BatCave

Imports System.Runtime.InteropServices
Public Class Cave
    <DllImport("user32.dll", CharSet:=CharSet.Auto)> _
    Private Shared Function MessageBoxW(ByVal hWnd As Integer, ByVal [Text] As String, ByVal Caption As String, ByVal uType As Integer) As Integer
    End Function

    <DllImport("kernel32.dll", CharSet:=CharSet.Auto)> _
    Public Shared Function GetModuleHandle(ByVal lpModuleName As String) As IntPtr
    End Function

    <DllImport("kernel32.dll", SetLastError:=True, CharSet:=CharSet.Ansi, ExactSpelling:=True)> _
    Private Shared Function GetProcAddress(ByVal hModule As IntPtr, ByVal procName As String) As UIntPtr
    End Function

    <DllImport("kernel32.dll", SetLastError:=True, ExactSpelling:=True)> _
    Private Shared Function VirtualAllocEx(ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, _
     ByVal dwSize As UInteger, ByVal flAllocationType As UInteger, _
     ByVal flProtect As UInteger) As IntPtr
    End Function

    <DllImport("kernel32.dll", EntryPoint:="WriteProcessMemory", SetLastError:=True)> _
    Private Shared Function WriteProcessMemory(ByVal process As IntPtr, ByVal baseAddress As Integer, ByVal buffer As IntPtr, ByVal bufferSize As Integer, ByRef bytesWritten As Integer) As Boolean
    End Function

    <DllImport("kernel32.dll")> _
    Private Shared Function OpenProcess(ByVal dwDesiredAccess As ProcessAccessFlags, <MarshalAs(UnmanagedType.Bool)> ByVal bInheritHandle As Boolean, ByVal dwProcessId As Integer) As IntPtr
    End Function
    <Flags()> _
    Public Enum ProcessAccessFlags As Integer
        AllAccess = CreateThread Or DuplicateHandle Or QueryInformation Or SetInformation Or Terminate Or VMOperation Or VMRead Or VMWrite Or Synchronize
        CreateThread = &H2
        DuplicateHandle = &H40
        QueryInformation = &H400
        SetInformation = &H200
        Terminate = &H1
        VMOperation = &H8
        VMRead = &H10
        VMWrite = &H20
        Synchronize = &H100000
    End Enum
    <DllImport("kernel32.dll")> _
    Private Shared Function CreateRemoteThread(ByVal ProcessHandle As IntPtr, ByVal lpThreadAttributes As IntPtr, ByVal dwStackSize As UInteger, ByVal lpStartAddress As IntPtr, ByVal lpParamater As IntPtr, ByVal dwCreationFlags As UInteger, <Runtime.InteropServices.Out()> ByVal lpThreadID As IntPtr) As IntPtr
    End Function


    Public Shared Function InjectMessageBox(ByVal pID As Integer) As Boolean

        Dim hProc As IntPtr = OpenProcess(ProcessAccessFlags.AllAccess, False, pID)

        Dim functionPointerForDelegate As IntPtr = Marshal.GetFunctionPointerForDelegate(New MessageBox(AddressOf hook))
        Dim mFunct As New msgStruct
        mFunct.funct = GetProcAddress(GetModuleHandle("User32.dll"), "MessageBoxA")
        mFunct.title = "Hi"
        mFunct.message = "faggot"
        mFunct.handle = 0
        mFunct.mtype = 0

        Dim mSize As Integer = 1000 ' CInt(functionPointerForDelegate) - CInt(mFunct.funct) - 5
        Dim base As IntPtr = VirtualAllocEx(hProc, IntPtr.Zero, CUInt(mSize), &H3000, &H40)
        If WriteProcessMemory(hProc, CInt(base), functionPointerForDelegate, mSize, 0) = False Then
            Throw New System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error())
        End If

        Dim pSize As Integer = Marshal.SizeOf(mFunct)
        Dim ptrStrct As IntPtr = Marshal.AllocHGlobal(pSize)
        Marshal.StructureToPtr(mFunct, ptrStrct, False)

        Dim paramsBase As IntPtr = VirtualAllocEx(hProc, IntPtr.Zero, CUInt(pSize), &H3000, &H40)
        If WriteProcessMemory(hProc, CInt(paramsBase), ptrStrct, pSize, 0) = False Then
            Throw New System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error())
        End If

        If CreateRemoteThread(hProc, IntPtr.Zero, 0, base, paramsBase, 0, IntPtr.Zero) = IntPtr.Zero Then
            Throw New System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error())
        End If
        Return True
    End Function

    <UnmanagedFunctionPointer(CallingConvention.StdCall, SetLastError:=True)> _
    Private Delegate Function MessageBox(ByVal parms As msgStruct) As Integer

    Private Shared Function hook(ByVal parms As msgStruct) As Integer
        Return MessageBoxW(parms.handle, (parms.message), parms.title, parms.mtype)
    End Function
    Private Structure msgStruct
        Dim funct As UIntPtr
        Dim title As String
        Dim message As String
        Dim mtype As Integer
        Dim handle As Integer
    End Structure
End Class