title: Calling a function from a remote process using injected DLL
body: <p>I saw a similar, but still different question to this, so just to clarify this is not a dupe of 13428881 (Calling a function in an injected DLL). </p>
  
  <p>What I have at the minute:
  A DLL, injected into a target process, displaying a message box and fiddling around doing math.</p>
  
  <p>What I want in the future:
  A DLL which can manipulate and toy with the internals of the target process.</p>
  
  <p>The next step towards achieving the desired manipulation is to call a method in a remote thread within the process I'm injecting into.</p>
  
  <p>Let's take an example:
  I have a C++ application, which has int main, let's say it looks like this:</p>
  
  <pre><code>int PrintText(string text)
  {
      cout &lt;&lt; text;
      return 1;
  }
  
  int main()
  {
      while (true)
      {
          PrintText("From the DLL");
      }
  }
  </code></pre>
  
  <p>Ok, so that's lovely, my target application is currently printing some text, and it seems to be doing so very happily. It's spamming it at an unbelievable rate, but I can slow it down using threads and sleeps etc if I need to. The fact is this isn't an issue, the code here hasn't been compiled or tested, and I've no intention of using this exact code. I'm actually working with a game.</p>
  
  <p>Now, let's say I create a pointer to the method, PrintText, and that I know the address of it within that process. How do I go about calling it, externally, passing in arguments?</p>
  
  <p>Locally, I believe it would look something like this:</p>
  
  <pre><code>int i;
  int (*PrintSomeText)(string) = PrintText;
  </code></pre>
  
  <p>I could then call this function using a reference, like so:</p>
  
  <pre><code>i = operation("Text to be printed", PrintSomeText);
  </code></pre>
  
  <p>This should, by my theory, declare an integer called i, then define a pointer to a method which returns int, takes one string as a parameter, and the pointer stores the value of the pointer which was in PrintText. (Or something of that nature).</p>
  
  <p>Very nice, so I can call my own functions via pointer, that's great, cracking in fact. I've truly astonished myself with this ability, and I do now feel like superman. I'll go save some babies or something, brb.</p>
  
  <p>Back, so now I want to continue a little further, and take that next step. Let's say I know that the the method is at the address 100 in the target process (decimal, I will likely do it in hexadecimal, as I'm using CheatEngine / OllyDBG to find methods in the target process, but for this example we'll stay simple).</p>
  
  <p>I presume that my injected DLL gets its own space entirely, does it have any higher access to the target process? How can I find this out?</p>
  
  <p>Thanks for your time,
  Josh</p>
  
  <p>Edit: A small note, I'm going through the C++ tutorial book, and it's proven so far to be very useful. I've noticed that I forgot to include my operation method, so apologies for that being missing. If it's required, let me know. Thanks!</p>
  
  <p>Edit nr 2: I've just made some compilable code to test this out, since I wrote most of this free hand reading from the book without an IDE, and the IDE has finally configured itself, so here is the code I'm currently working with</p>
  
  <pre><code>#include "stdafx.h"
  #include &lt;iostream&gt;
  
  using namespace std;
  
  int PrintText(char * Text)
  {
      cout &lt;&lt; Text &lt;&lt; endl;
      return 1;
  }
  
  int _tmain(int argc, _TCHAR* argv[])
  {
      int (*Print)(char*) = PrintText;
      char Text[] = "Hello, world!";
      PrintText(Text);
      int x = (*Print)("Oh my word, it really works!");
      cin.get();
      return 0;
  }
  </code></pre>
  
  <p>Note I haven't yet made it run indefinitely, so yeah, please excuse that, I'll add it shortly.</p>