Short LdrLoadDll stub crashes when remotely executed

Question

So I have written a small program that copies some shellcode into a specified process that calls LdrLoadDll (like a stub). The problem is, it only works when I specify the program to use to be the same program I wrote. If I choose any other program, that program will crash. Could it be with my function prototypes of something?

Here is my code:

#include <Windows.h>
#pragma comment(lib, "ntdll.lib")

typedef struct _LSA_UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
    PWSTR Buffer;
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;
using f_LdrLoadDll = NTSTATUS(NTAPI*)(IN PWCHAR PathToFile OPTIONAL, IN ULONG Flags OPTIONAL, IN PUNICODE_STRING ModuleFileName, OUT PHANDLE ModuleHandle);


typedef NTSTATUS(NTAPI *pdef_LdrLoadDll)(IN PWCHAR PathToFile OPTIONAL, IN ULONG Flags OPTIONAL, IN PUNICODE_STRING ModuleFileName, OUT PHANDLE ModuleHandle);
EXTERN_C NTSYSAPI VOID WINAPI RtlInitUnicodeString(PUNICODE_STRING, PCWSTR);
struct LOADER_STUB_INFO
{
    pdef_LdrLoadDll LdrLoadDllDef;
    UNICODE_STRING filename;
    f_LdrLoadDll LdrLoadDll = LdrLoadDllDef;
};
void __stdcall ldrstub(LOADER_STUB_INFO * ldrInfo);
int main()
{                                 //only works with GetCurrentProcessId();
    HANDLE proc = OpenProcess(GENERIC_ALL, 0, GetCurrentProcessId()); 
    LOADER_STUB_INFO loaderInfo;
    LPVOID ldrFuncAddr = GetProcAddress(GetModuleHandle("ntdll.dll"), "LdrLoadDll");
    pdef_LdrLoadDll LdrLoadDll = (pdef_LdrLoadDll)ldrFuncAddr;
    loaderInfo.LdrLoadDll = LdrLoadDll;
    UNICODE_STRING file;
    RtlInitUnicodeString(&file, L"C:\\Users\\Arush\\Desktop\\test.dll");
    loaderInfo.filename = file;
    LPVOID structAddr = VirtualAllocEx(proc, nullptr, 0x1000, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    WriteProcessMemory(proc, structAddr, &loaderInfo, sizeof(loaderInfo), nullptr);
    LPVOID codeAddr = VirtualAllocEx(proc, nullptr, 0x1000, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    WriteProcessMemory(proc, codeAddr, ldrstub, 0x1000, nullptr);
    CreateRemoteThread(proc, nullptr, 0, (LPTHREAD_START_ROUTINE)codeAddr, reinterpret_cast<LOADER_STUB_INFO*>(structAddr), 0, nullptr);
    system("pause");
    return 0;
}

void __stdcall ldrstub(LOADER_STUB_INFO * ldrInfo)
{
    auto _LdrLoadDll = ldrInfo->LdrLoadDll;
    HANDLE handee;
    _LdrLoadDll(nullptr, 0, &ldrInfo->filename, &handee);
}

Answer 1

UNICODE_STRING filename; inside LOADER_STUB_INFO containing pointer - Buffer. you init this pointer to L"C:\\Users\\Arush\\Desktop\\test.dll" and copy as is to remote process. but in remote process the Buffer of course invalid. you need allocate and copy name of dll, which you want to load to remote process, instead pointer to it from local process