CreateRemoteThread remote thread injection DLL and hook

Although CreateRemoteThread is easy to detect, it is useful in some situations. Always try to find the previous code when you want to use it, and now record it here.

CreateRemoteThread Remote Injection

DWORD Dwoffect,dwargu; BOOL Createremotedll (Const Char*dllfullpath,ConstDWORD Dwremoteprocessid, DWORD Dwoffect,dword Dwargu)    {HANDLE htoken; if(OpenProcessToken (getcurrentprocess (),token_adjust_privileges,&htoken))        {Token_privileges TKP; Lookupprivilegevalue (Null,se_debug_name,&TKP. privileges[0]. LUID);//Modify Process PermissionsTkp. Privilegecount=1; Tkp. privileges[0]. attributes=se_privilege_enabled; AdjustTokenPrivileges (Htoken,false,&TKP,sizeofTkp,null,null);//notifies the system to modify process permissionsCloseHandle (Htoken);    } HANDLE hremoteprocess; //open a remote thread    if((hremoteprocess = openprocess (Process_create_thread |//allow remote creation of threadsprocess_vm_operation |//allow remote VM operationsProcess_vm_write,//allow remote VMs to writeFALSE, dwremoteprocessid) = =NULL) {        returnFALSE; }    Char*Pszlibfileremote; //The memory address space of the remote process allocates the DLL file name bufferPszlibfileremote = (Char*) VirtualAllocEx (hremoteprocess, NULL, Lstrlen (Dllfullpath) +1, Mem_commit, page_readwrite); if(Pszlibfileremote = =NULL)        {CloseHandle (hremoteprocess); returnFALSE; }    //Copy the path name of the DLL to the memory space of the remote process    if(WriteProcessMemory (Hremoteprocess, Pszlibfileremote, (void*) Dllfullpath, Lstrlen (Dllfullpath) +1, NULL) = =0) {CloseHandle (hremoteprocess); returnFALSE; }    //Calculate the entry address for the LoadLibraryAPthread_start_routine pfnstartaddr =(Pthread_start_routine) GetProcAddress (GetModuleHandle (TEXT ("Kernel32")),"LoadLibraryA"); if(Pfnstartaddr = =NULL) {        returnFALSE;    } HANDLE Hremotethread; Hremotethread= CreateRemoteThread (hremoteprocess, NULL,0, Pfnstartaddr, Pszlibfileremote,0, NULL);    WaitForSingleObject (Hremotethread,infinite); if(Hremotethread = =NULL)        {CloseHandle (hremoteprocess); returnFALSE;    } DWORD dwdlladdr; GetExitCodeThread (Hremotethread,&dwdlladdr); if(dwdlladdr!=0) {dwdlladdr+=Dwoffect;        HANDLE Hhookfunc; Hhookfunc= CreateRemoteThread (hremoteprocess, NULL,0, (Pthread_start_routine) dwdlladdr, (LPVOID) Dwargu,0, NULL);        WaitForSingleObject (Hhookfunc,infinite); if(Hhookfunc = =NULL)            {CloseHandle (hremotethread);            CloseHandle (hremoteprocess); returnFALSE;    } closehandle (Hhookfunc); }    Else{CloseHandle (hremoteprocess);        CloseHandle (Hremotethread); returnFALSE;    } closehandle (hremoteprocess);    CloseHandle (Hremotethread); returnTRUE;}voidHook (intdwpid) {     Charcurpath[260]; GetModuleFileName (Null,curpath,260); *STRRCHR (Curpath,'\\') =' /'; strcat (Curpath,"\\this.dll"); Hmodule Htmpdll=LoadLibrary (Curpath); Dwoffect= (DWORD) GetProcAddress (Htmpdll,"Hookfun"); Dwoffect-=(DWORD) Htmpdll;    FreeLibrary (Htmpdll); Createremotedll (Curpath,dwpid,dwoffect,dwargu);}

Hook code

__declspec (naked)voidmyhookgetres () {__asm {Pushad pushfd} myfun (); __asm {POPFD popad add esp,0xcjmp Uretaddr}} ULONG uhookaddr=0x11111+(DWORD) hmodule; HANDLE HANDLE=getcurrentprocess ();Charmyjmp[5]={0}; myjmp[0]=(Char)0xe9; ULONG utempaddr=(ULONG) myjmp;uretaddr= Uhookaddr +5; ULONG uskilljmp= (ULONG) myhookgetres-uhookaddr-5; __asm{mov eax,uskilljmp mov ebx, utempaddr add ebx,1mov [EBX],EAX mov ecx,[ebx]} WriteProcessMemory (handle, (LPVOID) (UHOOKADDR), (LPVOID) myjmp,5, NULL);

CreateRemoteThread remote thread injection DLL and hook