete code:

#include "stdafx.h" #include <stdio.h> BOOL APIENTRY DllMain(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { FILE * File = fopen("D:\\test.txt", "w"); if(File != NULL) { fclose(File); } return TRUE; } 

Super just right? Well, I can't even get this to work. This code compiles in the dll, and I put the path to this DLL into the registry under the [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Windows \ AppInit_DLLs] section. I should also note that the LoadAppInit_DLLs registry value is set to 1. From this, I expect to see the file "D: \ test.txt" that appears when other applications are launched (for example, notepad.exe), but it is not. I do not understand. There is another .dll that is very old and written in the visual studio '97 (which I am trying to replace), which works fine when I install AppInit_DLLs to point to it and run an arbitrary application. I can say that it loads when other applications start up.

I'm not sure what's going on here, but this should work, right? It could not be easier. I use VS 2010, for all accounts, I think I created a very flat Jane.dll, so I don’t think that any project settings should be deleted, but I'm not quite sure about that. What am I missing here?

---

Setup Information

• OS: Windows 7 64-bit
• OS Version: 6.1.7601 Service Pack 1 Build 7601
• IDE: Visual Studio 2010
• IDE Version: 10.0.40219.1 SP1Rel

Answer 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs] NOT the registry key used for injection for 32-bit processes . Its registry key if your OS is 32-bit .

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs] is the correct registry key to use if your OS is 64-bit .

I was on the assumption that the former was for 32-bit processes, and the latter was for 64-bit processes. But in fact, the OS ignores one of these registry keys, depending on whether the OS itself is 64-bit or 32-bit.

Answer 2

@Ultratrunks: This is not entirely correct.

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Windows \ AppInit_DLLs] is designed for both 32 and 64-bit OS.

But if we want to run 32-bit processes on a 64-bit machine, we need to change the following registry key: [HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft \ Windows NT \ CurrentVersion \ Windows \ AppInit_DLLs]

Wow is the concept of creating a 64-bit system for compatibility with 32-bit processes.

I checked it after running my programs on both 32 and 64-bit OS and executed 32-bit processes on a 64-bit machine.

Hence

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Windows \ AppInit_DLL for 32/64 bit OS

HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft \ Windows NT \ CurrentVersion \ Windows \ AppInit_DLLs for 32-bit processes on a 64-bit OS