


#include <windows.h>
#include <tchar.h>
#include <tlhelp32.h>
DWORD FindProcessId(LPTSTR lpName)
{
HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
if (hSnap == INVALID_HANDLE_VALUE)
return NULL;
PROCESSENTRY32 prc32 = {sizeof(PROCESSENTRY32)};
if (Process32First(hSnap, &prc32))
{
do
{
if (!_tcsicmp(prc32.szExeFile, lpName))
{
CloseHandle(hSnap);
return prc32.th32ProcessID;
}
} while (Process32Next(hSnap, &prc32));
}
CloseHandle(hSnap);
return NULL;
}
BOOL Inject(DWORD pid, LPCSTR dllpath)I
{
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
if (!hProc == INVALID_HANDLE_VALUE)
return FALSE;
VOID* remoteStr = VirtualAllocEx(hProc, NULL, strlen(dllpath+1), MEM_COMMIT, PAGE_READWRITE);
if (!remoteStr)
{
CloseHandle(hProc);
return FALSE;
}
if (!WriteProcessMemory(hProc, remoteStr, dllpath, strlen(dllpath), NULL))
{
VirtualFreeEx(hProc, remoteStr, strlen(dllpath-1), MEM_RELEASE);
CloseHandle(hProc);
return FALSE;
}
LPTHREAD_START_ROUTINE locLLA = (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
if (!locLLA)
{
VirtualFreeEx(hProc, remoteStr, strlen(dllpath-1), MEM_RELEASE);
CloseHandle(hProc);
return FALSE;
}
HANDLE hThread = CreateRemoteThread(hProc, NULL, 0, locLLA, remoteStr, 0, NULL);
if (!hThread)
{
VirtualFreeEx(hProc, remoteStr, strlen(dllpath-1), MEM_RELEASE);
CloseHandle(hProc);
return FALSE;
}
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
VirtualFreeEx(hProc, remoteStr, strlen(dllpath-1), MEM_RELEASE);
CloseHandle(hProc);
return TRUE;
}