dll-syringe

A windows dll injection library written in Rust.

Supported scenarios

Usage

Inject & Eject

The example below will inject and then eject injection_payload.dll into a process called "ExampleProcess".

use dll_syringe::{Syringe, process::OwnedProcess};

// find target process by name
let target_process = OwnedProcess::find_first_by_name("ExampleProcess").unwrap();

// create a new syringe for the target process
let syringe = Syringe::for_process(target_process);

// inject the payload into the target process
let injected_payload = syringe.inject("injection_payload.dll").unwrap();

// do something else

// eject the payload from the target (optional)
syringe.eject(injected_payload).unwrap();

Calling Remote Procedures

This example performs the same injection as above, but will call the add function exported from the injected module.

The definition of the exported add function looks like this:

#[no_mangle]
pub extern "system" fn add(numbers: *const (f64, f64), result: *mut f64) {
    unsafe { *result = (*numbers).0 + (*numbers).1 }
}

The code of the injector/caller will look like this:

use dll_syringe::{Syringe, process::OwnedProcess};

// find target process by name
let target_process = OwnedProcess::find_first_by_name("ExampleProcess").unwrap();

// create a new syringe for the target process
let syringe = Syringe::for_process(target_process);

// inject the payload into the target process
let injected_payload = syringe.inject("injection_payload.dll").unwrap();

let result = syringe.get_procedure::<(f64, f64), f64>(injected_payload, "add").unwrap().unwrap().call(&(2.0, 4.0)).unwrap();
println!("{}", result); // prints 6

// eject the payload from the target (optional)
syringe.eject(injected_payload).unwrap();

Note that currently only functions with a signature of extern "system" fn(args: *mut A, result: *mut B) -> () are supported. As the parameters are memcpy'd there can be problems if the injector and payload have different target architectures.

The definition of the exported function above can be simplified using dll-syringe-payload-utils:

dll_syringe_payload_utils::remote_procedure! {
    fn add(a: f64, b: f64) -> f64 {
        a + b
    }
}

License

Licensed under MIT license (LICENSE or http://opensource.org/licenses/MIT)

Attribution

Inspired by Reloaded.Injector from Sewer.