title: Injected DLL and calling a function using CreateRemoteThread causes "has stopped working", what happens?
body: <p>I`m trying to inject a DLL in a process and call a exported function in my DLL.</p>
  
  <p>The DLL is injected alright with that code:</p>
  
  <pre><code>HANDLE Proc;
  char buf[50] = { 0 };
  LPVOID RemoteString, LoadLibAddy;
  if (!pID)
      return false;
  Proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);
  if (!Proc)
  {
      sprintf_s(buf, "OpenProcess() failed: %d", GetLastError());
      printf(buf);
      return false;
  }
  
  LoadLibAddy = (LPVOID)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");
  // Allocate space in the process for our DLL 
  RemoteString = (LPVOID)VirtualAllocEx(Proc, NULL, strlen(DLL_NAME), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
  // Write the string name of our DLL in the memory allocated 
  WriteProcessMemory(Proc, (LPVOID)RemoteString, DLL_NAME, strlen(DLL_NAME), NULL);
  // Load our DLL 
  HANDLE hThread = CreateRemoteThread(Proc, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, NULL, NULL);
  </code></pre>
  
  <p>The module of my DLL is created OK, like you see in that image of Process Hacker (BootstrapDLL.exe):</p>
  
  <p><img src="https://i.stack.imgur.com/riEOn.jpg" alt="enter image description here"></p>
  
  <p>My exported functions is ok too, like you see in the list of functions exported on Process Hacker (ImplantDotNetAssembly):</p>
  
  <p><img src="https://i.stack.imgur.com/BHnT2.jpg" alt="enter image description here"></p>
  
  <p>The problems, I think, happens on the offset calculation to get the address of the "ImplantDotNetAssembly", because everything above is alright and when I do the calculation I get the address of the "ImplantDotNetAssembly", but when I call CreateRemoteThread again to call it, the window "Has stopped working..." of the windows is showed and the process stoped. What`s happening?</p>
  
  <p>Here is the code of the calculation of the offset:</p>
  
  <pre><code>DWORD_PTR hBootstrap = GetRemoteModuleHandle(ProcId, L"BootstrapDLL.exe");
  DWORD_PTR offset = GetFunctionOffset(L"C:\\Users\\Acaz\\Documents\\Visual Studio 2013\\Projects\\Contoso\\Debug\\BootstrapDLL.exe", "ImplantDotNetAssembly");
  DWORD_PTR fnImplant = hBootstrap + offset;
  
  HANDLE hThread2 = CreateRemoteThread(Proc, NULL, 0, (LPTHREAD_START_ROUTINE)fnImplant, NULL, 0, NULL);
  </code></pre>
  
  <p>Here are the functions GetRemoteModuleHandle and GetFunctionOffset:</p>
  
  <pre><code>DWORD_PTR GetFunctionOffset(const wstring&amp; library, const char* functionName)
  {
      // load library into this process
      HMODULE hLoaded = LoadLibrary(library.c_str());
  
      // get address of function to invoke
      void* lpInject = GetProcAddress(hLoaded, functionName);
  
      // compute the distance between the base address and the function to invoke
      DWORD_PTR offset = (DWORD_PTR)lpInject - (DWORD_PTR)hLoaded;
  
      // unload library from this process
      FreeLibrary(hLoaded);
  
      // return the offset to the function
      return offset;
  }
  
  DWORD_PTR GetRemoteModuleHandle(const int processId, const wchar_t* moduleName)
  {
      MODULEENTRY32 me32;
      HANDLE hSnapshot = INVALID_HANDLE_VALUE;
  
      // get snapshot of all modules in the remote process 
      me32.dwSize = sizeof(MODULEENTRY32);
      hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, processId);
  
      // can we start looking?
      if (!Module32First(hSnapshot, &amp;me32))
      {
          CloseHandle(hSnapshot);
          return 0;
      }
  
      // enumerate all modules till we find the one we are looking for or until every one of them is checked
      while (wcscmp(me32.szModule, moduleName) != 0 &amp;&amp; Module32Next(hSnapshot, &amp;me32));
  
      // close the handle
      CloseHandle(hSnapshot);
  
      // check if module handle was found and return it
      if (wcscmp(me32.szModule, moduleName) == 0)
          return (DWORD_PTR)me32.modBaseAddr;
  
      return 0;
  }
  </code></pre>
  
  <p>If someone know what is happening, I'll be very grateful!</p>
  
  <p>I cant`t even debug the "has stopped work.." error. When I clik in the DEBUG button on the window, the error throw again and everything stop.</p>
  
  <p>Thank you.</p>