Dll Injection - watek nie reaguje.

DWORD Inject::CreateRemoteThreadW(PCWSTR pszLibFile, DWORD dwProcessId) {

	// Calculate the number of bytes needed for the DLL's pathname
	DWORD dwSize = (lstrlenW(pszLibFile) + 1) * sizeof(wchar_t);

	// Get process handle passing in the process ID
	HANDLE hProcess = OpenProcess(
		PROCESS_QUERY_INFORMATION |
		PROCESS_CREATE_THREAD |
		PROCESS_VM_OPERATION |
		PROCESS_VM_WRITE,
		FALSE, dwProcessId);
	if (hProcess == NULL)
	{
		wprintf(TEXT("[-] Error: Could not open process for PID (%d).\n"), dwProcessId);
		return(1);
	}

	// Allocate space in the remote process for the pathname
	LPVOID pszLibFileRemote = (PWSTR)VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE);
	if (pszLibFileRemote == NULL)
	{
		wprintf(TEXT("[-] Error: Could not allocate memory inside PID (%d).\n"), dwProcessId);
		return(1);
	}

	// Copy the DLL's pathname to the remote process address space
	DWORD n = WriteProcessMemory(hProcess, pszLibFileRemote, (PVOID)pszLibFile, dwSize, NULL);
	if (n == 0)
	{
		wprintf(TEXT("[-] Error: Could not write any bytes into the PID [%d] address space.\n"), dwProcessId);
		return(1);
	}

	// Get the real address of LoadLibraryW in Kernel32.dll
	PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryW");
	if (pfnThreadRtn == NULL)
	{
		wprintf(TEXT("[-] Error: Could not find LoadLibraryA function inside kernel32.dll library.\n"));
		return(1);
	}

	// Create a remote thread that calls LoadLibraryW(DLLPathname)
	HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, pfnThreadRtn, pszLibFileRemote, 0, NULL);
	if (hThread == NULL)
	{
		wprintf(TEXT("[-] Error: Could not create the Remote Thread.\n"));
		return(1);
	}
	else
		wprintf(TEXT("[+] Success: DLL injected via CreateRemoteThread().\n"));

	// Wait for the remote thread to terminate
	WaitForSingleObject(hThread, INFINITE);

	// Free the remote memory that contained the DLL's pathname and close Handles
	if (pszLibFileRemote != NULL)
		VirtualFreeEx(hProcess, pszLibFileRemote, 0, MEM_RELEASE);

	if (hThread != NULL)
		CloseHandle(hThread);

	if (hProcess != NULL)
		CloseHandle(hProcess);

	return(0);
}

// dllmain.cpp : Defines the entry point for the DLL application.
#include "pch.h"
#include <iostream>

BOOL APIENTRY DllMain(HMODULE hModule,
	DWORD  ul_reason_for_call,
	LPVOID lpReserved
)
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		std::cout << "Proc attach\n";

	case DLL_THREAD_ATTACH:
		std::cout << "Thread attach!\n";

	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}

	std::cout << "Hello World!\n";

	return TRUE;
}

#include <iostream>
#include "Inject.h"
#include "SystemInformations.h"

int main()
{
	PCWSTR pszLibFile = NULL;
	pszLibFile = (wchar_t*)malloc((wcslen(L"sciezka do plika") + 1) * sizeof(wchar_t));
	pszLibFile = L"sciezka do plika";

	wchar_t x[] = L"Calculator.exe";
	wchar_t* point = x; 


	Inject injection;
	SystemInformations sysInfo;
	DWORD pid = sysInfo.findPidByName(point);

	injection.CreateRemoteThreadW(pszLibFile, pid);
}

    case DLL_PROCESS_ATTACH:
        std::cout << "Proc attach\n";

    case DLL_THREAD_ATTACH:
        std::cout << "Thread attach!\n";

#include "pch.h"
#include <iostream>
#include <fstream>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		MessageBox(NULL, L"Dll process attach", L"Info", MB_OK);
		break;

	case DLL_THREAD_ATTACH:
		MessageBox(NULL, L"Thread attach", L"Info", MB_OK);
		break;

	case DLL_THREAD_DETACH:
		break;
	case DLL_PROCESS_DETACH:
		break;
	}

	std::ofstream myfile("C:\\Users\\MojKomputer\\Desktop\\testowyplik.txt", std::ofstream::binary);

	myfile << "Bla bla bla\n";
	myfile.close();

	return TRUE;
}

#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		MessageBox(NULL, "Dll process attach", "Info", MB_OK);
		break;

	case DLL_THREAD_ATTACH:
		break;
	case DLL_THREAD_DETACH:
		break;
	case DLL_PROCESS_DETACH:
		break;
	}

	return TRUE;
}

#include <windows.h>
#include <stdio.h>

DWORD InjectDll(PCWSTR pszLibFile, DWORD dwProcessId) 
{
	DWORD dwSize = (lstrlenW(pszLibFile) + 1) * sizeof(wchar_t);

	HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, 
								FALSE, 
								dwProcessId);
	if (hProcess == NULL) {
		printf("[-] Error: Could not open process for PID (%d).\n", dwProcessId);
		return 1;
	}

	LPVOID pszLibFileRemote = (PWSTR)VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE);
	if (pszLibFileRemote == NULL) {
		printf("[-] Error: Could not allocate memory inside PID (%d).\n", dwProcessId);
		return 1;
	}

	DWORD n = WriteProcessMemory(hProcess, pszLibFileRemote, (PVOID)pszLibFile, dwSize, NULL);
	if (n == 0) {
		printf("[-] Error: Could not write any bytes into the PID [%d] address space.\n", dwProcessId);
		return 1;
	}

	PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryW");
	if (pfnThreadRtn == NULL) {
		printf("[-] Error: Could not find LoadLibraryA function inside kernel32.dll library.\n");
		return 1;
	}

	HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, pfnThreadRtn, pszLibFileRemote, 0, NULL);
	if (hThread == NULL) {
		printf("[-] Error: Could not create the Remote Thread.\n");
		return 1;
	}
	else
		printf("[+] Success: DLL injected via CreateRemoteThread().\n");

	WaitForSingleObject(hThread, INFINITE);
	
	DWORD ExitCode;

	if (GetExitCodeThread(hThread, &ExitCode))
		printf("[+] Exit code: %d\n", ExitCode);

	if (pszLibFileRemote != NULL)
		VirtualFreeEx(hProcess, pszLibFileRemote, 0, MEM_RELEASE);

	if (hThread != NULL)
		CloseHandle(hThread);

	if (hProcess != NULL)
		CloseHandle(hProcess);

	return 0;
}


int main()
{
	DWORD id;
	wchar_t path[MAX_PATH];

	if (scanf("%d", &id) == 1 && GetModuleFileNameW(NULL, path, MAX_PATH)) {
		*wcsrchr(path, L'\\') = 0;
		wcscat(path, L"\\libdll.dll");
		InjectDll(path, id);
	}

	return 0;
}

cmake_minimum_required(VERSION 3.5)

project (dllinjector)

add_executable(injector main.cpp)
add_library(dll SHARED dll.cpp)

InjectDll(L"Dll1.dll", tu funkcja getPID);

*wcsrchr(path, L'\\') = 0;
wcscat(path, L"\\libdll.dll");

wcscpy(wcsrchr(path, L'\\'), L"\\libdll.dll");