Advertisement
Guest User

Untitled

a guest
Jun 25th, 2017
58
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.55 KB | None | 0 0
  1. SetDlgItemTextW( STATUSLABEL, L"Waiting for warrock.exe..." );
  2. PROCESSENTRY32 peWarrockProcess;
  3. HANDLE hWarrockProcess;
  4. bool test = false;
  5. while(true)
  6. {
  7. hWarrockProcess = CreateToolhelp32Snapshot( TH32CS_SNAPALL, 0 );
  8. if( hWarrockProcess == INVALID_HANDLE_VALUE ){
  9. SetDlgItemTextW( STATUSLABEL, L"Error: Cannot create process snapshot." );
  10. return;
  11. }
  12. peWarrockProcess.dwSize = sizeof( PROCESSENTRY32 );
  13. BOOL bSucceed = Process32First( hWarrockProcess, &peWarrockProcess );
  14. SetDlgItemTextW( STATUSLABEL, L"Waiting for warrock.exe." );
  15. if( !bSucceed ){
  16. SetDlgItemTextW( STATUSLABEL, L"Error." );
  17. return;
  18. }
  19. while( bSucceed ){
  20. if( stristr(peWarrockProcess.szExeFile, "warrock" ) ){
  21. SetDlgItemTextW( STATUSLABEL, L"Found warrock.exe." );
  22. test = true;
  23. break;
  24. }
  25.  
  26. bSucceed = Process32Next( hWarrockProcess, &peWarrockProcess );
  27. peWarrockProcess.dwSize = sizeof( PROCESSENTRY32 );
  28. }
  29.  
  30. if(test)
  31. {
  32. break;
  33. }
  34. Sleep(500);
  35. }
  36. if(test)
  37. {
  38. if( !peWarrockProcess.th32ProcessID ){
  39. SetDlgItemTextW( STATUSLABEL, L"Error: Could not get the process ID of remote process." );
  40. }
  41. SetDlgItemTextW( STATUSLABEL, L"Injecting DLL." );
  42. HANDLE hWarrockProcessID = OpenProcess( PROCESS_ALL_ACCESS, false, peWarrockProcess.th32ProcessID );
  43. if( !hWarrockProcessID ){
  44. SetDlgItemTextW( STATUSLABEL, L"Error: Could not open remote process." );
  45. return;
  46. }
  47.  
  48. LPVOID lpvLoadLibraryAddr = GetProcAddress( GetModuleHandleA( "kernel32.dll" ), "LoadLibraryA" );
  49. LPVOID lpvResult = VirtualAllocEx( hWarrockProcessID, NULL, strlen( "Sourced_WR.dll" ), MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE );
  50. if( !lpvResult ){
  51. SetDlgItemTextW( STATUSLABEL, L"Error: Cannot allocate memory in remote process" );
  52. CloseHandle( hWarrockProcessID );
  53. return;
  54. }
  55. BOOL bWPRes = WriteProcessMemory( hWarrockProcessID, lpvResult, "Sourced_WR.dll", strlen( "Sourced_WR.dll" ), NULL);
  56. if( !bWPRes ){
  57. SetDlgItemTextW( STATUSLABEL, L"Error: Cannot write to remote process." );
  58. CloseHandle( hWarrockProcessID );
  59. return;
  60. }
  61. if( !CreateRemoteThread( hWarrockProcessID, NULL, NULL, (LPTHREAD_START_ROUTINE)lpvLoadLibraryAddr, lpvResult, NULL, NULL) ){
  62. SetDlgItemTextW( STATUSLABEL, L"Error: Cannot create thread in remote process." );
  63. CloseHandle( hWarrockProcessID );
  64. return;
  65. }
  66. else{
  67. SetDlgItemTextW( STATUSLABEL, peWarrockProcess.szExeFile );
  68. if( bClose ){
  69. CloseHandle( hWarrockProcessID );
  70. ExitProcess( 0 );
  71. }
  72. }
  73. }
  74. else
  75. {
  76. SetDlgItemTextW( STATUSLABEL, L"Error: Could not find warrock.exe" );
  77. }
  78. CloseHandle( hWarrockProcessID );
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement