CopyFile error code is 5 (Access is denied)

c++ / delphi package - dll injection and api hooking

CopyFile error code is 5 (Access is denied)

Postby yyjo » Tue Dec 01, 2015 11:29 am

I tried DLL injection to IE11. Use the 'InjectLibrary()'.
I use the CopyFile() in DLL.
But CopyFile() return FALSE. Error Cdoe is 5(Access is denied).
I can't understand this error.

Attach the Code.
My OS is Windows 8.1.

Thanks.

+ Call 'GetOpenFileNameWCallback' fuction when if you attach the file in mail service.

Code: Select all
BOOL (WINAPI *GetOpenFileNameWNext)(
  _Inout_ LPOPENFILENAME lpofn
);

BOOL WINAPI GetOpenFileNameWCallback(
  _Inout_ LPOPENFILENAME lpofn
)
{
   CopyFile(L"c:\\test\\a.txt", L"c:\\test\\c.txt", TRUE);   /// Fail!! Error Code is 5.  why?
   return GetOpenFileNameWNext(lpofn);
}

void HookStart()
{
   InitializeMadCHook();
   CopyFile(L"c:\\test\\a.txt", L"c:\\test\\b.txt", TRUE);   /// Success!
   HookAPI("Comdlg32.dll", "GetOpenFileNameW", GetOpenFileNameWCallback, (PVOID*)&GetOpenFileNameWNext);
}

void HookEnd()
{
   FinalizeMadCHook();
}
Last edited by yyjo on Tue Dec 01, 2015 11:36 am, edited 1 time in total.
yyjo
 
Posts: 1
Joined: Tue Dec 01, 2015 10:34 am

Re: CopyFile error code is 5 (Access is denied)

Postby madshi » Tue Dec 01, 2015 11:32 am

Could be an NTFS restriction. Or maybe IE11 is running in a sandbox, blocking file access? Does this only happen inside of IE11, but not in other processes? In that case it's probably IE11 sandbox or "protected process" or whatever added security they're using to stop browser plugins from doing bad stuff.
madshi
Site Admin
 
Posts: 10268
Joined: Sun Mar 21, 2004 5:25 pm

Re: CopyFile error code is 5 (Access is denied)

Postby iconic » Tue Dec 01, 2015 4:10 pm

Windows 8.1 introduced IE 11 as a Metro app, you can still use the normal desktop version but IIRC metro is the default. Metro apps can't perform file access to locations outside of their current local folders due to their sandboxed behavior. It's likely the reason why CopyFile is failing with ERROR_ACCESS_DENIED

--Iconic
iconic
Site Admin
 
Posts: 967
Joined: Wed Jun 08, 2005 5:08 am

Re: CopyFile error code is 5 (Access is denied)

Postby madshi » Tue Dec 01, 2015 4:43 pm

Ah, makes sense, thanks.
madshi
Site Admin
 
Posts: 10268
Joined: Sun Mar 21, 2004 5:25 pm

Re: CopyFile error code is 5 (Access is denied)

Postby alfaunits » Thu Dec 03, 2015 2:05 am

Not the case here exactly, but it is a sandbox issue. Since the copy works from the Hook Init and not from the hooked API itself.

The DLL initialization happens inside the main process, whereas the hook is called from the sandboxed process. Sandboxed processed in IE, whether Protected Mode is on, or UAC is on (on windows 8+, not prior) have Low Integrity Level, which means they cannot write outside of Temp folder more/less.


I had been banging my head for months frankly to figure how to overcome this :( In the end, we decided to make a plugin for download instead :D
alfaunits
 
Posts: 21
Joined: Sat Apr 09, 2011 9:41 pm


Return to madCodeHook

Who is online

Users browsing this forum: No registered users and 24 guests