#undef _UNICODE 
#undef UNICODE 


#include <windows.h> 


typedef HINSTANCE (__stdcall *PLOADLIB)(LPCTSTR); 


struct INJDAT 
{ 
 _TCHAR dll[MAX_PATH]; 
 HINSTANCE hInst; 
 DWORD err; 


 PLOADLIB LoadLibrary; 



}; 


static DWORD WINAPI LLProc(LPVOID _pInjDat) 
{ 
 struct INJDAT *pDat = (struct INJDAT *)_pInjDat; 

 SetLastError(0); 
 pDat->hInst = pDat->LoadLibrary(pDat->dll); 


 if(!pDat->hInst) 
  pDat->err = GetLastError(); 
 else 
  pDat->err = 0; 


 return pDat->err; 



} 


static void LLProcEnd() {} // Mark the end 

HINSTANCE __stdcall InjectDll(HANDLE hProc, LPCTSTR dll) 
{ 
 const unsigned cb = 
  ((unsigned)LLProcEnd) - ((unsigned)LLProc); 


 struct INJDAT dat; 
 HINSTANCE hKernel = 0; 


 PVOID pRemoteDat = 0; 


 HANDLE hThread = 0; 


 DWORD id = 0; 


 LPTHREAD_START_ROUTINE pRemoteProc = 
  (LPTHREAD_START_ROUTINE)VirtualAllocEx( 
  hProc,      // Target process 
  NULL,      // Let the VMM decide where 
  cb,       // Size 
  MEM_COMMIT,     // Commit the memory 
  PAGE_EXECUTE_READWRITE); // Protections 
 if(!pRemoteProc) return 0; 


 __try { 


  if(!WriteProcessMemory( 
   hProc,     // Target process 
   pRemoteProc,   // Source for code 
   LLProc,     // The code 
   cb,      // Code length 
   NULL))     // We don't care 
   return 0; 


  // Now fill in a INJDAT 
  strcpy(dat.dll, dll); 


  hKernel = LoadLibrary("KERNEL32.DLL"); 
  if(!hKernel) return 0; 


  dat.LoadLibrary = 
   (PLOADLIB)GetProcAddress(hKernel, "LoadLibrary"); 
  if(!dat.LoadLibrary) return 0; 


  // Now copy the INJDAT 
  pRemoteDat = VirtualAllocEx(hProc, NULL, 
   sizeof(struct INJDAT), MEM_COMMIT, PAGE_READWRITE); 
  if(!pRemoteDat) return 0; 


  if(!WriteProcessMemory(hProc, pRemoteDat, &dat, 
   sizeof(struct INJDAT), NULL)) 
   return 0; 


  // Now spawn the thread 
  hThread = CreateRemoteThread( 
   hProc,     // Target process 
   NULL,     // No security 
   4096 * 16,    // 16 pages of stack 
   pRemoteProc,   // Thread proc 
   pRemoteDat,    // Data 
   0,      // Run NOW 
   &id); 


  if(!hThread) return 0; 


  // Wait for it!! 
  WaitForSingleObject(hThread, INFINITE); 


  // Read the data back out 
  if(!ReadProcessMemory( 
   hProc,     // Target process 
   pRemoteDat,    // Their data 
   &dat,     // Our data 
   sizeof(struct INJDAT), // Size 
   NULL))     // We don't care 
   return 0; 


  // Restore the status 
  SetLastError(dat.err); 
  return dat.hInst; 


 } 


 __finally // Clean up 
 { 
  DWORD lerr = GetLastError(); 


  if(pRemoteProc) VirtualFreeEx(hProc, pRemoteProc, 
   cb, MEM_RELEASE); 


  if(hKernel) CloseHandle(hKernel); 


  if(pRemoteDat) VirtualFreeEx(hProc, pRemoteDat, 
   sizeof(struct INJDAT), MEM_RELEASE); 


  if(hThread) CloseHandle(hThread); 


  SetLastError(lerr); 
 } 


 return 0; // Something blew up!!