Making Injector in C++
Hello, I just want to share something..
Code:
#include <Windows.h>
#include <Tlhelp32.h>
#include <Shlwapi.h>
#include <Tchar.h>
char g_szInjectorPath[MAX_PATH] = "";
char szTarget[] = "hl.exe";
char szTarget_BIG[] = "HL.EXE";
//===========================================================================
DWORD dwGetGameProcessID(VOID)
{
HANDLE hProcessSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL);
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(pe32);
if(!Process32First(hProcessSnapshot, &pe32))
return NULL;
while(Process32Next(hProcessSnapshot, &pe32))
{
if(lstrcmp(pe32.szExeFile, szTarget) == 0 || (lstrcmp(pe32.szExeFile, szTarget_BIG) == 0))
{
return pe32.th32ProcessID;
}
}
CloseHandle(hProcessSnapshot);
return NULL;
}
//===========================================================================
char* szGetDirFile(char* szFileName)
{
char szTemp[MAX_PATH] = "";
if(wsprintf(szTemp, "%s%s", g_szInjectorPath, szFileName))
{
return szTemp;
}
return "";
}
//=============================================================================
BOOL bInjectLibrary(HANDLE hProcess, char* szDllToInjectPath)
{
LPVOID lpRemoteAddress = VirtualAllocEx(hProcess, NULL, strlen(szDllToInjectPath), MEM_COMMIT, PAGE_READWRITE);
if(!lpRemoteAddress)
return FALSE;
if(!WriteProcessMemory(hProcess, lpRemoteAddress, (LPVOID)szDllToInjectPath, strlen(szDllToInjectPath), NULL))
return FALSE;
HANDLE hThread = NULL;
if(!(hThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("KERNEL32.DLL"), "LoadLibraryA"), lpRemoteAddress, NULL, NULL)))
return FALSE;
WaitForSingleObject(hThread, INFINITE);
if(!VirtualFreeEx(hProcess, lpRemoteAddress, 0, MEM_RELEASE))
return FALSE;
CloseHandle(hThread);
return TRUE;
}
//=============================================================================
int _tmain(int argc, _TCHAR* argv[])
{
TOKEN_PRIVILEGES TPLEGES;
TPLEGES.PrivilegeCount=1;
TPLEGES.Privileges->Luid.LowPart=0x00000014;
TPLEGES.Privileges->Luid.HighPart=0x00000000;
TPLEGES.Privileges->Attributes=0x00000002;
HANDLE htoken;
OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &htoken);
AdjustTokenPrivileges(htoken,0,&TPLEGES,0,0,0);
GetModuleFileName(NULL, g_szInjectorPath, MAX_PATH);
char* pos = g_szInjectorPath + strlen(g_szInjectorPath);
while(pos >= g_szInjectorPath && *pos != '\\') --pos;
pos[1] = 0;
DWORD dwGamePID = dwGetGameProcessID();
if(!dwGamePID)
{
Sleep(10);
dwGamePID = dwGetGameProcessID();
}
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, dwGamePID);
if(!bInjectLibrary(hProcess, szGetDirFile("BLANK.dll")))
{
}
CloseHandle(hProcess);
return 1;
}
//=============================================================================
PS: I didn't test if this still working.





