Memory allocation unsuccessful when Dll injecting into notepad - windows

Question

I am trying to inject a dll I've made into note pad.
I've written the following code where I open a process of notepad and inject it with my dll.
Yet, for some reason, my virtualalloc fails.
Would really appreciate some help on the matter.
Code:
#include <Windows.h>
#include <stdio.h>
int main()
{
char dllPath[125];
DWORD pathLen = GetFullPathNameA("MagshimimFinalProject.dll" ,160 , dllPath, NULL);
PVOID addrLoadLibrary = (PVOID)GetProcAddress(GetModuleHandle("notepad.exe"), "LoadLibraryA"); // maybee we need text instead of the dllpath
HANDLE proc = OpenProcess("PROCESS_CREATE_PROCESS",FALSE, "6340");
PVOID memAddr = (PVOID)VirtualAllocEx(proc, NULL,pathLen,MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (NULL == memAddr)
{
printf("Couldn't allocate memory");
DWORD err = GetLastError();
return 0;
}
HANDLE hRemote = CreateRemoteThread(proc,NULL,0,memAddr, NULL,0,NULL );
if (NULL == hRemote)
{
printf("Couldn't create thread");
DWORD err = GetLastError();
return 0;
}
WaitForSingleObject(hRemote, INFINITE);
BOOL check = CloseHandle(hRemote);
return 0;
}
I've tried looking up all of the functions and making sure they are all getting the right variables, and looking up tutorials on the matter on youtube, but to no avail.
Edit - as the first comment suggested, I've used the debugger to look at each and every line, and when I checked addrLoadLibrary its value was: "identifier "addrLoadLibrary" is undefined" for some reason. any clue why that is?
Edit 2 - firstly, I was checking its value after the line has been completed (value of addrloadlibrary). Secondly, as someone has mentioned, proc is actually the problem for some reason, as its always NULL. Still trying to figure out why is it not working
edit 3 - fixed the problem with proc by removing the quotation marks like some guy in the comments was telling me (sorry for not remembering name, I'm very bad at that.) Now all thats left to figure out is why is addrLoadLibrary undefined even after line
edit 4 - re-read the documentation of the function "getModuleHandle" and relized it should get the dllpath variable. hopefully im not wrong because im not a native english speaker and documentations are especially tough for me to understand.

Answer 1

There are tons of things wrong with this code. Most of the API calls are just plain incorrect. You are not doing very much error checking. You are not copying the DLL path into the memory you allocate before creating the remote thread.
Try something more like this instead:
#include <Windows.h>
#include <stdio.h>
int main() {
char dllPath[MAX_PATH];
DWORD pathLen = GetFullPathNameA("MagshimimFinalProject.dll", MAX_PATH, dllPath, NULL);
if (!pathLen) {
DWORD err = GetLastError();
printf("Couldn't get DLL path. Error: %u", err);
return 0;
}
PVOID addrLoadLibrary = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
// TODO: use CreateToolhelp32Snapshot() or EnumProcesses() to find the correct process ID...
DWORD procID = 6340;
HANDLE proc = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, procID);
if (!proc) {
DWORD err = GetLastError();
printf("Couldn't open process. Error: %u", err);
return 0;
}
PVOID memAddr = VirtualAllocEx(proc, NULL, pathLen+1, MEM_COMMIT, PAGE_READWRITE);
if (!memAddr) {
DWORD err = GetLastError();
CloseHandle(proc);
printf("Couldn't allocate memory. Error: %u", err);
return 0;
}
if (!WriteProcessMemory(proc, memAddr, dllPath, pathLen+1, NULL)) {
DWORD err = GetLastError();
VirtualFreeEx(proc, memAddr, 0, MEM_RELEASE);
CloseHandle(proc);
printf("Couldn't write to memory. Error: %u", err);
return 0;
}
HANDLE hRemote = CreateRemoteThread(proc, NULL, 0, addrLoadLibrary, memAddr, 0, NULL);
if (!hRemote) {
DWORD err = GetLastError();
VirtualFreeEx(proc, memAddr, 0, MEM_RELEASE);
CloseHandle(proc);
printf("Couldn't create thread. Error: %u", err);
return 0;
}
WaitForSingleObject(hRemote, INFINITE);
CloseHandle(hRemote);
VirtualFreeEx(proc, memAddr, 0, MEM_RELEASE);
CloseHandle(proc);
return 0;
}