Foro de elhacker.net

#define DLL_NAME "\\vac2d.dll"

BOOL LoadRemoteLibrary(DWORD dwPID)
{
	HANDLE hThread;
	void *lpBaseAddr = 0;
	DWORD lpExitCode = 0;
	char lpLibPath[MAX_PATH];

	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID);
	if (!hProcess) return FALSE;

	GetCurrentDirectory(MAX_PATH, lpLibPath);
	strcat(lpLibPath, DLL_NAME);

	lpBaseAddr = VirtualAllocEx(hProcess, NULL, sizeof(lpLibPath), MEM_COMMIT, PAGE_READWRITE);
	if(lpBaseAddr == NULL) return FALSE;
		
	if (!WriteProcessMemory(hProcess, lpBaseAddr, lpLibPath, sizeof(lpLibPath), NULL))
		return FALSE;

	hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA"), lpBaseAddr, 0, NULL);
	if (!hThread) return FALSE;
		
	WaitForSingleObject(hThread, INFINITE);
	GetExitCodeThread(hThread, &lpExitCode);

	CloseHandle(hThread);

	if(!VirtualFreeEx(hProcess, lpBaseAddr, 0, MEM_RELEASE))
		return FALSE;

	CloseHandle(hProcess);

	return TRUE;
}