typedef HINSTANCE (WINAPI *ProcLoadLibrary)(char*);
typedef FARPROC (WINAPI *ProcGetProcAddress)(HMODULE, LPCSTR);
typedef int (WINAPI *ProcMessageBox)(HWND,LPCTSTR,LPCTSTR,UINT);
typedef struct tagHYPINJECT {
?????? ProcLoadLibrary??? fnLoad;
?????? ProcGetProcAddress fnGetProc;
?????? char MsgStr [MAX_PATH];
?????? char DLLName [MAX_PATH];
?????? char ProcName [MAX_PATH];
} HYPINJECT;
#pragma check_stack (off)
static DWORD WINAPI ThreadProc (LPVOID lpParameter)
{
?????? HYPINJECT* p = (HYPINJECT*)lpParameter;
?????? HMODULE hDLL = p->fnLoad (p->DLLName);
??? ProcGetProcAddress GetProc = p->fnGetProc;
?????? ProcMessageBox MsgBox = (ProcMessageBox)GetProc(hDLL,p->ProcName);
??? MsgBox(NULL,p->MsgStr,p->MsgStr,MB_OK);
?????? return 0;
}
static void AfterThreadProc (void) { }
#pragma check_stack
HYPINJECT hypInject;
BOOL InjectFunc(DWORD PID)
{
?????? HMODULE hk = LoadLibrary ("kernel32.dll");
?????? hypInject.fnLoad = (ProcLoadLibrary)GetProcAddress (hk, "LoadLibraryA");
?????? hypInject.fnGetProc = (ProcGetProcAddress)GetProcAddress (hk, "GetProcAddress");
?????? strcpy(hypInject.MsgStr," hyp's Knowledge Base");
?????? strcpy (hypInject.DLLName, "user32.dll");
?????? strcpy (hypInject.ProcName, "MessageBoxA");
?????? PVOID pCode = NULL;
?????? PVOID pData = NULL;
?????? BOOL bc = FALSE;
?????? DWORD cbCodeSize = (BYTE*)AfterThreadProc - (BYTE*)ThreadProc;
?????? HANDLE hProc = OpenProcess(
????????????? PROCESS_QUERY_INFORMATION |??
????????????? PROCESS_CREATE_THREAD???? |
????????????? PROCESS_VM_OPERATION????? |
????????????? PROCESS_VM_WRITE,???????????
????????????? FALSE, PID);
?????? if (hProc == NULL)
?????? {
????????????? return FALSE;
?????? }
??????
?????? pCode=VirtualAllocEx(hProc,NULL,cbCodeSize,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
?????? if(pCode == NULL)
?????? {
????????????? return FALSE;
?????? }
?????? bc = WriteProcessMemory(hProc,pCode,(LPVOID)(DWORD) ThreadProc,cbCodeSize,NULL);
?????? if (!bc)
?????? {
????????????? return FALSE;
?????? }
?????? pData = VirtualAllocEx (hProc,NULL, sizeof (hypInject), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
?????? if(pData == NULL)
?????? {
????????????? return FALSE;
?????? }
?????? bc = WriteProcessMemory (hProc, pData, &hypInject, sizeof (hypInject), NULL);
?????? if (!bc)
?????? {
????????????? return FALSE;
?????? }
?????? HANDLE ht=CreateRemoteThread(hProc,NULL,NULL,(LPTHREAD_START_ROUTINE)pCode,pData,0,NULL);
?????? if(ht == NULL)
?????? {
????????????? return FALSE;
?????? }
?????? CloseHandle(hProc);
?????? return TRUE;
}
int main()
{
?????? HANDLE hSnapshot = NULL;
?????? hSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL);
?????? PROCESSENTRY32 pe;
?????? pe.dwSize = sizeof(PROCESSENTRY32);
?????? Process32First(hSnapshot,&pe);
?????? do
?????? {
????????????? if(stricmp(pe.szExeFile,"NOTEPAD.EXE")==0)
????????????? {
???????????????????? InjectFunc(pe.th32ProcessID);
???????????????????? break;
????????????? }
?????? }
?????? while(Process32Next(hSnapshot,&pe)==TRUE);
?????? CloseHandle (hSnapshot);????
?????? return 0;
}