Injecting 32bit dll into 64bit process - Autoit makes it possible?

1
votes

afaik there is no way to inject 32bit dlls into 64bit processes and vice versa (at least it's not possible with my c++ written injector / dll). However, when using the Autoit injector from http://pastebin.com/AGWw2kT8 it is possible to inject 32bit dlls into 64bit processes. This Autoit library uses the same way of injecting as my c++ injector (CreateRemoteThread). Can someone explain this behaviour?

3
c++dllcode-injectionautoit
I'm pretty sure this doesn't work. - Collin Dauphinee
This is the Arthur C Clarke effect. Injecting 32-bit DLLs into 64-bit processes is not possible. The lack of error checking in that script can certainly make it look like it worked. - Hans Passant

3 Answers

1
votes

I've found the reason why the injection was successful. In the Autoit injection test script I use @SystemDir & "\calc.exe" as path for the target application. However, on a 64bit Windows installation the @SystemDir macro points to C:\Windows\SysWOW64 instead of C:\Windows\System32 - therefore the script started the 32bit version of calc.exe, in which the injection succeeded.

1
votes

CreateRemoteThread 32->64 won't work!

CreateRemoteThread 64->32 will work!

More info on that subject here

0
votes

It can't possibly work (you can't mix 32 and 64 bit code in one process). Therefore it doesn't. It may of course fail to make it clear that it hasn't worked.