0

When I use Process Monitor to check iexplore.exe, I see some operations like lock/read/write from iexplore.exe to a specific file.

How can I do a modification to this specific file as iexplore.exe?

In short: how can I make a running Internet Explorer instance modify a file?

Jason Geffner
  • 20,681
  • 1
  • 36
  • 75
studentofmp
  • 317
  • 2
  • 4
  • 9

2 Answers2

3

One of the ways is to load your code into that process (iexplore.exe) and hook the file creation/writing APIs. This will give you the way to alter that process IO.

But why would you do that? This will look like pretty malicious activity.

Are you sure, there is no way to solve your problem without doing what you've asked?

Update - I hope what you are saying is true.

Introduction
Windows Hooks
The CreateRemoteThread & LoadLibrary Technique
-- Interprocess Communications

The CreateRemoteThread & WriteProcessMemory Technique
-- How to Subclass a Remote Control With this Technique
When to Use this Technique

Also, do some searching on the subject of hooking, there are a lot info on the Net.

PhoeniX
  • 3,052
  • 16
  • 30
  • Given past questions, I would reckon that this is an attempt at circumventing the DRM scheme somehow?! – 0xC0000022L Sep 04 '13 at 14:19
  • @ph0sec yes i know that is the way but how to load my code inside iexplore.exe on the load and executer it, AND NO THERE IS NO MALICIOUS JUST WANT TO DO IT – studentofmp Sep 04 '13 at 14:23
3

Create a DLL with your code in it.

You can then write an EXE to perform the following steps:

  1. Use CreateProcess() or OpenProcess() on Internet Explorer to get a handle to the Internet Explorer process.
  2. Call VirtualAllocEx() to allocate memory in the IE process using the handle from Step 1.
  3. Call WriteProcessMemory() to write the file path of your DLL into the memory allocated in Step 2.
  4. Call CreateRemoteThread() to call LoadLibrary() from IE's process to load the DLL whose path you just wrote into IE's memory in Step 3.

These steps are discussed in greater detail at http://resources.infosecinstitute.com/using-createremotethread-for-dll-injection-on-windows/

Jason Geffner
  • 20,681
  • 1
  • 36
  • 75
  • thanks for the reply ! it sounds the best way , just one think how to make static constructor since the dll is called a function starts ? – studentofmp Sep 04 '13 at 14:42