/* Inyección de Dll escrito por Hendrix
* en base al codigo en C de MazarD por
* CreateRemoteThread.
*
* Fecha: 2-6-2007
*
* Dll echa en Vc++
*/
using System;
using System.Collections.Generic;
using System.Text;
using System.Runtime.InteropServices;
using System.Diagnostics;
using System.ComponentModel;
using System.IO;
namespace ConsoleApplication1
{
class Apis
{
[DllImport("kernel32.dll", EntryPoint = "OpenProcess")]
public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, uint dwProcessId);
[DllImport("kernel32", CharSet = CharSet.Ansi)]
public extern static int GetProcAddress(int hwnd, string procedureName);
[DllImport("kernel32.dll", EntryPoint = "GetModuleHandle")]
public static extern int GetModuleHandle(string lpModuleName);
[DllImport("kernel32.dll", EntryPoint = "VirtualAllocEx")]
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool CloseHandle(IntPtr hObject);
[DllImport("kernel32", EntryPoint = "CreateRemoteThread")]
public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, uint lpThreadId);
[DllImport("kernel32.dll",EntryPoint = "WriteProcessMemory")]
public static extern IntPtr WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] buffer, uint size, IntPtr lpNumberOfBytesWritten);
}
class Program
{
static int Main(string[] args)
{
uint pid;
int load;
uint tama;
string ladll;
string nom;
const uint PROCESS_ALL_ACCESS = 0x000F0000 | 0x00100000 | 0xFFF;
const uint MEM_COMMIT = 0x1000;
const uint MEM_RESERVE = 0x2000;
const uint PAGE_READWRITE = 0x40;
try
{
Console.Write("Introduce el nombre del proceso (sin la extension): ");
nom = Console.ReadLine();
Console.Write("\nIntroduce la ruta de la dll a inyectar: ");
ladll = Console.ReadLine();
if (File.Exists(ladll) == false)
{
Console.WriteLine("La ruta de la Dll no existe");
Console.Read();
return 0;
}
Byte[] dll = Encoding.ASCII.GetBytes(ladll);
tama = Convert.ToUInt32(ladll.Length);
Process[] nombre = Process.GetProcessesByName(nom);
if (nombre.Length == 0)
{
Console.WriteLine("El proceso no existe");
Console.Read();
return 0;
}
pid = Convert.ToUInt32(nombre[0].Id);
IntPtr proc = Apis.OpenProcess(PROCESS_ALL_ACCESS, false, pid);
load = Apis.GetProcAddress(Apis.GetModuleHandle("kernel32.dll"), "LoadLibraryA");
IntPtr nLoad = new IntPtr(load);
IntPtr rems = Apis.VirtualAllocEx(proc, IntPtr.Zero, Convert.ToUInt32(ladll.Length), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
Apis.WriteProcessMemory(proc, rems, dll, tama, IntPtr.Zero);
Apis.CreateRemoteThread(proc, IntPtr.Zero, 0, nLoad, rems, 0, 0);
Apis.CloseHandle(proc);
return 1;
}
catch
{
Console.WriteLine("\nUn error ha ocurrido.");
Console.ReadLine();
return 0;
}
}
}
}