DLL Injection

**~Fleck** on Thu Jul 02, 2009 6:14 am

Code:: void FindPID( ) //bi stoopid { PROCESSENTRY32 pe32; pe32.dwSize = sizeof( PROCESSENTRY32 ); HANDLE hSnapShot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 ); if( hSnapShot == INVALID_HANDLE_VALUE ) { printf( "snapshot < failed\n" ); } Process32First( hSnapShot, &pe32 ); while( Process32Next( hSnapShot, &pe32 ) ) { if( strstr( pe32.szExeFile, "explorer.exe" ) ) { if( InjectDLL( pe32.th32ProcessID, "dll.dll" ) ) { printf( "inject < success\n" ); } else { printf( "inject < failed\n" ); } } } }; bool InjectDLL( unsigned long dwPID, char* szLibraryPath ) { unsigned long dwWritten; HANDLE hProcess, hThread; LPTHREAD_START_ROUTINE lpModule; void* lpBuffer; hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, dwPID ); if( !hProcess ) return false; lpModule = (LPTHREAD_START_ROUTINE)GetProcAddress( GetModuleHandle( "kernel32.dll" ), "LoadLibraryA" ); lpBuffer = VirtualAllocEx( hProcess, NULL, strlen( szLibraryPath ) + 1, MEM_COMMIT, PAGE_READWRITE ); if( !lpBuffer ) return false; if( !WriteProcessMemory( hProcess, lpBuffer, szLibraryPath, strlen( szLibraryPath ) + 1, &dwWritten ) ) return false; hThread = CreateRemoteThread( hProcess, NULL, 0, lpModule, lpBuffer, 0, NULL ); if( !hThread ) return false; CloseHandle( hThread ); CloseHandle( hProcess ); return true; };