dll-syringe
dll-syringe copied to clipboard
OpenByteDev
Why is it not supported for 32-bit programs to call 64-bit target processes.
It should be possible to do it, as there are also some other injectors that support it, but i have not looked into how they do it.
To extend the current implementation as is, there are some problems:
EnumProcessModulesExdoes not support iterating x64 modules from an x32 (wow64) process. (Currently used to get addresses of win32 API functions in target process and to confirm that the injection succeeded)CreateRemoteThreadwill truncate arguments and return value when doing x32->x64.- maybe others
You can refer to the implementation of yapi, which supports injection of 32-bit processes into 64-bit processes under C++.
Confirm whether the injection is successful can be determined by remote LoadLibrary,
- EnumProcessModulesEx the yapi method can call this function under 32 bits.
- CreateRemoteThread the parameter problem can be done in assembly form. The assembly parameters under 64-bit are very fixed, and you only need to write the registers as they are.
EnumProcessModulesEx can be called but will not return x64 modules (see the remarks section). I dont follow with what you are suggesting for CreateRemoteThread.
This problem of EnumProcessModulesEx can be easily solved.
One way is to call NtQueryInformationProcess through wow64, and the other way is to directly call NtWow64QueryInformationProcess64.
For related codes, please refer to https://www.52pojie.cn/forum.php?mod=viewthread&tid=872501 and https://stackoverflow.com/questions/3801517/how-to-enum-modules-in-a-64bit -process-from-a-32bit-wow-process?answertab=trending#tab-top
I just want to mention that while I may implement this, I will not work on it in the near future.
I rewrote listing processes and modules using ntdll in https://github.com/OpenByteDev/processes/commit/31435c769fbf2856a45c2c4a1426bf67b4dd4139 but without using the WoW64 methods.