Code:
#include <stdio.h> #include <iostream> #include <stdlib.h> #include <string.h> #include <Windows.h> #include <TlHelp32.h> using namespace std;
The function:
Code:
void CodeInjection()
{
DWORD OLDPROTECT; // DWORD for Page Protection
HWND windh = FindWindow(0, (LPCSTR)"WindowName"); // The Window Handle(hWnd) being retrieved by the Window Name
DWORD ppid; // The Process ID
GetWindowThreadProcessId(windh, &ppid); // Retrieves Process ID of the window
HANDLE pproc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ppid); // Sets the process handle with it's access rights
VirtualProtectEx(pproc,(LPVOID)0xMemoryAddress, 1, PAGE_READWRITE, &OLDPROTECT); //Sets the Memory Page to Readable&Writable so we can write memory
WriteProcessMemory(pproc,(LPVOID)0xMemoryAddress,MemoryToBeWrittenBytes,sizeof(MemoryToBeWrittenBytes),0); //Writes Memory at specified Address
VirtualProtectEx(pproc,(LPVOID)0xMemoryAddress, 1, OLDPROTECT, &OLDPROTECT); // Sets the Memory Page to it's original state
}
DWORD OLDPROTECT;
This is a DWORD type which will be used in VirtualProtect() for the memory page rights. VirtualProtect() is a Win32 function for setting the rights on a memory page such as READ, WRITE, and EXECUTE. VirtualProtectEx() is extended so that it can set the memory page rights on another process. If the memory page was Read-Only then it can't be written to with WriteProcessMemory() alone, you'd have to set the page rights to writable with VirtualProtectEx().
HWND windh = FindWindow(0, (LPCSTR)"WindowName");
This is a hWnd also known as a window handle, to retrieve the window handle we use FindWindow() FindWindow takes a window class name which is not a requirement if the window name is there or a window name which isn't optional if the window class name is there. FindWindow takes LPCSTR in it's parameters.
DWORD ppid;
This is the DWORD for the Process ID.
GetWindowThreadProcessId(windh, &ppid);
This gets the Thread ID that initialized the window AND the process ID.
HANDLE pproc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ppid);
This creates a Handle of the process and uses the OpenProcess function to set it's access rights and Process ID.
VirtualProtectEx(pproc,(LPVOID)0xMemoryAddress, 1, PAGE_READWRITE, &OLDPROTECT);
This function was already explained above; however, I'll review. VirtualProtectEx() is an extension of VirtualProtect() and writes to the memory page rights of another process.
WriteProcessMemory(pproc,(LPVOID)0xMemoryAddress,M emoryToBeWrittenBytes,sizeof(MemoryToBeWrittenByte s),0);
This is the function for injecting code into another process. WriteProcessMemory(). pproc is the process handle AKA the process it's writing to. (LPVOID)0xMemoryAddress is the memory location it will be written to. Example: 0x00500000. MemoryToBeWrittenBytes is the bytes it will take and write. Example: "\x54\x90"
sizeof(MemoryToBeWrittenBytes) is the size of the bytes being written. Example: "\x54\x90" would be a size of 2, so sizeof(2)
The last parameter is optional.
VirtualProtectEx(pproc,(LPVOID)0xMemoryAddress, 1, OLDPROTECT, &OLDPROTECT);
This sets the memory page back to it's original state, this is great to do because some programs have a red flag for if any changes to a memory page are made.
This sums up basic code injection.
Just give a Feedback if it Helped you
)? No other headers than windows.h are needed for your snippet.
. That is part of something called "clean programming".
