[Source Code] AutoInjection

/*
*	A proof-of-concept tool for forcing the client to self inject malicious code at Run-time
*
*	Cryless Domore (@crylessdomore)
*	July 10, 2017
*	https://github.com/crylessdomore/
*/

#include <Windows.h>
#include <detours.h>

BOOL(WINAPI *oFreeLibrary)(HMODULE hLibModule);

FARPROC WINAPI oShowNostaleSplash = NULL;
FARPROC WINAPI oFreeNostaleSplash = NULL;

extern "C" __declspec(dllexport) void __declspec(naked) ShowNostaleSplash()
{
	__asm jmp oShowNostaleSplash
}

extern "C" __declspec(dllexport) void __declspec(naked) FreeNostaleSplash()
{
	__asm jmp oFreeNostaleSplash
}

BOOL WINAPI FreeLibrary_HOOK(HMODULE hLibModule)
{
	char aLibFileName[MAX_PATH];
	GetModuleFileNameA(hLibModule, aLibFileName, sizeof(aLibFileName));

	if (strstr(aLibFileName, "EWSF.EWS")) {
		hLibModule = GetModuleHandleA("EWSF.dll");
	}

	return oFreeLibrary(hLibModule);
}

void OnAttach()
{
	// Write your code here...
	MessageBoxA(NULL, "Hacking involves a different way of looking at problems that no one's thought of.", "Walter O'Brien", MB_OK);
}

BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpvReserved)
{
	switch (dwReason)
	{
	case DLL_PROCESS_ATTACH:
		HMODULE hLibModule = LoadLibraryA("EWSF.dll");
		oShowNostaleSplash = GetProcAddress(hLibModule, "ShowNostaleSplash");
		oFreeNostaleSplash = GetProcAddress(hLibModule, "FreeNostaleSplash");

		oFreeLibrary = FreeLibrary;

		DetourTransactionBegin();
		DetourUpdateThread(GetCurrentThread());
		DetourAttach(&(PVOID&)oFreeLibrary, FreeLibrary_HOOK);
		DetourTransactionCommit();

		DisableThreadLibraryCalls(hInstance);
		CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)OnAttach, NULL, NULL, NULL);
	}

	return TRUE;
}