Calling Other Processes Functions

// 32 bit procceses only
// only cdecl functions
// took some of this from some injector source

#define MAX_CALLER_ARGUMENTS 16
typedef struct _CALLER_ARGUMENTS {
    PVOID lpAddress;
    DWORD dwArguments[MAX_CALLER_ARGUMENTS];
} CALLER_ARGUMENTS, *PCALLER_ARGUMENTS;

#pragma optimize("", off)
DWORD caller(PCALLER_ARGUMENTS cargs) {
    return ((DWORD (__cdecl *)(...))cargs->lpAddress)(cargs->dwArguments[0], cargs->dwArguments[1], cargs->dwArguments[2], cargs->dwArguments[3], cargs->dwArguments[4], cargs->dwArguments[5], cargs->dwArguments[6], cargs->dwArguments[7], cargs->dwArguments[8], cargs->dwArguments[9], cargs->dwArguments[10], cargs->dwArguments[11], cargs->dwArguments[12], cargs->dwArguments[13], cargs->dwArguments[14], cargs->dwArguments[15]);
}
#pragma optimize("", on)

PVOID GetProcessBaseAddress(HANDLE hProcess) {
    HANDLE ModuleSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetProcessId(hProcess));
    MODULEENTRY32 ModuleEntry;
    ModuleEntry.dwSize = sizeof(MODULEENTRY32);
    Module32First(ModuleSnapshot, &ModuleEntry);
    return ModuleEntry.modBaseAddr;
}

HANDLE OpenProcess(LPCSTR ProcessName) {
    HANDLE ProcessSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
    PROCESSENTRY32 ProcessEntry;
    ProcessEntry.dwSize = sizeof(PROCESSENTRY32);
    Process32First(ProcessSnapshot, &ProcessEntry);
    do {
        if(!strcmp(ProcessEntry.szExeFile, ProcessName)) {
            return OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessEntry.th32ProcessID);
        }
    } while(Process32Next(ProcessSnapshot, &ProcessEntry));
}

DWORD call_remote_function(HANDLE hProcess, PVOID lpAddress, DWORD cArguments, ...) {
    LPVOID lpCallerAddress = VirtualAllocEx(hProcess, NULL, 0x7F, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    WriteProcessMemory(hProcess, lpCallerAddress, caller, 0x7F, NULL);

    CALLER_ARGUMENTS cargs;
    cargs.lpAddress = (PVOID)((DWORD)GetProcessBaseAddress(hProcess) + (DWORD)lpAddress);

    va_list vl;
    va_start(vl, cArguments);
    for(DWORD i = 0; i < cArguments; i++) {
        cargs.dwArguments[i] = va_arg(vl, DWORD);
    }
    va_end(vl);

    LPVOID lpCallerArgumentsAddress = VirtualAllocEx(hProcess, NULL, sizeof(CALLER_ARGUMENTS), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    WriteProcessMemory(hProcess, lpCallerArgumentsAddress, &cargs, sizeof(CALLER_ARGUMENTS), NULL);

    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0x1000, (LPTHREAD_START_ROUTINE)lpCallerAddress, lpCallerArgumentsAddress, 0, NULL);
    WaitForSingleObject(hThread, INFINITE);
    DWORD dwReturn = 0;
    GetExitCodeThread(hThread, &dwReturn);

    VirtualFreeEx(hProcess, lpCallerAddress, 0x7F, MEM_RELEASE);
    VirtualFreeEx(hProcess, lpCallerArgumentsAddress, sizeof(CALLER_ARGUMENTS), MEM_RELEASE);

    return dwReturn;
}

DWORD remote_foo(DWORD a) {
    return call_remote_function(OpenProcess("B.exe"), (PVOID)0x1000, 1, a);
}