Gecodet im .Net Framework
Ich analysiers mal..
Code:
Dim num5 As Integer
ProjectData.ClearProjectError
Dim num4 As Integer = 2
Me.Timer1.Stop
Dim processesByName As Process() = Process.GetProcessesByName(Me.TextBox1.Text)
Me.TargetProcessHandle = Form1.OpenProcess(&H2A, 0, processesByName(0).Id)
Me.pszLibFileRemote = Me.OpenFileDialog1.FileName
Dim lpModuleName As String = "Kernel32"
Dim lpProcName As String = "LoadLibraryA"
Me.pfnStartAddr = Form1.GetProcAddress(Form1.GetModuleHandle(lpModuleName), lpProcName)
Me.TargetBufferSize = (1 + Strings.Len(Me.pszLibFileRemote))
Dim lpBaseAddress As Integer = Form1.VirtualAllocEx(Me.TargetProcessHandle, 0, Me.TargetBufferSize, &H1000, 4)
Dim lpNumberOfBytesWritten As Integer = 0
Dim num2 As Integer = Form1.WriteProcessMemory(Me.TargetProcessHandle, lpBaseAddress, Me.pszLibFileRemote, Me.TargetBufferSize, lpNumberOfBytesWritten)
lpNumberOfBytesWritten = 0
Form1.CreateRemoteThread(Me.TargetProcessHandle, 0, 0, Me.pfnStartAddr, lpBaseAddress, 0, lpNumberOfBytesWritten)
Form1.CloseHandle(Me.TargetProcessHandle)
Zu 100% von KaMeR1337 geklaut, sind ganz genau die selben Namen, nichtmal umbenannt hat er sie.
#gemeldet!