danielkrupinski / memject

Simple Dll injector loading from memory. Supports PE header and entry point erasure. Written in C99.

MemJect

Simple dll injector designed to load dll from memory. Supports PE header and entry point erasure. Written in C99.

Features

• load dll from byte array in memory, without storing dll file on disk
• decrypt encrypted dll buffer
• erase DLLEntryPoint
• erase PE header

Getting started

Prerequisites

C99 compiler for Windows is required in order to compile MemJect. Microsoft Visual Studio is required to load solution for easy compilation (MemJect.sln).

Cloning

The very first step in order to compile MemJect is to clone this repo from GitHub to your local computer. Git is required to step futher, if not installed download it here. Open git bash / git cmd / cmd and enter following command:

git clone https://github.com/danielkrupinski/MemJect.git

MemJect folder should have been succesfully created, containing all the source files.

Compiling from source

When you have equiped a copy of source code, next step is opening MemJect.sln in Microsoft Visual Studio. If you don't have Visual Studio, compile MemJect.cpp using your compilator.

Find below line in MemJect.cpp and replace csgo.exe with your destination process name:

#define PROCESS_NAME "csgo.exe"

Find below line in MemJect.cpp and supply your dll in form of byte array there. You can use my python script to convert dll to array of bytes or almost any hex-editor with export to C function.

static const uint8_t binary[] = {
0x4d, 0x5a, 0x80, 0x00, 0x01, ...

Then change build configuration to Release | x86 and simply press Build solution.

If everything went right you should receive MemJect.exe binary file.

Encryption

memject's Issues

win7 still doesn't work!

I changed it to MT, but win7 still doesn't work!

CSGO Crashes once Injecting.

Both the cheat.dll and memject.exe are Compiled in x86.

Crashes and says that it's Successfully Injected in 0x0.

Crash

csgo.exe (or another selected process) crashes when I try to inject the dll using this method, but if I inject the dll using for example Extreme injector (with mmap method selected) it works fine

are this still consider undetected?

hi, can someone answer me regarding about the question? thank you! :D

C++

How to convert this code to C++?

Good with Osiris.

Guys, this code is very good with osiris, there are no problems, and it seems very safe, just a few things that you @danielkrupinski need to improve and update.

question

im kinda new to coding and stuff can you explain me why are you adding 1 to
ntHeaders. Adding 1 to ntHeader is for making sure every byte checks?
https://github.com/danielkrupinski/MemJect/blob/master/MemJect/MemJect.c#L271

Methods injection

@danielkrupinski This injector has Loadlibrary, ManualMap?

Replacement of GetProcAddress.

Hi, man! I kindly ask you to help me figure out how to pass my own (custom) GetProcAdress function in LoaderData structure. Is it possible?

I will be very grateful! Ty!

Here is code of it:

FARPROC __stdcall InternalGetProcAddressP(HMODULE ModuleHandle, LPCSTR ProcessName) 
{
    PIMAGE_DOS_HEADER ImageDosHeader = (PIMAGE_DOS_HEADER)ModuleHandle;
    PIMAGE_NT_HEADERS ImageNtHeader = (PIMAGE_NT_HEADERS)((BYTE*)ModuleHandle + ImageDosHeader->e_lfanew);
    PIMAGE_EXPORT_DIRECTORY ImageExportDirectory = (PIMAGE_EXPORT_DIRECTORY) ((BYTE*)ModuleHandle + ImageNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

    DWORD* AddressOfFunctions = (DWORD*)((BYTE*)ModuleHandle + ImageExportDirectory->AddressOfFunctions);
    WORD* AddressOfNameOrdinals = (WORD*)((BYTE*)ModuleHandle + ImageExportDirectory->AddressOfNameOrdinals);
    DWORD* AddressOfNames = (DWORD*)((BYTE*)ModuleHandle + ImageExportDirectory->AddressOfNames);

    for (DWORD i = 0; i < ImageExportDirectory->NumberOfNames; ++i) {
        if (strcmp(ProcessName, (const char*)ModuleHandle + AddressOfNames[i]) == 0) {
            return (FARPROC)((BYTE*)ModuleHandle + AddressOfFunctions[AddressOfNameOrdinals[i]]);
        }
    }

    return NULL;
}

I replace this fild:
LoaderData.GetProcAdressPointer = (InternalGetProcAddress)InternalGetProcAddressP;
But target application crushes.

okok

good

Just a Question

Help with the script

Hi Daniel, probably this is not the right page to ask help, but, how can i use the script? I can open the solution on VS and i have already downloaded Python but what i need to do before opening the script? If you can send me some imgur screens. Thank you

PE Header Erase

1st Question
There are two Methods which Zero's the Memory, they are both equal but besides the Secure one Zero's the Memory even the Compile Optimization removes the Function. Why don't use the Secure Version?

RtlSecureZeroMemory vs RtlZeroMemory

2nd Question
Is the AddressOfEntryPoint deleted if you Zero the PE Header completly? Or do I have to Zero the AddressOfEntryPoint seperatly?

Memject Decrypt malfunction

Hello @danielkrupinski

The csgo.exe is found but this is not working
process = OpenProcess(PROCESS_VM_WRITE | PROCESS_VM_OPERATION | PROCESS_CREATE_THREAD, FALSE, processInfo.th32ProcessID);

process is 0x0

best regards

Invalid memory access

I got this error when injecting, I'm pretty sure that all av & windows defender is off. And I have no problem using other injector.

win7 system or can not inject

Whether it is installed runtime or set static win7 system or can not inject, I really can not find a solution, can you help me, thank you!

EntryPoint+Erase Header

Just to emphasis. He erase entrypoint+header of the cheat? Or only injector?

unsigned char rawData or hex Data

What it means?

64 bit support?

I'm curious are 64 bit supported? Asking only because getting successful injection message to 64 bit process but in fact dll is not injected. Bytes 100% valid, dll was tested with xenos afterwards

Pomoc

Cześć, zainteresowałem się twoim oprogramowaniem lecz kompletnie nie rozumiem co mam zrobić. Wyjaśnisz to w języku polskim?

dll issue

If i compile the programm with Release | x86 everything is perfectly working and i get this Hello World message box from csgo but if i try to compile it with my own dll converted with https://github.com/danielkrupinski/PE2HEX the game crashes

Encrypting the bytes?

There is an option to decrypt the DLL but how would i encrypt it? I have tried googling methods to encrypt bytes etc but no help tbh

Help

I have the script (PE2HEX) and the DLL, what i need to do?

What is "decryptBinary"?

I was having a look at the code and found "decryptBinary" method. What does it do? Does it decrypt encrypted byte array? If so, how can we encrypt the byte array?

Erasing dll entry point and PE header

Hi! I an not good at programming, just learning how it works and trying modify ur code. I want to find another way to erase dll entry point and PE header. I implemented it like this in "WinMain":

NtWriteVirtualMemory(ProcessHandle, TargetBase, ZeroBuffer, 4096, nullptr);
NtWriteVirtualMemory(ProcessHandle, (BYTE*)TargetBase + ImageOptionalHeader->AddressOfEntryPoint, ZeroBuffer, 32, nullptr);

Is this a correct way?

Also I discovered that I can erase PE header like this in the end of Loader function:

MappingData->DllEntryFunction(MappingData->TargetBase, DLL_PROCESS_ATTACH, nullptr);

MappingData->ModuleHandle = reinterpret_cast<HINSTANCE>(MappingData->TargetBase);

int i = 1024;

unsigned char* ptr = (unsigned char*)MappingData->TargetBase;

while (i-- > 0)         //working
{
	*ptr++ = 0;
}

while (ImageOptionalHeader->SizeOfHeaders-- > 0)        //also working
{
	*ptr++ = 0;
}

unsigned char* ptr = (unsigned char*)MappingData->TargetBase;

int i = ImageOptionalHeader->SizeOfHeaders;
	
while (i-- > 0)                //dont work
{
		*ptr++ = 0;
}

Its just memset implemention. By bruteforce method I found "1024" which erases all page and target working correctly. But sadly I cant understand how its working. When I pass "4096" my target crashes. The same situation with entry point erasing with the same memset method. Do u see the problem?

Then I made this to erase address of entry point:

//TargetBase is PVOID
	register unsigned char* ptr1 = (unsigned char*)(BYTE*)MappingData->TargetBase + ImageOptionalHeader->AddressOfEntryPoint;

	int SizeOfAddressOfEntryPoint = 32;

	while (SizeOfAddressOfEntryPoint-- > 0)
	{
		*ptr1++ = 0;
	}

Program not crushes but how can I check that entry point was erased?

Another question is how to calculate number of bytes to erase in address of dll entry point? Why its "32" size? Unfortunately I not found any information about this.

I will be gratefull for any answer! Thank you!