Injecting .NET 4.0 Library into unmanaged App, Unending loop in clr.dll

Question

I am trying to inject a .net library into a managed app, but it didn't seem to work after some debugging with ollydbg i found it to be looping infinitely. If i forcefully exit the loop it all works. I have created a work around (See code below) but i doubt this is the way it should be!

The loop start when executing: hr = pClrHost->Start();

Injector code

    static void Main(string[] args)
    {
        //Has to be 32Bit app, not sure why yet, x86 should work in x64 apps
        Process np = Process.GetProcessesByName("notepad")[0];

        string dllpath = @"c:\Loader.dll";
        string corepath = string.Format("{0}\\{1}", Environment.GetFolderPath(Environment.SpecialFolder.System), "mscoree.dll");

        if (!File.Exists(corepath))
        {
            //No .NET
        }

        //Open Process for write access
        IntPtr PID = OpenProcess(PROCESS_ALL_ACCESS, false, np.Id);

        //Allocate memory
        IntPtr addr = (IntPtr)VirtualAllocEx(PID, IntPtr.Zero, (uint)dllpath.Length + 1, 0x1000, 4);
        if (addr == IntPtr.Zero)
        {
            //return false;
        }

        //Write DLL path into process memory
        int wrote = WriteProcessMemory(PID, addr, System.Text.Encoding.ASCII.GetBytes(dllpath), (uint)dllpath.Length +1, IntPtr.Zero);
        IntPtr hRemoteThread = IntPtr.Zero;

        uint temp;
        //Start new thread @ LoadLibraryA with path to library as parameter
        hRemoteThread = CreateRemoteThread(PID, IntPtr.Zero, 0, (IntPtr)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA"), addr, 0, out temp);

        if (hRemoteThread == IntPtr.Zero)
        {
            //return false;
        }

        System.Threading.Thread.Sleep(1000);

        //**WORK AROUND**
        //Force loop to exit, Will cause the messagebox to show up
        wrote = WriteProcessMemory(PID, (IntPtr)0x6D8EC91A, new byte[1]{ 0xEB}, (uint)1, IntPtr.Zero);

        //Clean up
        VirtualFreeEx(PID, addr, (uint)dllpath.Length + 1, FreeType.Release);

        //return true;
    }

C++ .Net Loader code

#pragma comment(lib,"MSCorEE.lib") 

#include <mscoree.h>
#include <metahost.h>

ICLRRuntimeHost* pClrHost = NULL;

int WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
switch(dwReason)
{
    case DLL_PROCESS_ATTACH:
        {
                // Get the policy object, so we can determine which runtime to use.
                    ICLRMetaHostPolicy* pMetaHostPolicy     = NULL;
                    HRESULT hr = CLRCreateInstance(CLSID_CLRMetaHostPolicy, IID_ICLRMetaHostPolicy, (LPVOID*)&pMetaHostPolicy);

                    if (FAILED(hr))
                    {
                        MessageBox(NULL, L"Could not create a ICLRMetaHostPolicy object!", L"Injection - Error", MB_OK);
                        return 1;
                    }

                    ICLRRuntimeInfo* pRuntimeInfo = NULL;
                    // Get the runtime info object. Allow the assembly to tell US what runtime to use.
                    DWORD pcchVersion = 0;
                    DWORD dwConfigFlags = 0;
                    hr = pMetaHostPolicy->GetRequestedRuntime(METAHOST_POLICY_HIGHCOMPAT, 
                                                                L"C:\\Test.dll", NULL,
                                                                NULL, &pcchVersion,
                                                                NULL, NULL, &dwConfigFlags,
                                                                IID_ICLRRuntimeInfo,
                                                                (LPVOID*)&pRuntimeInfo);

                    if (FAILED(hr))
                    {
                        MessageBox(NULL, L"Could not create an ICLRRuntimeInfo object.", L"Injection - Error", MB_OK);
                        return 1;
                    }

                    // Allow the runtime to load .NET 2.0 mixed-mode libraries. (This covers 2.0-3.5 SP1)
                    hr = pRuntimeInfo->BindAsLegacyV2Runtime();

                    if (FAILED(hr))
                    {
                        MessageBox(NULL, L"Could not bind as legacy v2 runtime.", L"Injection - Error", MB_OK);
                        return 1;
                    }

                    hr = pRuntimeInfo->GetInterface(CLSID_CLRRuntimeHost, IID_ICLRRuntimeHost, (LPVOID*)&pClrHost);

                    if (FAILED(hr))
                    {
                        MessageBox(NULL, L"Could not get an instance of ICLRRuntimeHost!", L"Injection - Error", MB_OK);
                        return 1;
                    }

                    hr = pClrHost->Start();

                    if (FAILED(hr))
                    {
                        MessageBox(NULL, L"Failed to start the CLR!", L"Injection - Error", MB_OK);
                        return 1;
                    }

                    DWORD dwRet = 0;
                    // Execute the Main func in the domain manager, this will block indefinitely.
                    // (Hence why we're in our own thread!)
                    hr = pClrHost->ExecuteInDefaultAppDomain(
                                                L"C:\\Test.dll",    // Executable path
                                                L"Test.bc",
                                                L"InjectedMain",
                                                L"Hello World!",
                                                &dwRet);

                    if (FAILED(hr))
                    {
                        MessageBox(NULL, L"Failed to execute in the default app domain!", L"Injection - Error", MB_OK);
                        return 1;
                    }
        }
    break;

    case DLL_THREAD_ATTACH:  break;
    case DLL_THREAD_DETACH:  break;
    case DLL_PROCESS_DETACH: break;
}
//FreeLibraryAndExitThread(hInstance, 0);
return true;
}

.Net Test Code

public class bc
{
    public static int InjectedMain(string args)
    {
        try
        {
            MessageBox.Show(args);
        }
        catch (Exception ex)
        {
            Debug.WriteLine(ex);
        }
        return 0;
    }
}

Image of said loop in a debugger

This cannot work, google ".net loader lock" – Hans Passant Sep 12 '11 at 16:02 — Hans Passant, Sep 12 '11 at 16:02

score 2 · Answer 1 · answered Sep 12 '11 at 23:40

2

Solution:

Remove DllMain, It has restrictions. Move code to exported function. Load the library then call the exported function.

answered Sep 12 '11 at 23:40

user940602

73
4

Yahia · Answer 2 · 2011-09-12T16:01:38.867

Not sure since the scenario you describe is to say the least "somehow unusual" but I suspect the solution lies somewhere in the following possibilities/options:

Try "playing" with the settings via SetDefaultStartupFlags
STARTUP_DISABLE_COMMITTHREADSTACK looks very promising to me since the loop seems to do something with stacks and threads...
IF nothing helps implement the DLL as a COM component which in turn hosts the CLR

Injecting .NET 4.0 Library into unmanaged App, Unending loop in clr.dll

2 Answers2