unit Unit1;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls, TLHelp32;
type
TForm1 =
class(TForm)
Edit1: TEdit;
Button1: TButton;
Label1: TLabel;
Button2: TButton;
procedure FormCloseQuery(Sender: TObject;
var CanClose: Boolean);
procedure Button2Click(Sender: TObject);
procedure Button1Click(Sender: TObject);
private
{ Private-Deklarationen }
function BaseAddrDllProcess(PID: Cardinal; DLLName:
string): Cardinal;
public
{ Public-Deklarationen }
end;
var
Form1: TForm1;
hProc: Cardinal;
hthread:cardinal;
TID:cardinal;
addr:pointer;
cWPM: Cardinal;
hdll:cardinal; processid:cardinal;
implementation
{$R *.dfm}
function InjectIntoProcess(lpProcessID: Cardinal; lpDllname: PChar):Boolean;
begin
result := false;
SetLastError(ERROR_SUCCESS);
processid:=lpProcessID;
hProc := OpenProcess(PROCESS_ALL_ACCESS, false, lpProcessID);
//{prozesshandle besorgen}
//{freien Speicher im Prozess reservieren und dem Zeiger auf den Speicherblock}
//{den DLL-Namen in den Prozess schreiben}
addr:=VirtualAllocEx(hProc,
nil, length(lpDllname), MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProc, addr, Pointer(lpDllName), length(lpDllName),cWPM);
hthread:=CreateRemoteThread(hproc,
nil, 0,GetProcaddress(getmodulehandle('
kernel32.dll'),'
LoadLibraryA') , addr, 0, TID);
WaitforSingleObject(hThread,INFINITE);
Virtualfreeex(hproc,addr,0,MEM_Release);
if GetLastError = ERROR_SUCCESS
then
result := true;
end;
procedure TForm1.Button1Click(Sender: TObject);
var pid,h:cardinal;
begin
h:=findwindow(
nil,pchar(edit1.Text));
getwindowthreadprocessid(h,@pid);
label1.Caption:=booltostr(Injectintoprocess(pid,'
E:\Dokumente und Einstellungen\Stefan_Admin\Eigene Dateien\Programmierung\code-injection\project1.dll'));
end;
procedure TForm1.Button2Click(Sender: TObject);
begin
hdll:=BaseAddrDllProcess(ProcessID,'
project1.dll');
if hdll=0
then
begin
showmessage('
keine entsprechende DLL gefunden');
exit;
end;
addr:=Virtualallocex(hproc,0,sizeof(hdll),MEM_COMMIT,PAGE_READWRITE);
writeprocessmemory(hproc,addr,pointer(hdll),sizeof(hdll),cWPM);
hthread:=createremotethread(hproc,
nil,0,getprocaddress(getmodulehandle('
kernel32.dll'),'
FreeLibrary'),addr,0,TID);
WaitforSingleObject(hthread,INFINITE);
VirtualFreeex(hproc,addr,0,MEM_Release);
end;
function TForm1.BaseAddrDllProcess(PID: Cardinal; DLLName:
string): Cardinal;
var
me: TModuleEntry32;
hSnap: THandle;
begin
Result := 0;
hSnap := CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid);
me.dwSize := sizeof(TModuleEntry32);
Module32First(hSnap, me);
repeat
if LowerCase(me.szModule) = LowerCase(DLLName)
then
begin
result := Cardinal(me.modBaseAddr);
break;
end;
until (
not (Module32Next(hSnap, me)));
CloseHandle(hSnap);
end;
procedure TForm1.FormCloseQuery(Sender: TObject;
var CanClose: Boolean);
begin
closehandle(hproc);
end;
end.