Code Injection Example in Win32

was bored some days back... thought i'll try out code injection in Win32. Its not DLL Injection which can be achieved using SetWindowHookEx Win32 API.

The following code, basically locates Notepad instance, and injected code into it - that pops a blank message box. It works only in Win2K and above [ I tested it only on WinXP SP2 ].

In your project settings, turn off incremental compilation and linking, otherwise, code-size detection may fail.

///// _ CODE _ STARTS _ HERE _ ////

#include <stdio.h>
#include <tchar.h>
#include <windows.h>

#pragma code_seg(".injseg")
__declspec( naked ) static DWORD WINAPI InjectCode(LPVOID lpParameter)
{
    __asm
    {
        call get_delta
get_delta:
        pop ebp
        sub ebp, offset get_delta

        lea esi, dword ptr [ebp + addrMessageBox]
        mov eax, dword ptr [esi]

        push MB_OK
        push 0
        push 0
        push NULL
        call eax

        lea esi, dword ptr [ebp + addrExitProcess]
        mov eax, dword ptr [esi]
        push 0
        call eax

        __emit 6Bh //k
        __emit 65h //e
        __emit 72h //r
        __emit 6Eh //n
        __emit 65h //e
        __emit 6Ch //l
        __emit 33h //3
        __emit 32h //2
        __emit 2Eh //.
        __emit 64h //d
        __emit 6Ch //l
        __emit 6Ch //l
        __emit 00h //�
        __emit 00h //�

addrMessageBox:
        __emit 00h
        __emit 00h
        __emit 00h
        __emit 00h
       
addrExitProcess:
        __emit 00h
        __emit 00h
        __emit 00h
        __emit 00h
    }
}

static void InjectCode_EndMarker (void){}

#pragma code_seg()
#pragma comment(linker, "/SECTION:.injseg,RWX")

BOOL DoSomeInjection(DWORD dwProcessId)
{
    BOOL bRet = FALSE;
    BOOL bOK = FALSE;
    HANDLE hProcess = NULL;
    HANDLE hRemoteThread = NULL;
    LPVOID lpInjectCode = NULL;
    const DWORD dwCodeSize = ((LPBYTE) InjectCode_EndMarker - (LPBYTE) InjectCode);
    DWORD dwTemp = 0;

    do
    {
        *(((LPDWORD)InjectCode_EndMarker) - 2) = (DWORD)&MessageBoxA;
        *(((LPDWORD)InjectCode_EndMarker) - 1) = (DWORD)&ExitProcess;


        hProcess = OpenProcess( PROCESS_ALL_ACCESS,
                               FALSE,
                               dwProcessId
                               );

        if(NULL == hProcess)
        {
            _tprintf(_T("OpenProcess Failed!n"));
            break;
        }

        lpInjectCode = VirtualAllocEx(
                                hProcess,
                                NULL,
                                dwCodeSize,
                                MEM_RESERVE|MEM_COMMIT,
                                PAGE_EXECUTE_READWRITE
                                );

        if(NULL == lpInjectCode)
        {
            _tprintf(_T("VirtualAllocEx Failed!n"));
            break;
        }

        bOK = WriteProcessMemory(hProcess, lpInjectCode, (LPVOID)InjectCode, dwCodeSize, &dwTemp);

        if(FALSE == bOK)
        {
            _tprintf(_T("WriteProcessMemory Failed!n"));
            break;
        }

        hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpInjectCode, NULL, 0, NULL);

        if(NULL == hRemoteThread)
        {
            _tprintf(_T("CreateRemoteThread Failed!n"));
            break;
        }

        WaitForSingleObject( hRemoteThread, INFINITE);
        bRet = TRUE;
    } while(false);

    if(NULL != lpInjectCode)
    {
        VirtualFreeEx( hProcess, lpInjectCode, dwCodeSize, MEM_RELEASE);
        lpInjectCode = NULL;
    }

    if(NULL != hRemoteThread)
    {
        CloseHandle(hRemoteThread);
        hRemoteThread = NULL;
    }

    if(NULL != hProcess)
    {
        CloseHandle(hProcess);
        hProcess = NULL;
    }

    return bRet;
}

int main(int argc, char* argv[])
{
    DWORD dwProcId = 0;
    HWND hwnd = FindWindow("Notepad", NULL);
    GetWindowThreadProcessId( hwnd, &dwProcId);
    DoSomeInjection(dwProcId);
    return 0;
}

///// _ CODE _ ENDS _ HERE _ ////

                                                                                                     
                                                                                             Source:            infoGreG