SharpNeedle does not support 64-bit (CallExport: Could not find module in remote process)

I am running Windows 10 x64. I have built the solution using VS 2015. I have ensured I am using an elevated permissions for VS 2015/command prompt I am unable to get demo app to be injected.

I get the following error: 'CallExport: Could not find module in remote process'.

Would be willing to provide any more info if I could get some help debugging this.

[ChadSki]

This has to do with a mismatch between 32-bit and 64-bit, right?

I believe that SharpNeedle's bitness needs to match the bitness of the target process in order to work. 32-bit cannot target 64-bit and vice-versa.

I just figured this out and was going to come back and ask about it! I've successfully got it working with 32-bit processes, but haven't been able to get it to work with any 64 bit.

I understand there are three moving parts here the bootstrap dll, launcher exe and example project dll. When you say SharpNeedle's bitness which are you talking about - all of those or just some?

I understand for the C# the platform target is defaulted to Any CPU - is this good?
I don't have as much experience with C++ projects. I've tried fiddling with the configuration manager but am unsure if I've switched to x64 appropriately. How do I switch those two to be x64?

[ChadSki]

If you're targeting a 64-bit process, both Launcher.exe and Bootstrapper.dll must be 64-bit. ExampleProject.dll can remain Any CPU. In Visual Studio you can change this via Build > Configuration Manager.

I just tried it out for myself and there is a handful of warnings such as 'type cast': conversion from 'DWORD' to 'LPVOID' of greater size that will need to be dealt with.

Ok I'm seeing the same now, will investigate.

[DoCode]

@jasteph, @ChadSki, what is the progress with a 64bit solution?
Nice solution!

[asim1337]

I'm also landing at "CallExport: Could not find module in remote process.". The bootstrap.dll doesn't seem to be part of the process snapshot! I tried to inject it into Dependency Walker x86 .exe. In VS2017 I set it to 'Debug' and 'Win32', I also checked PE Header of the bootstrap.dll, it is x86! Do you have any idea or a quick working poc?

[ChadSki]

@asim1337 are you able to inject into other 32-bit processes?

[hagohel]

Hello @ChadSki
I was trying to inject putty.exe which is 32 bit process however my windows OS is 64 bit. It shows me following output.

I have tried with notepad++(which is also 32 bit) but the same output. Please advise..!

[ChadSki]

That does appear to be a 32-bit process, and Launcher.exe is able to enumerate the loaded dlls. My guess is that Bootstrapper.dll is missing because it was not successfully injected. It's hard to say why that would happen.

You might have to try step-through debugging of InjectAndRunThenUnload to see where the injection is going wrong.