Dll
procedure EntryPoint(Reason : DWORD);
begin
if Reason = DLL_PROCESS_ATTACH then
MessageBox($0, 'Dll injected!', 'Done', 0);
end;
begin
DllProc:= @EntryPoint;
EntryPoint(DLL_PROCESS_ATTACH);
end.
unitunit nvk_inj;
{$H+}
{$O+}
{$WARN SYMBOL_PLATFORM OFF}
interface
uses
SysUtils,
WINDOWS,
TlHelp32;
type
PNT_THREAD_BUFFER = ^NT_THREAD_BUFFER;
NT_THREAD_BUFFER = record
Size : Cardinal;
Unknown1 : Cardinal;
Unknown2 : Cardinal;
Unknown3 : PCardinal;
Unknown4 : Cardinal;
Unknown5 : Cardinal;
Unknown6 : Cardinal;
Unknown7 : PCardinal;
Unknown8 : Cardinal;
end;
var _NtCreateThreadEx : function (var lpThreadId: Thandle;
DesiredAccess:DWORD;
lpThreadAttributes:Pointer;
hProcess:THandle;
lpStartAddress:TFNThreadStartRoutine;
lpParameter: Pointer;
CreateSuspended:Boolean;
dwStackZero: Cardinal;
lpStartCommit: Cardinal;
dwCreationFlags: Cardinal;
var NTbuf:NT_THREAD_BUFFER): Cardinal; stdcall;
function NtCreateThreadEx(hProcess: Cardinal; lpStartAddress, lpParameter: Pointer): THandle;
function InjectStr(Hnd : THandle; Str : Pchar) : Pointer;
procedure InjectThread(Hnd: THandle; Dll: Pchar);
function GetPid(procName : string) : Cardinal;
implementation
function
NtCreateThreadEx(hProcess: Cardinal; lpStartAddress, lpParameter: Pointer) : THandle;
var
tmp1, tmp2: DWORD;
Hnd : THandle;
NTbuf : NT_THREAD_BUFFER;
begin
NTbuf.Size:= Sizeof(NT_THREAD_BUFFER);
tmp1:= 0;
tmp2:= 0;
NTbuf.Unknown1:= $10003;
NTbuf.Unknown2:= $8;
NTbuf.Unknown3:= @tmp2;
NTbuf.Unknown4:= $0;
NTbuf.Unknown5:= $10004;
NTbuf.Unknown6:= 4;
NTbuf.Unknown7:= @tmp1;
NTbuf.Unknown8:= $0;
_NtCreateThreadEx:= GetProcAddress(LoadLibrary('ntdll.dll'), 'NtCreateThreadEx');
_NtCreateThreadEx(Hnd, $1FFFFF, nil, hProcess, lpStartAddress, lpParameter, False, 0, 0, 0, NTBuf);
Result:= Hnd;
end;
function InjectStr(Hnd : THandle; Str : Pchar) : Pointer;
var
lpNumberOfBytesWritten : DWORD;
begin
Result:= VirtualAllocEx(Hnd, nil, Length(Str)+1, MEM_RESERVE or MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if WriteProcessMemory(Hnd, Result, Str, Length(Str)+1, lpNumberOfBytesWritten)<>True then
Result:= nil;
end;
procedure
InjectThread(Hnd: THandle; Dll: Pchar);
begin
NtCreateThreadEx(Hnd, GetProcAddress(GetModuleHandle('kernel32.dll'), 'LoadLibraryA'), InjectStr(Hnd, Dll));
end;
// Version generica para encontrar el id de un proceso...
function GetPid(procName : string) : Cardinal;
var
hSnap : THandle;
PE32 : TPROCESSENTRY32;
begin
Result := 0;
hSnap := CreateToolhelp32Snapshot(TH32CS_SNAPALL, 0);
PE32.dwSize := sizeof(PROCESSENTRY32);
Process32First(hSnap, PE32);
while Process32Next(hSnap, PE32) do
begin
if PE32.szExeFile = procName then
Result:= PE32.th32ProcessID;
end;
CloseHandle(hSnap);
end;
Mainprogram InjectioTest;
{$APPTYPE CONSOLE}
uses
SysUtils,
WINDOWS,
nvk_inj;
var
PID : Cardinal;
Hnd : THandle;
begin
// Para inyectar
PID := GetPid('cmd.exe');
if PID=INVALID_HANDLE_VALUE then Exit;
WriteLn('Proceso: ', PID);
Hnd:= OpenProcess(PROCESS_ALL_ACCESS, false, PID);
if Hnd=INVALID_HANDLE_VALUE then
Exit;
InjectThread(Hnd, 'D:\\Dll.dll');
WaitForSingleObject(Hnd, INFINITE);
//VirtualFreeEx(Hnd, Paddr, 15, MEM_RELEASE);
CloseHandle(Hnd);
WriteLn('Terminado!');
ReadLn;
end.
Recuerden compilar primero la dll, luego la inyeccion(con su respectiva ruta).Pruebenlo y diganme sus resultados.