How do I get a programs windows from an injected DLL?

Question

I've injected a DLL into a program to implement a chat UI over the applications main window. I figured I can get the applications main window handle, then get it's DC, and draw onto it. The window has a predictable title, which means I can use FindWindow to get the handle. The only problem is, the DLL is injected when the process starts. At that time, the window hasn't been created. Which means FindWindow finds nothing!

What are some solutions to this? Could I create a thread in the DLL and sleep for a while until I know the window is created? This seems very unstable so I'd rather not do it.

What I tried to do was use SetWindowsHookEx in the DLL to hook the global WndProc. I could scan the messages until I find one from my window (which means it was created). Then I could save the handle and go on with my program. I'm not too worried about there being multiple windows with the same name at the time. The only problem is that my hook never gets called.

I create the hook like this:

m_hWndProcHook = SetWindowsHookEx(WH_CALLWNDPROC, (HOOKPROC)WndProc, m_hModule, 0);
if(!m_hWndProcHook)
{
    oss << "Failed to set wndproc hook. Error code: " << GetLastError();
    Log(oss.str().c_str());
    return false;
} 

Which returns a valid hook. The WndProc look like this:

LRESULT CALLBACK CChatLibrary::WndProc(int code, WPARAM wParam, LPARAM lParam)
{
    CWPSTRUCT* pData;
    ostringstream oss;
    char wndName[256];

    gChatLib->Log("WNDPROC");

    if(code < 0)
        return CallNextHookEx(gChatLib->GetWndProcHookHandle(), code, wParam, lParam);
    else
    {
        //Get the data for the wndproc
        pData = (CWPSTRUCT*)lParam;

        //Log the message
        GetWindowText(pData->hwnd, wndName, 256);
        oss << "Message from window \"" << wndName << "\"";
        gChatLib->Log(oss.str().c_str());

        return CallNextHookEx(gChatLib->GetWndProcHookHandle(), code, wParam, lParam);
    }
}

But no "WNDPROC" messages are logged into my log file... Earlier, I had a MessageBox instead of a log to see if it worked, which turned out to be a terrible idea. All the programs froze because they were waiting for me to click "OK", and I had to do a hard reset... When I turned my computer back on and replaced the MessageBox with a log command, it didn't work. I know my log works, though, because it works everywhere else. I'm extremely confused with whats happening with this.

Are there any other methods of obtaining the main window (preferably when it is created)? Or is my hook method good, but just executed wrong? Thank you for any feedback.

Answer 1

You can always inject the DLL when application has already started. It's quite complicated nowadays because of ASLR in Windows Vista/7, but not impossible. You would have to write a short application which would inject selected DLL into the process with given PID. Here is what should be done in order to inject DLL into the running process:

Write a shellcode which would find address of the kernel32.dll library. Here is my old code in NASM:

[BITS 32]

_main:
    xor     eax,    eax
    mov     esi,    [FS:eax+0x30]   ; ESI points at PEB
    mov     esi,    [esi+0x0C]  ; ESI points at PEB->Ldr
    mov     esi,    [esi+0x1C]  ; ESI points at PEB->Ldr.InInitOrder
    mov     edx,    -1          ; EDX is now the current letter pointer

check_dll:
    mov     ebp,    [esi+0x08]  ; EBP points at base address InInitOrder[i]
    mov     edi,    [esi+0x20]  ; EDI points at InInitOrder[X] name
    mov     esi,    [esi]       ; ESI points at flink
    mov     edx,    -1      ; set letter pointer at InInitOrder name
    mov     ebx,    0       ; set pattern letter pointer to null

check_small_name:
    inc     edx             ; go to the next letter in InInitOrder name
    cmp     ebx,    0x7     ; check if we have checked all letters
    je      library_found       ; if so and no error kernel32.dll found
    mov     al, BYTE[edi+edx]   ; load byte to EAX from InInitOrder name
    cmp     al,     0x0 ; check if unicode complement
    je      check_small_name    ; ignore if so
    jmp     s_kernel32

back1:
    pop     ecx
    cmp     BYTE[ecx+ebx],  al  ; compare characters
    jne     check_big_name      ; if not equal check upper size
    inc     ebx         ; if equal then go to the next letter in pattern
    jmp     check_small_name    ; loop  

check_big_name:
    jmp     b_kernel32

back2:
    pop     ecx
    cmp     BYTE[ecx+ebx],  al  ; check characters
    jne     check_dll       ; if not equal then go to the next module
    inc     ebx         ; if equal go increment the pattern pointer
    jmp     check_small_name    ; loop

library_found:
    mov     eax,    ebp         ; move kernel32 base address into ECX

loop:
    jmp loop    

s_kernel32:
    call    back1
    db      "kernel32",10,0 

b_kernel32:
    call    back2
    db      "KERNEL32",10,0

1. Load compiled shellcode into memory from file.
2. Attach to the target process as a debugger. Stop all threads in application. Allocate some memory and set 'read, write, execute' permissions and inject shellcode there.
3. Get main thread handle. Open thread, create thread context backup and then set new context with EIP register modified (set to the allocated memory - shellcode - address).
4. Resume threads for some time (e.g. 5 s). Make sure that the process was activated and our shellcode had a chance to execute.
5. Again attach as a debugger to the target process. Read the EAX register which should now store kernel32.dll base address in target process (thanks to the ASLR it might be not the same as in your injector process).
6. Check the offset of LoadLibraryA function in kernel32.dll from your process.
7. The offset should be the same in target process so you have to add remote kernel32.dll base address to the offset in order to compute base address of LoadLibraryA function in the remote process.
8. Call CreateRemoteThread function giving the computed address of LoadLibraryA as a function to call and DLL path as it's parameter.

I had to figure this all on my own some time ago (I couldn't find any description), but recently I found something similiar: http://syprog.blogspot.com/2012/05/createremotethread-bypass-windows.html

Happy hacking!