DLL-Injection mit Freelibrary

[brechi]

wenns auch schon sehr alt ist:

Delphi-Quellcode:

function InjectIntoProcess(lpProcessID: Cardinal; lpDllname: String):  cardinal;
var
  hProc: Cardinal;
  hRemThread:cardinal;
  addr:pointer;
  cWPM: Cardinal;
  th: integer;
begin
  result := 0;
  SetLastError(ERROR_SUCCESS);
  hProc := OpenProcess(PROCESS_ALL_ACCESS, false, lpProcessID);
  addr:=VirtualAllocEx(hProc, nil, length(lpDllname)+1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  WriteProcessMemory(hProc, addr, PChar(lpDllName), length(lpDllName)+1, cWPM);
  th := CreateRemoteThread(hProc, nil, 0,GetProcaddress(getmodulehandle('kernel32.dll'),'LoadLibraryA') , addr, 0, hRemThread);
  if (th > 0) then
  begin
    // warten bis thread beendet (dll im fremden prozess geladen)
    WaitForSingleObject(th,INFINITE);
    // den exitcode bekommen = EAX register von LLA = baseadresse der dll = dllhandle
    GetExitCodeThread(th,result);
    closehandle(th);
    // dll wieder entladen
    th := createremotethread(hproc,nil,0,getprocaddress(getmodulehandle('kernel32.dll'),'FreeLibrary'),Pointer(result),0,hremthread);
    if (th > 0) then
      closehandle(th);
  end;
  CloseHandle(hProc);
end;