Encapsulate remote injection class CreateRemoteThreadEx

Class initialization, input the DLL file name to be injected

Use only two functions
// Inject DLL to the specified address space
BOOL InjectModuleInto (DWORD dwProcessId );
// Detach the DLL from the specified address space
BOOL EjectModuleFrom (DWORD dwProcessId );

. H

1. # pragma once
2. # include <windows. h> // include
3.
4. class CRemThreadInject
5 .{
6. public:
7. CRemThreadInject (LPSTR lpDllName );
8 .~ CRemThreadInject (void );
9.
10. protected:
11. char m_szDllName [MAX_PATH];
12. static BOOL EnableDebugPrivilege (BOOL bEnable );
13. public:
14. // inject DLL to the specified address space
15. BOOL InjectModuleInto (DWORD dwProcessId );
16. // detach the DLL from the specified address space
17. BOOL EjectModuleFrom (DWORD dwProcessId );
18 .};

. Cpp
1. # include "RemThreadInject. h"
2. # include <tlhelp32.h>
3.
4. www.2cto.com
5.
6. CRemThreadInject: CRemThreadInject (LPSTR lpDllName)
7 .{
8. memcpy (m_szDllName, lpDllName, MAX_PATH );
9. EnableDebugPrivilege (TRUE );
10 .}
11.
12.
13. CRemThreadInject ::~ CRemThreadInject (void)
14 .{
15. EnableDebugPrivilege (FALSE );
16 .}
17.
18. BOOL CRemThreadInject: EnableDebugPrivilege (BOOL bEnable)
19 .{
20. HANDLE hToken = INVALID_HANDLE_VALUE;
21. // OpenProcessToken
22. if (0 ==:: OpenProcessToken (: GetCurrentProcess (), TOKEN_ADJUST_PRIVILEGES, & hToken ))
23 .{
24. return FALSE;
25 .}
26. LUID luid;
27.
28 .//
29.: LookupPrivilegeValue (NULL, SE_DEBUG_NAME, & luid );
30. TOKEN_PRIVILEGES tp;
31. tp. PrivilegeCount = 1;
32. tp. Privileges [0]. Luid = luid;
33. if (bEnable)
34. tp. Privileges [0]. Attributes = SE_PRIVILEGE_ENABLED;
35. else
36. tp. Privileges [0]. Attributes = 0;
37. if (! AdjustTokenPrivileges (
38. hToken,
39. FALSE,
40. & tp,
41. sizeof (TOKEN_PRIVILEGES ),
42. (PTOKEN_PRIVILEGES) NULL,
43. (PDWORD) NULL ))
44 .{
45. return FALSE;
46 .}
47. if (GetLastError () = ERROR_NOT_ALL_ASSIGNED)
48 .{
49. return FALSE;
50 .}
51.: CloseHandle (hToken );
52. return TRUE;
53 .}
54.
55. // inject DLL to the specified address space
56. BOOL CRemThreadInject: InjectModuleInto (DWORD dwProcessId)
57 .{
58 .//
59. if (: GetCurrentProcessId () = dwProcessId)
60 .{
61. return FALSE;
62 .}
63. BOOL bFound;
64. /*************************************** *********************************/
65./* traversal module */
66. /*************************************** *********************************/
67. HANDLE hModuleSnap = INVALID_HANDLE_VALUE;
68. MODULEENTRY32 me32;
69.
70. // Take a snapshot of all modules in the specified process.
71. hModuleSnap = createconlhelp32snapshot (TH32CS_SNAPMODULE, dwProcessId );
72. if (hModuleSnap = INVALID_HANDLE_VALUE)
73 .{
74. return (FALSE );
75 .}
76. me32.dwSize = sizeof (MODULEENTRY32 );
77. if (! Module32First (hModuleSnap, & me32 ))
78 .{
79. CloseHandle (hModuleSnap); // Must clean up the snapshot object!
80. return (FALSE );
81 .}
82. do
83 .{
84. if (stricmp (me32.szModule, m_szDllName) = 0)
85 .{
86. bFound = TRUE;
87. break;
88 .}
89.} while (Module32Next (hModuleSnap, & me32 ));
90.
91. // Do not forget to clean up the snapshot object.
92. CloseHandle (hModuleSnap );
93.
94. if (bFound) // if the module has been loaded, it will not be loaded
95 .{
96. return FALSE;
97 .}
98.
99. // if not loaded, open the process and perform remote injection.
100.
101. HANDLE hProcess =: OpenProcess (PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwProcessId );
102. if (hProcess = NULL)
103 .{
104. return FALSE;
105 .}
106. HMODULE hKernerl32 = GetModuleHandle ("kernel32.dll ");
107. LPTHREAD_START_ROUTINE pfnLoadLibraryA = (LPTHREAD_START_ROUTINE): GetProcAddress (hKernerl32, "LoadLibraryA ");
108.
109. int cbSize = strlen (m_szDllName) + 1;
110. LPVOID lpRemoteDllName =: VirtualAllocEx (hProcess, 0, cbSize, MEM_COMMIT, PAGE_READWRITE );
111.: WriteProcessMemory (hProcess, lpRemoteDllName, m_szDllName, cbSize, NULL );
112. HANDLE hRemoteThread =: CreateRemoteThreadEx (hProcess, NULL, 0, pfnLoadLibraryA, lpRemoteDllName, 0, NULL, NULL );
113. if (NULL = hRemoteThread)
114 .{
115.: CloseHandle (hProcess );
116. return FALSE;
117 .}
118. // wait until the running of the target thread ends, that is, the LoadLibraryA function returns
119.: WaitForSingleObject (hRemoteThread, INFINITE );
120.: CloseHandle (hRemoteThread );
121.: CloseHandle (hProcess );
122. return TRUE;
123 .}
124.
125.
126. // detach the DLL from the specified address space
127. BOOL CRemThreadInject: EjectModuleFrom (DWORD dwProcessId)
128 .{
129 .//
130. if (: GetCurrentProcessId () = dwProcessId)
131 .{
132. return FALSE;
133 .}
134. BOOL bFound;
135. /*************************************** *********************************/
136./* traversal module */
137. /*************************************** *********************************/
138. HANDLE hModuleSnap = INVALID_HANDLE_VALUE;
139. MODULEENTRY32 me32;
140.
141. // Take a snapshot of all modules in the specified process.
142. hModuleSnap = createconlhelp32snapshot (TH32CS_SNAPMODULE, dwProcessId );
143. if (hModuleSnap = INVALID_HANDLE_VALUE)
144 .{
145. return (FALSE );
146 .}
147. me32.dwSize = sizeof (MODULEENTRY32 );
148. if (! Module32First (hModuleSnap, & me32 ))
149 .{
150. CloseHandle (hModuleSnap); // Must clean up the snapshot object!
151. return (FALSE );
152 .}
153. do
154 .{
155. if (stricmp (me32.szModule, m_szDllName) = 0)
156 .{
157. bFound = TRUE;
158. break;
159 .}
160.} while (Module32Next (hModuleSnap, & me32 ));
161.
162. // Do not forget to clean up the snapshot object.
163. CloseHandle (hModuleSnap );
164.
165. if (! BFound) // if no module is loaded, it cannot be uninstalled.
166 .{
167. return FALSE;
168 .}
169.
170. // if it is loaded, open the process and perform remote injection.
171.
172. HANDLE hProcess =: OpenProcess (PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwProcessId );
173. if (hProcess = NULL)
174 .{
175. return FALSE;
176 .}
177. HMODULE hKernerl32 = GetModuleHandle ("kernel32.dll ");
178. LPTHREAD_START_ROUTINE pfnFreeLibrary = (LPTHREAD_START_ROUTINE): GetProcAddress (hKernerl32, "FreeLibrary ");
179.
180. int cbSize = strlen (m_szDllName) + 1;
181. LPVOID lpRemoteDllName =: VirtualAllocEx (hProcess, 0, cbSize, MEM_COMMIT, PAGE_READWRITE );
182.: WriteProcessMemory (hProcess, lpRemoteDllName, m_szDllName, cbSize, NULL );
183. HANDLE hRemoteThread =: CreateRemoteThreadEx (hProcess, NULL, 0, pfnFreeLibrary, lpRemoteDllName, 0, NULL, NULL );
184. if (NULL = hRemoteThread)
185 .{
186.: CloseHandle (hProcess );
187. return FALSE;
188 .}
189. // wait until the running of the target thread ends, that is, the LoadLibraryA function returns
190.: WaitForSingleObject (hRemoteThread, INFINITE );
191.: CloseHandle (hRemoteThread );
192.: CloseHandle (hProcess );
193. return TRUE;
194 .}