Have you ever tried to inject a DLL into another process on a 64 bit Windows? Well I tried and failed. CreateRemoteThread returned NULL and GetLastError returned error 5, which means ACCESS DENIED. That didn’t make any sense to me because I made sure to change my privilege token to include SE_PRIVILEGE_ENABLED, which means debugging rights.
Finally I used Process Explorer to find out that the process I was trying to inject was a 64 bit process, other than my injecting process, which was 32 bit. Obviously its impossible to inject a 32 bit dll into a 64 bit process.
Since I couldn’t find any forum posts suggesting this could ahve been the problem, I post it here to save you some time!
And a suggestion to Microsoft: That error message didn’t say what was actually wrong! It could throw a more informative message.
Filed under: Windows API
Word Gems 