CopyFile error code is 5 (Access is denied)

c++ / delphi package - dll injection and api hooking
Post Reply
yyjo
Posts: 1
Joined: Tue Dec 01, 2015 10:34 am

CopyFile error code is 5 (Access is denied)

Post by yyjo »

I tried DLL injection to IE11. Use the 'InjectLibrary()'.
I use the CopyFile() in DLL.
But CopyFile() return FALSE. Error Cdoe is 5(Access is denied).
I can't understand this error.

Attach the Code.
My OS is Windows 8.1.

Thanks.

+ Call 'GetOpenFileNameWCallback' fuction when if you attach the file in mail service.

Code: Select all

BOOL (WINAPI *GetOpenFileNameWNext)(
  _Inout_ LPOPENFILENAME lpofn
);

BOOL WINAPI GetOpenFileNameWCallback(
  _Inout_ LPOPENFILENAME lpofn
)
{
	CopyFile(L"c:\\test\\a.txt", L"c:\\test\\c.txt", TRUE);	/// Fail!! Error Code is 5.  why?
	return GetOpenFileNameWNext(lpofn);
}

void HookStart()
{
	InitializeMadCHook();
	CopyFile(L"c:\\test\\a.txt", L"c:\\test\\b.txt", TRUE);	/// Success!
	HookAPI("Comdlg32.dll", "GetOpenFileNameW", GetOpenFileNameWCallback, (PVOID*)&GetOpenFileNameWNext);
}

void HookEnd()
{
	FinalizeMadCHook();
}
Last edited by yyjo on Tue Dec 01, 2015 11:36 am, edited 1 time in total.
madshi
Site Admin
Posts: 10327
Joined: Sun Mar 21, 2004 5:25 pm

Re: CopyFile error code is 5 (Access is denied)

Post by madshi »

Could be an NTFS restriction. Or maybe IE11 is running in a sandbox, blocking file access? Does this only happen inside of IE11, but not in other processes? In that case it's probably IE11 sandbox or "protected process" or whatever added security they're using to stop browser plugins from doing bad stuff.
iconic
Site Admin
Posts: 974
Joined: Wed Jun 08, 2005 5:08 am

Re: CopyFile error code is 5 (Access is denied)

Post by iconic »

Windows 8.1 introduced IE 11 as a Metro app, you can still use the normal desktop version but IIRC metro is the default. Metro apps can't perform file access to locations outside of their current local folders due to their sandboxed behavior. It's likely the reason why CopyFile is failing with ERROR_ACCESS_DENIED

--Iconic
madshi
Site Admin
Posts: 10327
Joined: Sun Mar 21, 2004 5:25 pm

Re: CopyFile error code is 5 (Access is denied)

Post by madshi »

Ah, makes sense, thanks.
alfaunits
Posts: 21
Joined: Sat Apr 09, 2011 9:41 pm

Re: CopyFile error code is 5 (Access is denied)

Post by alfaunits »

Not the case here exactly, but it is a sandbox issue. Since the copy works from the Hook Init and not from the hooked API itself.

The DLL initialization happens inside the main process, whereas the hook is called from the sandboxed process. Sandboxed processed in IE, whether Protected Mode is on, or UAC is on (on windows 8+, not prior) have Low Integrity Level, which means they cannot write outside of Temp folder more/less.


I had been banging my head for months frankly to figure how to overcome this :( In the end, we decided to make a plugin for download instead :D
Post Reply