WriteProcessMemory bytes

[poohpooh]

hi
i need some help with writing bytes to external process to remove a detour that the program does

this is what im trying it fails

	HANDLE Handle = OpenProcess(PROCESS_ALL_ACCESS, false, ProcessId);

	BYTE btLdrLoadDll[] = { 0x8B, 0xFF, 0x55, 0x8B, 0xEC };

	if (!WriteProcessMemory(Handle, (BYTE*)((DWORD)GetProcAddress(GetModuleHandle("ntdll.dll"), "LdrLoadDll")), &btLdrLoadDll, sizeof(btLdrLoadDll), NULL))
	{
		CloseHandle(Handle);
		std::cout << "\nFailed to write Bytes to memory. Press enter to exit.";
		std::cin.ignore();
		std::cin.sync();
		return 0;
	}

an also using the right address like this fails

WriteProcessMemory(Handle, (BYTE*)0x77C64F9F, &btLdrLoadDll, sizeof(btLdrLoadDll), NULL)

[helios]

You're getting the address of ntdll.dll!LdrLoadDll in the address space of the local process. You need the address in the address space of the remote process.

[poohpooh]

An how do you do that?
I thought this was right

[helios]

You need to run GetProcAddress() from the remote process and somehow send the address to the local process. I'm not aware of a way to obtain the addresses of modules loaded from another process, though it may be possible.

[poohpooh]

The program that I'm trying to writeprocessmemory to seems to block it. Thinking with a kernel driver or something.
I have no idea how to prevent this. Any help would be great.
Pm me if you don't want anyone to see or what ever. Willing to help out anyone that helps me out.

[helios]

You could inject a DLL into the process and send the address over a pipe. If you're going that route, though, it's easier to do the writing from the injected DLL and skip the pipe and WriteProcessMemory() altogether.

[poohpooh]

cant inject dll into process it protects loadlibrary and WriteProcessMemory
so not really sure what to do

[helios]

You can still inject code without using LoadLibrary, although you'll have to write more Assembly by hand.

[poohpooh]

Are you talking about manual mapping?
If so I tried that an didn't work because of WriteProcessMemory

how do you mean?