Dll_Injector

#include <stdlib.h>
#include <stdio.h>
#include <Windows.h>

int main(int argc, CHAR *argv[])
{
    int pid = 0;
    DWORD number_written;
    pid = atoi(argv[1]);
    CHAR *dll_path;
    dll_path = argv[2];
    LPCWSTR kernel = LPCWSTR("kernel32.dll");
    char *buffer;

    // Get handle to kernel32 module
    HMODULE kernel32 = GetModuleHandle(TEXT("kernel32.dll"));
    if (kernel32 == NULL)
    {
        printf("Can't get handle to kernel32 %d", GetLastError());
    }

    // Get the address of loadlibrary function
    FARPROC loadLibrary = GetProcAddress(kernel32, "LoadLibraryA");
    //LoadLibraryA(dll_path);
    if (!loadLibrary)
    {
        int f = GetLastError();
        printf("Cant get loadlibrary address %d", f);
    }

    HANDLE victim_process = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
    if (victim_process == INVALID_HANDLE_VALUE)
    {
        printf("Can't open remote process");
        return 0;
    }

    // Because every process has it's own address so we write the name of the dll itself in order for the program to load it
    LPVOID remoteDllName = VirtualAllocEx(victim_process, NULL, strlen(dll_path) + 1, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (remoteDllName == NULL)
    {
        printf("Can't allocate on the remote process");
    }

    // We write the name of the dll to the victim process using the address we got with virtual alloc
    if (!WriteProcessMemory(victim_process, remoteDllName, dll_path, strlen(dll_path) + 1, &number_written))
    {
        printf("Can't write to the remote process");
    }

    // Creates the remote thread on the target process.
    HANDLE remoteThread = CreateRemoteThread(victim_process, NULL, 0, (LPTHREAD_START_ROUTINE)loadLibrary, remoteDllName, 0, NULL);
    if (!remoteThread)
    {
        int j = GetLastError();
        printf("Cant open thread on the remote thread ERROR: %d", j);

    }
    // Wait for the thread to finish.
    bool finished = WaitForSingleObject(remoteThread, 10000) !=
        WAIT_TIMEOUT;
    VirtualFreeEx(victim_process, remoteDllName, sizeof(dll_path), MEM_RELEASE);
    CloseHandle(victim_process);



    return 0;
}