Injector

#include <windows.h>
#include <stdio.h>


BOOL EnableSEPriv()
{
HANDLE hToken;
LUID luID;
TOKEN_PRIVILEGES tkp;

if(!OpenProcessToken(GetCurrentProcess(), (TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY), &hToken))
return FALSE;

if(!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luID))
return FALSE;

tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = luID;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL);
CloseHandle(hToken);
return TRUE;
}

int
main(int argc, char **argv)
{
if(argc != 2)
{
puts("usage: inject <PID>");
return 1;
}

DWORD pid = (DWORD)atoi(argv[1]);

HANDLE hproc = OpenProcess(
PROCESS_ALL_ACCESS,
FALSE,
pid);
// check

printf("pid = %i\n", pid);

PVOID addr = VirtualAllocEx(
hproc,
NULL,
strlen("hook.dll"),
MEM_COMMIT | MEM_RESERVE,
PAGE_EXECUTE_READWRITE);
//check
printf("addr = %.8x\n", addr);

WriteProcessMemory(hproc, addr, "hook.dll", strlen("hook.dll"), NULL);
//check

HANDLE hthread = CreateRemoteThread(
hproc,
NULL,
0,
(LPTHREAD_START_ROUTINE)
GetProcAddress(GetModuleHandle("kernel32"), "LoadLibraryA"),
addr,
0,
NULL);
// check

CloseHandle(hthread);
CloseHandle(hproc);

return 0;
}