[TUT]How to make an Advanced Injector!

[DeathHunter]

This is a easy tutorial on how to make an Advanced Injector!

Open Microsoft Visual Basics 2008.

So do a 5 Buttons.
What we gonna do?
We are going to do an Advanced Injector.

What Items we will have?

• 5 Buttons.
• 1 Label.
• 1 TextBox.
• 1 ListBox.
• 1 Timer.
• 1 OpenFileDialog.

Name Button1 "Clear Selected"
Name Button2 "Clear Process"
Name Button3 "Clear List"
Name Button4 "Browse"
Name Button5 "Inject"

Do a Label.

Do a TextBox.

Do a ListBox and name ListBox1 to "Dlls"

Do a OpenFileDialog and go to Properties and MultiSelect do it True.

Add a Timer.

Click on Form1 and delete the words and copy and paste this:

Public Class Form1
    Private TargetProcessHandle As Integer
    Private pfnStartAddr As Integer
    Private pszLibFileRemote As String
    Private TargetBufferSize As Integer

    Public Const PROCESS_VM_READ = &H10
    Public Const TH32CS_SNAPPROCESS = &H2
    Public Const MEM_COMMIT = 4096
    Public Const PAGE_READWRITE = 4
    Public Const PROCESS_CREATE_THREAD = (&H2)
    Public Const PROCESS_VM_OPERATION = (&H8)
    Public Const PROCESS_VM_WRITE = (&H20)
    Dim DLLFileName As String
    Public Declare Function ReadProcessMemory Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpBaseAddress As Integer, _
    ByVal lpBuffer As String, _
    ByVal nSize As Integer, _
    ByRef lpNumberOfBytesWritten As Integer) As Integer

    Public Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" ( _
    ByVal lpLibFileName As String) As Integer

    Public Declare Function VirtualAllocEx Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpAddress As Integer, _
    ByVal dwSize As Integer, _
    ByVal flAllocationType As Integer, _
    ByVal flProtect As Integer) As Integer

    Public Declare Function WriteProcessMemory Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpBaseAddress As Integer, _
    ByVal lpBuffer As String, _
    ByVal nSize As Integer, _
    ByRef lpNumberOfBytesWritten As Integer) As Integer

    Public Declare Function GetProcAddress Lib "kernel32" ( _
    ByVal hModule As Integer, ByVal lpProcName As String) As Integer

    Private Declare Function GetModuleHandle Lib "Kernel32" Alias "GetModuleHandleA" ( _
    ByVal lpModuleName As String) As Integer

    Public Declare Function CreateRemoteThread Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpThreadAttributes As Integer, _
    ByVal dwStackSize As Integer, _
    ByVal lpStartAddress As Integer, _
    ByVal lpParameter As Integer, _
    ByVal dwCreationFlags As Integer, _
    ByRef lpThreadId As Integer) As Integer

    Public Declare Function OpenProcess Lib "kernel32" ( _
    ByVal dwDesiredAccess As Integer, _
    ByVal bInheritHandle As Integer, _
    ByVal dwProcessId As Integer) As Integer

    Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" ( _
    ByVal lpClassName As String, _
    ByVal lpWindowName As String) As Integer

    Private Declare Function CloseHandle Lib "kernel32" Alias "CloseHandleA" ( _
    ByVal hObject As Integer) As Integer
    Dim ExeName As String = IO.Path.GetFileNameWithoutExtension(Application.ExecutablePath)
    Private Sub Inject()
        On Error GoTo 1 ' If error occurs, app will close without any error messages
        Timer1.Stop()
        Dim TargetProcess As Process() = Process.GetProcessesByName(TextBox1.Text)
        TargetProcessHandle = OpenProcess(PROCESS_CREATE_THREAD Or PROCESS_VM_OPERATION Or PROCESS_VM_WRITE, False, TargetProcess(0).Id)
        pszLibFileRemote = OpenFileDialog1.FileName
        pfnStartAddr = GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA")
        TargetBufferSize = 1 + Len(pszLibFileRemote)
        Dim Rtn As Integer
        Dim LoadLibParamAdr As Integer
        LoadLibParamAdr = VirtualAllocEx(TargetProcessHandle, 0, TargetBufferSize, MEM_COMMIT, PAGE_READWRITE)
        Rtn = WriteProcessMemory(TargetProcessHandle, LoadLibParamAdr, pszLibFileRemote, TargetBufferSize, 0)
        CreateRemoteThread(TargetProcessHandle, 0, 0, pfnStartAddr, LoadLibParamAdr, 0, 0)
        CloseHandle(TargetProcessHandle)
1:      Me.Show()
    End Sub

    Private Sub OpenFileDialog1_FileOk(ByVal sender As System.Object, ByVal e As System.ComponentModel.CancelEventArgs) Handles OpenFileDialog1.FileOk

    End Sub

    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Button1.Text = "Clear Selected"
        Label1.Text = "Waiting for Process Start..."
        Timer1.Interval = 50
        Timer1.Start()

    End Sub

    Private Sub Timer1_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer1.Tick
        If IO.File.Exists(OpenFileDialog1.FileName) Then
            Dim TargetProcess As Process() = Process.GetProcessesByName(TextBox1.Text)
            If TargetProcess.Length = 0 Then
                Me.Label1.Text = ("Waiting for " + TextBox1.Text + ".exe...")
            Else
                Timer1.Stop()
                Me.Label1.Text = "Successfully Injected!"
                Call Inject()



            End If
        End If


    End Sub


    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        For i As Integer = (Dlls.SelectedItems.Count - 1) To 0 Step -1
            Dlls.Items.Remove(Dlls.SelectedItems(i))
        Next

    End Sub

    Private Sub Button2_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button2.Click
        TextBox1.Clear()

    End Sub

    Private Sub Button3_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button3.Click
        Dlls.Items.Clear()

    End Sub

    Private Sub Button4_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button4.Click
        OpenFileDialog1.Filter = "DLL (*.dll) |*.dll|(*.*) |*.*"
        OpenFileDialog1.ShowDialog()
        Dim FileName As String
        FileName = OpenFileDialog1.FileName.Substring(OpenFileDialog1.FileName.LastIndexOf("\"))
        Dim DllFileName As String = FileName.Replace("\", "")
        Me.Dlls.Items.Add(DllFileName)

    End Sub
    Private Function GetAsyncKeyState(ByVal vKey As Integer) As Short

        If GetAsyncKeyState(Keys.F12) Then
            If IO.File.Exists(OpenFileDialog1.FileName) Then
                Dim TargetProcess As Process() = Process.GetProcessesByName(TextBox1.Text)
                If TargetProcess.Length = 0 Then

                    Me.Label1.Text = ("Waiting for " + TextBox1.Text + ".exe Injection(F12)...")
                Else
                    Timer1.Stop()
                    Me.Label1.Text = "Successfully Injected!"
                    Call Inject()
                    ' If CheckBox1.Checked = True Then
                    'Me.Close()
                    'Else
                    ' End If
                End If
            Else
            End If
        End If

    End Function

    Private Sub Button5_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button5.Click
        If IO.File.Exists(OpenFileDialog1.FileName) Then
            Dim TargetProcess As Process() = Process.GetProcessesByName(TextBox1.Text)
            If TargetProcess.Length = 0 Then

                Me.Label1.Text = ("Waiting for " + TextBox1.Text + ".exe Injection(F12)...")
            Else
                Timer1.Stop()
                Me.Label1.Text = "Successfully Injected!"
                Call Inject()
                ' If CheckBox1.Checked = True Then
                'Me.Close()
                'Else
                ' End If
            End If
        Else
        End If

    End Sub
End Class

NOTE:
This may have some errors because I didn't fully checked it and I need to edit the thread to make it more easy to do.

[Spookerzz]

I'll test now.

[DeathHunter]

Okay,tell me what problems.
I will update this after helping my sister doing a project.

[Spookerzz]

Please work this one out.

[DeathHunter]

Did you do the buttons?
And did everything correctly?
I will post a source.

[Spookerzz]

I'm trying again.

[DeathHunter]

It should look something like this:

[Spookerzz]

Works. Well done Very Detailed after adding the extra bit.

EDIT: What do we write for the label and do we have to add .exe

[DeathHunter]

No,no .exe and write nothing in label.

[Zoom]

Does this inject every .dll in the list?

[cyberwap01]

after i browse the dlls not in list.,.,

[DeathHunter]

Yes,every dll.

[Spookerzz]

It's in the list for me.

[ndmbbl3]

i got:

Error	1	'Private Sub Button1_Click(sender As Object, e As System.EventArgs)' has multiple definitions with identical signatures.	C:\Users\Nick\AppData\Local\Temporary Projects\WindowsApplication1\Form1.Designer.vb	139	17	WindowsApplication1

i think i followed the directions as you said... Also, what is the Label1 for?

[Zoom]

Yes,every dll.

This does only inject the last file opened by openfiledialog.