DLL injection Template

// Injector. cpp file.
//
# Include <windows. h>
# Include <tlhelp32.h>

// Configure //-----------------------------------------------------------------------------------------
// DLL injected into the process space.
Bool winapi LoadLib (DWORD dwProcessId, LPTSTR lpszLibName)
{
BOOL bResult = FALSE;
HANDLE hProcess = NULL;
HANDLE hThread = NULL;
PSTR pszLibFileRemote = NULL;

_ Try
{
// Obtain the handle of the process to which the code is to be injected.
HProcess = OpenProcess (
PROCESS_ALL_ACCESS,
FALSE,
DwProcessId
);

If (hProcess = NULL)
_ Leave;

// Calculate the number of bytes required for the DLL path name.
Int cch = 1 + strlen (lpszLibName );

// Allocate space for the path name in a remote thread.
PszLibFileRemote = (PSTR) VirtualAllocEx (
HProcess,
NULL,
Cch,
MEM_COMMIT,
PAGE_READWRITE
);

If (pszLibFileRemote = NULL)
_ Leave;

// Copy the DLL path name to the memory space of the remote process.
If (! WriteProcessMemory (
HProcess,
(PVOID) pszLibFileRemote,
(PVOID) lpszLibName,
Cch,
NULL ))
_ Leave;

// Obtain the real address of LoadLibraryA in Kernel32.dll.
PTHREAD_START_ROUTINE pfnThreadRtn =
(PTHREAD_START_ROUTINE) GetProcAddress (
GetModuleHandle ("Kernel32"), "LoadLibraryA ");

If (pfnThreadRtn = NULL)
_ Leave;

// Create a remote thread and call the user's DLL file through the remote thread.
HThread = CreateRemoteThread (
HProcess,
NULL,
0,
PfnThreadRtn,
(PVOID) pszLibFileRemote,
0,
NULL
);
If (hThread = NULL)
_ Leave;

// Wait for the remote thread to terminate.
WaitForSingleObject (hThread, INFINITE );

BResult = TRUE;
}
_ Finally
{
// Close the handle.
If (pszLibFileRemote! = NULL)
VirtualFreeEx (hProcess, (PVOID) pszLibFileRemote, 0, MEM_RELEASE );

If (hThread! = NULL)
CloseHandle (hThread );

If (hProcess! = NULL)
CloseHandle (hProcess );
}
Return bResult;
}

// Configure //-----------------------------------------------------------------------------------------
// Release the injected DLL in the process space.
Bool winapi FreeLib (DWORD dwProcessId, LPTSTR lpszLibName)
{
BOOL bResult = FALSE;
HANDLE hProcess = NULL;
HANDLE hThread = NULL;
HANDLE hthSnapshot = NULL;
MODULEENTRY32 hMod = {sizeof (hMod )};

_ Try
{
// Open the process.
HProcess = OpenProcess (
PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION,
FALSE,
DwProcessId
);

If (hProcess = NULL)
_ Leave;

// Obtain the address of the FreeLibrary function in Kernel32.dll.
PTHREAD_START_ROUTINE pfnThreadRtn =
(PTHREAD_START_ROUTINE) GetProcAddress (
GetModuleHandle ("Kernel32.dll"), "FreeLibrary ");

If (pfnThreadRtn = NULL)
_ Leave;

// Obtain all the module images of the specified process.
HthSnapshot = createconlhelp32snapshot (TH32CS_SNAPMODULE, dwProcessId );
If (hthSnapshot = NULL)
_ Leave;

// Obtain the specified module in the list of all modules.
BOOL bmoremod = Module32First (hthSnapshot, & hMod );
If (bmoremod = FALSE)
_ Leave;

// Obtain the desired module cyclically.
For (; bmoremod = Module32Next (hthSnapshot, & hMod ))
{
If (strcmp (hMod. szExePath, lpszLibName) = 0) |
(Strcmp (hMod. szModule, lpszLibName) = 0 )){
Break;
}
}

// Create a remote thread to execute the FreeLibrary function.
HThread = CreateRemoteThread (hProcess,
NULL,
0,
PfnThreadRtn,
HMod. modBaseAddr,
0,
NULL );
If (hThread = NULL)
_ Leave;

// Wait for the remote thread to terminate.
WaitForSingleObject (hThread, INFINITE );

BResult = TRUE;

}
_ Finally
{
// Close the handle.
If (hThread! = NULL)
CloseHandle (hThread );

If (hthSnapshot! = NULL)
CloseHandle (hthSnapshot );

If (hProcess! = NULL)
CloseHandle (hProcess );
}

Return bResult;
}

// Injector. h: function prototype definition.
//
# Ifndef _ INJECTOR_H_INCLUDED
# Define _ INJECTOR_H_INCLUDED

Bool winapi LoadLib (DWORD dwProcessId, LPTSTR lpszLibName );
Bool winapi FreeLib (DWORD dwProcessId, LPTSTR lpszLibName );

# Endif