Hello Wasabi_Sushi,
Expanding a little on Eric Haddan's good suggestion, the DLL injection method was first expounded by Jeffrey Richter (circa 1995) in his excllent book "Advanced Windows". This techique can be quite useful for accomplishing tasks like the one you described. Here is a summary :
1. Load a pre-written DLL and inject it into your target application.
1.1 This can be done via a clever combination of VirtualAllocEx(), CreateRemoteThread(), WriteProcessMemory(). The following link provides sample code to do this based on Jeffrey Richter's original code :
http://www.skullsecurity.org/wiki/index.php/.dll_Injection_and_Patching
The function to use is InjectLibrary().
1.2 The link above also contains a conjugal function EjectLibrary() to unload a DLL from the target application.
1.3 You need to pass to the InjectLibrary() function a handle to the target process. This can be retrieved via the OpenProcess() API. Among the flags you need to set for the first parameter to OpenProcess() are PROCESS_CREATE_THREAD and PROCESS_QUERY_INFORMATION.
1.4 Remember that the DLL needs to be located in a path that the target application can find.
2. When the pre-written DLL is loaded into the address space of the target application, its DllMain() function will be called with parameter DLL_PROCESS_ATTACH. Inside DllMain(), you can make a call to GetCommandLine() (as mentioned by Eric Haddan) to obtain the command line passed to the target application.
3. Now, what's left to do is to somehow pass the string returned by GetCommandLine() back to the original application (that initiated the DLL injection operation).
3.1 One way to do this is via file mapping (which is a form of memory sharing).
3.2 Basically, the original application creates a named file mapping object using CreateFileMapping(). It then maps a view of the file mapping object using MapViewOfFile() :
HANDLE hMapFile;
hMapFile = CreateFileMapping
(
INVALID_HANDLE_VALUE, // Current file handle.
NULL, // Default security.
PAGE_READWRITE, // Read/write permission.
0, // Max. object size.
256, // Size of hFile.
"GetCommandLine" // Name of mapping object.
);
Note that by specifying INVALID_HANDLE_VALUE as the first parameter, we get the CreateFileMapping() API to create a file-mapping object of the specified size backed by the operating-system paging file rather than by a named file in the file system.
lpMapAddress = MapViewOfFile
(
hMapFile, // Handle to mapping object.
FILE_MAP_ALL_ACCESS, // Read/write permission
0, // Max. object size.
0, // Size of hFile.
0 // Map entire file.
);
memset (lpMapAddress, 0, 256);
The MapViewOfFile() API returns a pointer to a memory location that is sharable with other apps. This memory location can be directly managed with functions like memcpy(), memset(), etc. In my example code above I used the name "GetCommandLine" as the name of the file mapping object.
3.3 After the file mapping objet has been created successfully, the DLL is injected into the target app. The idea is that when the DLL is loaded into the target app's address space, it will determine the command line and then copy the command line string into the file mapping object. This is all done inside DllMain() so that to the original app, when the DLL has been loaded, the original app can immediately read its file mapping object to retrieve the command line string :
if (InjectLibrary(hProcess, "InjectionDLL.dll"))
{
EjectLibrary(hProcess, dwProcessId, "InjectionDLL.dll");
}
// At this time, lpMapAddress should contain the command line of the target app
// unless something went wrong inside DllMain().
3.4 Inside the DllMain() function of the injected DLL, the file mapping object is opened via OpenFileMapping(). The name of the object is specified so that the same object first created in the original app is referred :
HANDLE hMapFile = NULL;
hMapFile = OpenFileMapping
(
FILE_MAP_ALL_ACCESS,
FALSE,
"GetCommandLine"
);
3.5 A view of the mapping object must also be created via MapViewOfFile() :
LPVOID lpMapAddress = NULL;
lpMapAddress = MapViewOfFile
(
hMapFile, // Handle to mapping object.
FILE_MAP_ALL_ACCESS,// Read/write permission.
0, // Max. object size.
0, // Size of hFile.
0 // Map entire file.
);
3.6 The GetCommandLine() function can then be called to retrieve the command line string. This string is then copied into the shared memory address returned by MapViewOfFile() :
std::string strCommandLine;
strCommandLine.resize(256, 0);
sprintf (&(strCommandLine[0]), "%s", GetCommandLine());
memcpy (lpMapAddress, (LPCVOID)(strCommandLine.c_str()), strlen(strCommandLine.c_str()));
3.7 Be sure to call UnmapViewOfFile() at the end of the whole operation for both the original map as well as the injected DLL :
UnmapViewOfFile(lpMapAddress);
Best of luck, Wasabi_Sushi,
- Bio.
