Injects a DLL into the process memory. @warning: Setting C{bWait} to C{True} when the process is frozen by a debug event will cause a deadlock in your debugger. @warning: This involves allocating memory in the target process. This is how the freeing
(self, dllname, procname=None, lpParameter=0, bWait=True, dwTimeout=None)
| 3500 | # when the DLL can't be loaded or the procedure can't be found. |
| 3501 | # On error the shellcode should execute an int3 instruction. |
| 3502 | def inject_dll(self, dllname, procname=None, lpParameter=0, bWait=True, dwTimeout=None): |
| 3503 | """ |
| 3504 | Injects a DLL into the process memory. |
| 3505 | |
| 3506 | @warning: Setting C{bWait} to C{True} when the process is frozen by a |
| 3507 | debug event will cause a deadlock in your debugger. |
| 3508 | |
| 3509 | @warning: This involves allocating memory in the target process. |
| 3510 | This is how the freeing of this memory is handled: |
| 3511 | |
| 3512 | - If the C{bWait} flag is set to C{True} the memory will be freed |
| 3513 | automatically before returning from this method. |
| 3514 | - If the C{bWait} flag is set to C{False}, the memory address is |
| 3515 | set as the L{Thread.pInjectedMemory} property of the returned |
| 3516 | thread object. |
| 3517 | - L{Debug} objects free L{Thread.pInjectedMemory} automatically |
| 3518 | both when it detaches from a process and when the injected |
| 3519 | thread finishes its execution. |
| 3520 | - The {Thread.kill} method also frees L{Thread.pInjectedMemory} |
| 3521 | automatically, even if you're not attached to the process. |
| 3522 | |
| 3523 | You could still be leaking memory if not careful. For example, if |
| 3524 | you inject a dll into a process you're not attached to, you don't |
| 3525 | wait for the thread's completion and you don't kill it either, the |
| 3526 | memory would be leaked. |
| 3527 | |
| 3528 | @see: L{inject_code} |
| 3529 | |
| 3530 | @type dllname: str |
| 3531 | @param dllname: Name of the DLL module to load. |
| 3532 | |
| 3533 | @type procname: str |
| 3534 | @param procname: (Optional) Procedure to call when the DLL is loaded. |
| 3535 | |
| 3536 | @type lpParameter: int |
| 3537 | @param lpParameter: (Optional) Parameter to the C{procname} procedure. |
| 3538 | |
| 3539 | @type bWait: bool |
| 3540 | @param bWait: C{True} to wait for the process to finish. |
| 3541 | C{False} to return immediately. |
| 3542 | |
| 3543 | @type dwTimeout: int |
| 3544 | @param dwTimeout: (Optional) Timeout value in milliseconds. |
| 3545 | Ignored if C{bWait} is C{False}. |
| 3546 | |
| 3547 | @rtype: L{Thread} |
| 3548 | @return: Newly created thread object. If C{bWait} is set to C{True} the |
| 3549 | thread will be dead, otherwise it will be alive. |
| 3550 | |
| 3551 | @raise NotImplementedError: The target platform is not supported. |
| 3552 | Currently calling a procedure in the library is only supported in |
| 3553 | the I{i386} architecture. |
| 3554 | |
| 3555 | @raise WindowsError: An exception is raised on error. |
| 3556 | """ |
| 3557 | |
| 3558 | # Resolve kernel32.dll |
| 3559 | aModule = self.get_module_by_name(compat.b("kernel32.dll")) |
no test coverage detected