Page 1 of 1

DLL injection plugin

Posted: Sun Mar 23, 2008 10:24 am
by Administrator
This plugin lets you inject a DLL into a running process, or start a program and inject the code. Which injection method you use depends totally upon your preference or effectiveness (HINT: starting with dll injection will probably work better by injecting a DLL before GameGuard/XTrap can even load). To use the injector plugin, download the attachment, extract injector.dll, and put it into the micromacro/plugins/ folder.

There are two functions registered by this plugin: inject() and startWithDll(). Both functions return true on success, false on failure.

For our examples, we will assume that the DLL we wish to inject is named injectme.dll and is in the micromacro/data folder. The program we wish to launch will be game.exe inside of C:/Game/, and has a window title "Game v1.0".

bool,string inject(window, dll)
Injects into a running process. 'window' should be an HWND, found by using findWindow or similar functions. 'dll' should be the full path to the DLL (Dynamic Link Library) you wish to inject into that process. On error, this function also returns a second value that contains an error string.

Example:

Code: Select all

  local success,msg = inject(findWindow("Game v*"), getPath() .. "/data/injectme.dll");
  if( success == false ) then
    printf("Injecting injectme.dll into Game has failed: %s\n", msg);
  end

bool,string startWithDll(dll, target [, command])
Starts 'target' with command line 'command' and injects 'dll' into it at start. 'dll' and 'target' should be the full path (again, use getPath() if relative to MicroMacro's root directory). Specifying 'command' is optional, and should only be used if the application you are injecting into requires certain command line parameters (see below for more information). On error, this function also returns a second value that contains an error string.

Example (basic):

Code: Select all

  local success,msg = startWithDll(getPath() .. "/data/injectme.dll", "C:/Game/game.exe");
  if( success == false ) then
    printf("Injecting injectme.dll into Game has failed: %s\n", msg);
  end
If the program requires command line parameters, you should specify them in 'command'. You must, however, use the FULL command! This means including "game.exe" in the command as the first parameter. Shaiya, for example, requires you to pass "start game" in order to start it's main executable (game.exe) directly. See the example if this confuses you.

Example (command line):

Code: Select all

  local success = startWithDll(getPath() .. "/data/injectme.dll", "C:/Game/game.exe", "game.exe start game");
  if( success == false ) then
    printf("Injecting injectme.dll into Game has failed.\n");
  end

Re: DLL injection plugin

Posted: Sun Mar 23, 2008 4:09 pm
by Isaac
So, we can use this to try to bypass the xtrap for FiestaOnline?

Re: DLL injection plugin

Posted: Sun Mar 23, 2008 8:01 pm
by Administrator
Well, you can use this to inject a DLL before XTrap loads. I used this to inject a DLL which hooked LoadLibraryA, and prevented Fiesta from loading XTrapVa.dll. This resulted in Fiesta randomly closing whenever it felt like it.

Re: DLL injection plugin

Posted: Sun Dec 14, 2008 10:10 pm
by Administrator
I've completely rewrote the plugin to make it smaller and simpler. It went from 82kb compressed to 4.5kb. It should even work better, too. Version 1 has been left available in case the new version doesn't work for you. Please let me know if you have problems.

Re: DLL injection plugin

Posted: Mon Dec 15, 2008 9:08 am
by 3cmSailorfuku
Does anyone know of a msn dll & function to send messages to emails or change your PSM? :|

Re: DLL injection plugin

Posted: Mon Dec 15, 2008 9:21 am
by Administrator
Have you looked at CEMAPI? I don't know which functions would be of interest to you (as I've never used it myself), but it sounds like it has the ability to send e-mail.

Re: DLL injection plugin

Posted: Tue Dec 16, 2008 11:38 am
by 3cmSailorfuku
Administrator wrote:Have you looked at CEMAPI? I don't know which functions would be of interest to you (as I've never used it myself), but it sounds like it has the ability to send e-mail.
I was thinking more of instant messages to emails, using the msn messenger protocol.

Re: DLL injection plugin

Posted: Tue Dec 16, 2008 6:34 pm
by Administrator
I have no idea. I'm not even sure how that works (since I do not use MSN messenger). If it's just like sending instant messages, then you can hook Winsock send() and send your own packets to reproduce the message. You'll have to start by logging what gets passed to send() so that you know how to format your message.

Re: DLL injection plugin

Posted: Wed Dec 17, 2008 7:45 pm
by 3cmSailorfuku
Administrator wrote:I have no idea. I'm not even sure how that works (since I do not use MSN messenger). If it's just like sending instant messages, then you can hook Winsock send() and send your own packets to reproduce the message. You'll have to start by logging what gets passed to send() so that you know how to format your message.
I was wrong, I can change the struct at 0x4A for the name and have to send messages with the regular PostMessage function like you do.
I just looked into some plugins, and they were using basic functions like that... So I was wrong that it was managed normally via an dll.

What I do is basically getting the handle of a conversation window with the api class MsgrConversationWndPlugin, and send Messages with PostMessage to it.
Works good but somehow useless, except if you want to show everyone how badass fast you level even if they dont wanna see it :D

Re: DLL injection plugin

Posted: Sat May 02, 2009 3:42 am
by Administrator
Fixed a critical error in startWithDll() that would sometimes prevent the process from starting. Both inject() and startWithDll() now also return a second value if an error occurs: a string containing the error message.

Re: DLL injection plugin

Posted: Thu Jan 07, 2010 7:34 pm
by ime
how would I access a exported/external function in a DLL after injecting it with micromacro? Would the function become accessable just like a .lua function?

Re: DLL injection plugin

Posted: Thu Jan 07, 2010 9:49 pm
by Administrator
ime wrote:how would I access a exported/external function in a DLL after injecting it with micromacro? Would the function become accessable just like a .lua function?
No, you would need to create an additional plugin that would send a message that is caught by the injected DLL to trigger that function. There will be stuff added in the future to simplify this process.

Re: DLL injection plugin

Posted: Thu Jan 07, 2010 9:57 pm
by ime
ty admin, is it possible for the DLL to send data to micromacro through the network function, or would it just be easier for the DLL to stick the information in memory for micromacro to continuously read?

Re: DLL injection plugin

Posted: Thu Jan 07, 2010 10:04 pm
by Administrator
If you use libnet for your plugin, you could use network functions to communicate between the two. When the IPC code is finished, this is pretty much what will happen (except it will not rely on libnet).

Re: DLL injection plugin

Posted: Thu Jan 07, 2010 10:29 pm
by ime
kk will look into it, thanks for the help admin :)

Re: DLL injection plugin

Posted: Sat Nov 19, 2011 12:05 pm
by dx876234
Hey, I'm looking into the .dll insertion, trying to insert a Lua function into RoM, after some research I've made a valid Lua module (.dll) which loads and executes correctly in standalone lua.

Trying to insert it into RoM by using your examples works, both as injection and startup.

But, the module/function I've made (hello world) isn't available in the RoM Lua interface.

The module is as:

Code: Select all

#include <stdio.h>
#include "lua.h"
#include "lauxlib.h"
#define PROJECT_TABLENAME "myhello"

int LUA_API luaopen_myhello (lua_State *L);

static int helloworld (lua_State *L) {
	printf("hello world!\n");
	return 0;
}

int LUA_API luaopen_rwMemory (lua_State *L) {
	struct luaL_reg driver[] = {
		{"helloworld", helloworld},		
		{NULL, NULL},
	};
	luaL_openlib (L, "rwMemory", driver, 0);
	return 1;
}
Its built in MinGW as:

Code: Select all

gcc -I "\Program Files (x86)\Lua\5.1\include" -O2 -c -o rwMemory.o rwMemory.c
gcc -O -shared -o rwMemory.dll rwMemory.o -L "c:\Program Files (x86)\Lua\5.1\lib" -llua51
Testing it in Lua with the following works as planned:

Code: Select all

require("rwMemory")
rwMemory.helloworld() 
And injected by one of:
local success = startWithDll(getPath() .. "/data/rwMemory.dll", "C:\\Program Files (x86)\\Runes of Magic\\Client.exe", "Client.exe");
if( success == false ) then
printf("Injecting rwMemory.dll into Game has failed.\n");
end
local success,msg = inject(findWindow("Runes of Magic"), getPath() .. "/data/rwMemory.dll");
if( success == false ) then
printf("Injecting rwMemory.dll into Game has failed: %s\n", msg);
end
No error messages at all but I don't seem to be able to call the "rwMemory.helloworld()" function.

Am I think wrong and this isn't possible or am I just missing some step?

regards
DX

Re: DLL injection plugin

Posted: Sat Nov 19, 2011 7:42 pm
by Administrator
It might have to do with the way the game registers the functions. I'm pretty sure you would have to locate the function to register Lua functions within the process (should just be able to GetProcAddress), and call them. See, when you use 'require', it will load the DLL and find those functions for you. When you inject a DLL, it loads it into the process's memory space and calls the DllMain, but cannot make any assumptions about how it will be used.

Re: DLL injection plugin

Posted: Tue Apr 16, 2013 1:12 pm
by zwyklykowalski
hello can u add DLL injection plugin for MicroMacro 1.03?? :D

tx

Re: DLL injection plugin

Posted: Tue Apr 16, 2013 1:49 pm
by Administrator
No problem. I've recompiled for Lua 5.2 and attached the compiled DLL. Just drop it into your plugins directory and overwrite the one you have.

Re: DLL injection plugin

Posted: Tue Apr 16, 2013 3:06 pm
by zwyklykowalski
tx very much