What is the structure of HMODULE in x64?

Question

I'm trying to implement an injection of my 64-bit DLL into a 64-bit process. My host process calls CreateRemoteThread with a thread subroutine pointing to LoadLibrary. The DLL later unloads itself "from within" by calling FreeLibraryAndExitThread.

My goal is to know if the injected LoadLibrary call succeeded. For that unfortunately I can't use GetExitCodeThread from within my (host) process since returned 64-bit HMODULE handle is truncated to by a remote thread to DWORD. And I don't want to use Tool Help APIs as they will introduce a race condition.

So thus I was wondering about the lower 32-bits of the HMODULE returned by LoadLibrary in a 64-bit process -- can I reliably assume that its lower 32-bits will not be 0's for a valid handle?

PS. I don't need the HMODULE handle itself, all I need to know if LoadLibrary succeeded or not.

Edit. The call from my host process is done as such (in a very concise pseudo-code -- no error checking):

CreateRemoteThread(hProcess, 0, 0, 
  GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryW"),
  pVmAddressOfMyDllsPathWrittenWith_WriteProcessMemory, 0, 0);

Answer 1

Can I reliably assume that its lower 32-bits will not be 0's for a valid handle?

No you cannot. An HMODULE is just the same in 64 bit as it is in 32 bit. It is the base address of the loaded module. So there is no reason why a valid HMODULE would have to have non-zero low order bits.

It's very simple for you to confirm this. Create a 64 bit DLL with an IMAGEBASE set to, for instance, 0x0000000100000000. Load that DLL, and inspect the value of the returned HMODULE.

Answer 2

instead CreateRemoteThread with a thread subroutine pointing to LoadLibraryW we can inject tiny shell code to remote process which first call LoadLibraryW and than, if it fail, GetLastError - as result remote thread return error code (0 if no error) - and you will be know exactly - are LoadLibrary ok and if not - have error code. the 64 asm code can be:

CONST segment

SHELLDATA struct
    LoadLibrary DQ ?
    GetLastError DQ ?
SHELLDATA ends

public RemoteThreadProc_begin
public RemoteThreadProc_end

RemoteThreadProc_begin:
RemoteThreadProc proc
    nop
    nop
    nop
    call @@0
    ___ SHELLDATA <>
@@0:
    xchg [rsp],rbp
    sub rsp,20h
    call SHELLDATA.LoadLibrary[rbp]
    test rax,rax
    jz @@1
    xor eax,eax
@@2:
    add rsp,20h
    pop rbp
    ret
@@1:
    call SHELLDATA.GetLastError[rbp]
    jmp @@2
RemoteThreadProc endp
RemoteThreadProc_end:

CONST ends

and c++ code:

extern "C"
{
    extern UCHAR RemoteThreadProc_begin[], RemoteThreadProc_end[];
}

enum INJECT_PHASE {
    fOpenProcess, fVirtualAlloc, fWriteProcessMemory, fCreateRemoteThread, fMax
};

ULONG injectDll(ULONG dwprocessId, PCWSTR dllFilePath, INJECT_PHASE& phase)
{
    ULONG err = 0;

    struct SHELLDATA 
    {
        __int64 code;
        PVOID LoadLibrary, GetLastError;
    };

    if (HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE, FALSE, dwprocessId))
    {
        SIZE_T cbStr = (wcslen(dllFilePath) + 1) * sizeof(WCHAR);
        SIZE_T cbCode = ((RemoteThreadProc_end - RemoteThreadProc_begin) + sizeof(WCHAR) - 1) & ~(sizeof(WCHAR) - 1);

        union {
            PVOID RemoteAddress;
            PBYTE pbRemote;
            PTHREAD_START_ROUTINE lpStartAddress;
        };

        if (RemoteAddress = VirtualAllocEx(hProcess, 0, cbStr + cbCode, MEM_COMMIT, PAGE_EXECUTE_READWRITE))
        {
            union {
                PVOID pv;
                PBYTE pb;
                SHELLDATA* ps;
            };

            pv = alloca(cbStr + cbCode);

            memcpy(pv, RemoteThreadProc_begin, cbCode);
            memcpy(pb + cbCode, dllFilePath, cbStr);

            HMODULE hmod = GetModuleHandle(L"kernel32");
            ps->GetLastError = GetProcAddress(hmod, "GetLastError");
            ps->LoadLibrary = GetProcAddress(hmod, "LoadLibraryW");

            if (WriteProcessMemory(hProcess, RemoteAddress, pv, cbStr + cbCode, 0))
            {
                if (HANDLE hThread = CreateRemoteThread(hProcess, 0, 0, lpStartAddress, pbRemote + cbCode, 0, 0))
                {
                    phase = fMax;
                    WaitForSingleObject(hThread, INFINITE);
                    GetExitCodeThread(hThread, &err);

                    CloseHandle(hThread);
                }
                else
                {
                    phase = fCreateRemoteThread;
                    err = GetLastError();
                }
            }
            else
            {
                phase = fWriteProcessMemory;
                err = GetLastError();
            }

            VirtualFreeEx(hProcess, RemoteAddress, 0, MEM_RELEASE);
        }
        else
        {
            phase = fVirtualAlloc;
            err = GetLastError();
        }

        CloseHandle(hProcess);
    }
    else
    {
        phase = fOpenProcess;
        err = GetLastError();
    }

    return err;
}