#include <Windows.h>
#include <stdio.h>
 
char *driver = "C:\\hellowWorld.sys";
 
void instalar_driver() {
	SC_HANDLE Manager = OpenSCManager(NULL, NULL, SC_MANAGER_CREATE_SERVICE);
	if (Manager != ERROR) {
		printf("\nCargando el driver...");
		SC_HANDLE Service = CreateService(Manager, "TEST", "TEST", SERVICE_START | DELETE | SERVICE_STOP, SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, SERVICE_ERROR_IGNORE, driver, NULL, NULL, NULL, NULL, NULL);
		if (Service == ERROR) {
			Service = OpenService(Manager, "TEST", SERVICE_START | DELETE | SERVICE_STOP);
 
		}
		if (Service) {
			StartService(Service, 0, NULL);
			printf("\nServicio Ejecutado");
		}
		CloseServiceHandle(Manager);
	}
 
}
 
void eliminar_driver() {
 
	SC_HANDLE Manager = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
	if (Manager != ERROR) {
		SC_HANDLE Service = OpenService(Manager, "TEST", SERVICE_START | DELETE | SERVICE_STOP);
		if (Service != ERROR) {
			SERVICE_STATUS status;
			ControlService(Service, SERVICE_CONTROL_STOP, &status);
			printf("\nServicio Detenido");
			DeleteService(Service);
			printf("\nServicio Eliminado");
			CloseServiceHandle(Service);
		}
		CloseServiceHandle(Manager);
	}
}
 
int main(void) {
	int opcion;
	while (1)
	{
		printf("\n1) cargar driver");
		printf("\n2) eliminar driver de la memoria");
		printf("\n3) salir del menu");
		printf("\n\n->  ");
		scanf("%d", &opcion);
		switch (opcion) {
		case 1:
			instalar_driver();
			break;
		case 2:
			eliminar_driver();
			break;
		case 3:
			exit(1);
 
		default:
			printf("\n\nOpcion incorrecta");
			break;
		}
 
	}
	return 0;
}
 

#include <ntddk.h>
 
 
VOID Unload(PDRIVER_OBJECT DriverObject)
{
	DbgPrint("Driver Unloaded From Memory\n");
}
 
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegisterPath)
{
	DbgPrint("Hellow World From Kernel Space\n");
	DriverObject->DriverUnload = Unload;  // No siempre hay que limpiar el codigo , pero si es recomendable si vamos a hacer pruebas, ya que , de lo contrario hay que reiniciar el ordenador continuamente
	return STATUS_SUCCESS;
}

#include <Windows.h>
 
BOOL APIENTRY DllMain(HMODULE hMod, DWORD callback, LPVOID Param) 
{
	switch(callback)
	{
	case DLL_PROCESS_ATTACH:
aqui ponemos el codigo que queremos que se ejecute en la dll
		MessageBoxW(NULL, TEXT("Hola desde proceso injectado !"), TEXT("Test"), MB_ICONINFORMATION);
	case DLL_PROCESS_DETACH:
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	default:
		break;
	}
	return TRUE;
}

#include <Windows.h>
#include <stdio.h>
#include <winternl.h>
 
#pragma comment(lib, "ntdll.lib")
 
typedef struct _CLIENT_ID
{
	HANDLE	UniqueProcess;
	HANDLE	UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
 
 extern "C" NTSTATUS NTAPI ZwOpenProcess(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientID);
 
 
int main(int argc, char *argv[]) {
 
	char *ruta_dll = "C:\\Dlltest.dll";
	ULONG pid;
	OBJECT_ATTRIBUTES oa;
	HANDLE hproc;
	CLIENT_ID cid;
	NTSTATUS status;
 
 
	printf("\n pid -> ");
	scanf("%d", &pid);
 
 
	cid.UniqueProcess = (HANDLE)pid;
	cid.UniqueThread = 0;
	InitializeObjectAttributes(&oa, NULL, 0, NULL, NULL);
	if(NT_SUCCESS(ZwOpenProcess(&hproc, PROCESS_ALL_ACCESS, &oa, &cid))) {
		if(NT_SUCCESS(status)) {
			HMODULE dll = GetModuleHandle(L"kernel32");
			if(dll != NULL) {
				FARPROC load = GetProcAddress(dll, "LoadLibraryA");
				if(load != ERROR) {
					LPVOID base = VirtualAllocEx(hproc, NULL, 256, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
					if(base != ERROR) {
						BOOL exito = WriteProcessMemory(hproc, base, ruta_dll, strlen(ruta_dll) + 1, NULL);
						if(exito != 0) {
							HANDLE thread = CreateRemoteThread(hproc, NULL, NULL, (LPTHREAD_START_ROUTINE)load, base, NULL, NULL);
							if(thread != ERROR) {
								printf("\n dll inyectada en proceso id: %d", pid);
							}
						}
					}
				}
			}
		}
	}
	return 0;
 
}
 

#include <Windows.h>
#include <winternl.h>
#include <stdio.h>
 
 
#pragma comment(lib, "ntdll.lib")
 
typedef struct _CLIENT_ID
{
     PVOID UniqueProcess;
     PVOID UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
 
EXTERN_C NTSTATUS NTAPI NtOpenProcess(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
EXTERN_C NTSTATUS NTAPI NtTerminateProcess(HANDLE, NTSTATUS);
 
void main() {
	OBJECT_ATTRIBUTES oa;
	HANDLE hProc;
	ULONG pid;
	CLIENT_ID cid;
 
 
	printf("\n introduce pid-> ");
	scanf("%ld", &pid);
	cid.UniqueProcess = (HANDLE)pid;
	cid.UniqueThread = 0;
	InitializeObjectAttributes(&oa, NULL, 0, NULL, NULL);
	if(NT_SUCCESS(NtOpenProcess(&hProc, PROCESS_TERMINATE, &oa, &cid))) {
		NTSTATUS status = NtTerminateProcess(hProc, 1);
		if(NT_SUCCESS(status)) {
			MessageBoxW(0, TEXT("proceso terminado"), TEXT("test"), MB_ICONINFORMATION);
		}
	}
	NtClose(hProc);
 
 
 
 
}

int privilegios() //esto nos dara los permisos para inyectar en otros procesos
{
        HANDLE Token;
	TOKEN_PRIVILEGES tp;
	if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | 
                  TOKEN_QUERY, &Token))
	{
		LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);
		int i = GetLastError();
		tp.PrivilegeCount = 1;
		tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		if (AdjustTokenPrivileges(Token, 0, &tp, sizeof(tp), NULL, NULL) == 0) {
			return 1;
		}
		else {
			if (GetLastError() == ERROR_SUCCESS) {
				return 1;
			}
			else {
				return 0;
			}
		}
	}
	return 1;
}
 
int main()
{
	privilegios(); 
	return EXIT_SUCCESS;
}