C / C++ / MFC

// List Processes and Modules.cpp : Defines the entry point for the console application.<br />
//<br />
<br />
#include "stdafx.h"<br />
<br />
// test.cpp : Defines the entry point for the console application.<br />
//<br />
<br />
#include <windows.h><br />
#include <tlhelp32.h><br />
#include <tchar.h><br />
#include <stdio.h><br />
#include <string><br />
 <br />
#define MAXWAIT 10000<br />
<br />
//  Forward declarations:<br />
BOOL GetProcessList( );<br />
BOOL ListProcessModules( DWORD dwPID );<br />
BOOL ListProcessThreads( DWORD dwOwnerPID );<br />
void printError( TCHAR* msg );<br />
bool insertDll(DWORD procID, std::string dll);<br />
<br />
<br />
<br />
void main( )<br />
{<br />
  GetProcessList( );<br />
<br />
<br />
}<br />
<br />
BOOL GetProcessList( )<br />
{<br />
  HANDLE hProcessSnap;<br />
  HANDLE hProcess;<br />
  PROCESSENTRY32 pe32;<br />
  DWORD dwPriorityClass;<br />
  CHAR filename[260] = "notepad.exe";<br />
<br />
<br />
  // Take a snapshot of all processes in the system.<br />
  hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );<br />
  if( hProcessSnap == INVALID_HANDLE_VALUE )<br />
  {<br />
    printError( TEXT("CreateToolhelp32Snapshot (of processes)") );<br />
    return( FALSE );<br />
  }<br />
<br />
  // Set the size of the structure before using it.<br />
  pe32.dwSize = sizeof( PROCESSENTRY32 );<br />
<br />
  // Retrieve information about the first process,<br />
  // and exit if unsuccessful<br />
  if( !Process32First( hProcessSnap, &pe32 ) )<br />
  {<br />
    printError( TEXT("Process32First") ); // show cause of failure<br />
    CloseHandle( hProcessSnap );          // clean the snapshot object<br />
    return( FALSE );<br />
  }<br />
<br />
  // Now walk the snapshot of processes, and<br />
  // display information about each process in turn<br />
  do<br />
  {<br />
<br />
	  if (!strcmp(pe32.szExeFile,filename))<br />
	  {<br />
<br />
<br />
    printf( "\n\n=====================================================" );<br />
    _tprintf( TEXT("\nPROCESS NAME:  %s"), filename);//pe32.szExeFile );<br />
    printf( "\n-----------------------------------------------------" );<br />
<br />
    // Retrieve the priority class.<br />
    dwPriorityClass = 0;<br />
    hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID );<br />
    if( hProcess == NULL )<br />
      printError( TEXT("OpenProcess") );<br />
    else<br />
    {<br />
      dwPriorityClass = GetPriorityClass( hProcess );<br />
      if( !dwPriorityClass )<br />
        printError( TEXT("GetPriorityClass") );<br />
      CloseHandle( hProcess );<br />
    }<br />
<br />
    printf( "\n  Process ID        = 0x%08X", pe32.th32ProcessID );<br />
    printf( "\n  Thread count      = %d",   pe32.cntThreads );<br />
    printf( "\n  Parent process ID = 0x%08X", pe32.th32ParentProcessID );<br />
    printf( "\n  Priority base     = %d", pe32.pcPriClassBase );<br />
    if( dwPriorityClass )<br />
      printf( "\n  Priority class    = %d", dwPriorityClass );<br />
<br />
    // List the modules and threads associated with this process<br />
<br />
	insertDll(pe32.th32ParentProcessID, "C:\Caliber.dll"); // this is where we try to inject<br />
<br />
    ListProcessModules( pe32.th32ProcessID );<br />
    ListProcessThreads( pe32.th32ProcessID );<br />
<br />
	  }<br />
<br />
  } while( Process32Next( hProcessSnap, &pe32 ) );<br />
<br />
  CloseHandle( hProcessSnap );<br />
  return( TRUE );<br />
}<br />
<br />
<br />
BOOL ListProcessModules( DWORD dwPID )<br />
{<br />
  HANDLE hModuleSnap = INVALID_HANDLE_VALUE;<br />
  MODULEENTRY32 me32;<br />
<br />
  // Take a snapshot of all modules in the specified process.<br />
  hModuleSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwPID );<br />
  if( hModuleSnap == INVALID_HANDLE_VALUE )<br />
  {<br />
    printError( TEXT("CreateToolhelp32Snapshot (of modules)") );<br />
    return( FALSE );<br />
  }<br />
<br />
  // Set the size of the structure before using it.<br />
  me32.dwSize = sizeof( MODULEENTRY32 );<br />
<br />
  // Retrieve information about the first module,<br />
  // and exit if unsuccessful<br />
  if( !Module32First( hModuleSnap, &me32 ) )<br />
  {<br />
    printError( TEXT("Module32First") );  // show cause of failure<br />
    CloseHandle( hModuleSnap );           // clean the snapshot object<br />
    return( FALSE );<br />
  }<br />
<br />
  // Now walk the module list of the process,<br />
  // and display information about each module<br />
  do<br />
  {<br />
    _tprintf( TEXT("\n\n     MODULE NAME:     %s"),   me32.szModule );<br />
    _tprintf( TEXT("\n     Executable     = %s"),     me32.szExePath );<br />
    printf( "\n     Process ID     = 0x%08X",         me32.th32ProcessID );<br />
    printf( "\n     Ref count (g)  = 0x%04X",     me32.GlblcntUsage );<br />
    printf( "\n     Ref count (p)  = 0x%04X",     me32.ProccntUsage );<br />
    printf( "\n     Base address   = 0x%08X", (DWORD) me32.modBaseAddr );<br />
    printf( "\n     Base size      = %d",             me32.modBaseSize );<br />
<br />
  } while( Module32Next( hModuleSnap, &me32 ) );<br />
<br />
  CloseHandle( hModuleSnap );<br />
  return( TRUE );<br />
}<br />
<br />
BOOL ListProcessThreads( DWORD dwOwnerPID ) <br />
{ <br />
  HANDLE hThreadSnap = INVALID_HANDLE_VALUE; <br />
  THREADENTRY32 te32; <br />
 <br />
  // Take a snapshot of all running threads  <br />
  hThreadSnap = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 ); <br />
  if( hThreadSnap == INVALID_HANDLE_VALUE ) <br />
    return( FALSE ); <br />
 <br />
  // Fill in the size of the structure before using it. <br />
  te32.dwSize = sizeof(THREADENTRY32 ); <br />
 <br />
  // Retrieve information about the first thread,<br />
  // and exit if unsuccessful<br />
  if( !Thread32First( hThreadSnap, &te32 ) ) <br />
  {<br />
    printError( TEXT("Thread32First") ); // show cause of failure<br />
    CloseHandle( hThreadSnap );          // clean the snapshot object<br />
    return( FALSE );<br />
  }<br />
<br />
  // Now walk the thread list of the system,<br />
  // and display information about each thread<br />
  // associated with the specified process<br />
  do <br />
  { <br />
    if( te32.th32OwnerProcessID == dwOwnerPID )<br />
    {<br />
      printf( "\n\n     THREAD ID      = 0x%08X", te32.th32ThreadID ); <br />
      printf( "\n     Base priority  = %d", te32.tpBasePri ); <br />
      printf( "\n     Delta priority = %d", te32.tpDeltaPri ); <br />
    }<br />
  } while( Thread32Next(hThreadSnap, &te32 ) ); <br />
<br />
  CloseHandle( hThreadSnap );<br />
  return( TRUE );<br />
}<br />
<br />
void printError( TCHAR* msg )<br />
{<br />
  DWORD eNum;<br />
  TCHAR sysMsg[256];<br />
  TCHAR* p;<br />
<br />
  eNum = GetLastError( );<br />
  FormatMessage( FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,<br />
         NULL, eNum,<br />
         MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default language<br />
         sysMsg, 256, NULL );<br />
<br />
  // Trim the end of the line and terminate it with a null<br />
  p = sysMsg;<br />
  while( ( *p > 31 ) || ( *p == 9 ) )<br />
    ++p;<br />
  do { *p-- = 0; } while( ( p >= sysMsg ) &&<br />
                          ( ( *p == '.' ) || ( *p < 33 ) ) );<br />
<br />
  // Display the message<br />
  _tprintf( TEXT("\n  WARNING: %s failed with error %d (%s)"), msg, eNum, sysMsg );<br />
}<br />
<br />
<br />
<br />
 <br />
bool insertDll(DWORD procID, std::string dll)<br />
{<br />
    //Find the address of the LoadLibrary api, luckily for us, it is loaded in the same address for every process<br />
    HMODULE hLocKernel32 = GetModuleHandle("Kernel32");<br />
    FARPROC hLocLoadLibrary = GetProcAddress(hLocKernel32, "LoadLibraryA");<br />
    <br />
 <br />
    //Open the process with all access<br />
    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, procID);<br />
 <br />
    //Allocate memory to hold the path to the Dll File in the process's memory<br />
    dll += '\0';<br />
    LPVOID hRemoteMem = VirtualAllocEx(hProc, NULL, dll.size(), MEM_COMMIT, PAGE_READWRITE);<br />
 <br />
    //Write the path to the Dll File in the location just created<br />
    DWORD numBytesWritten;<br />
    WriteProcessMemory(hProc, hRemoteMem, dll.c_str(), dll.size(), &numBytesWritten);<br />
 <br />
    //Create a remote thread that starts begins at the LoadLibrary function and is passed are memory pointer<br />
    HANDLE hRemoteThread = CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)hLocLoadLibrary, hRemoteMem, 0, NULL);<br />
<br />
	ResumeThread(hRemoteThread);<br />
 <br />
    //cout << hRemoteThread << endl;<br />
 <br />
    //Wait for the thread to finish<br />
    bool res = false;<br />
    if (hRemoteThread)<br />
        res = (bool)WaitForSingleObject(hRemoteThread, MAXWAIT) != WAIT_TIMEOUT;<br />
 <br />
    //Free the memory created on the other process<br />
    VirtualFreeEx(hProc, hRemoteMem, dll.size(), MEM_RELEASE);<br />
<br />
 <br />
    //Release the handle to the other process<br />
    CloseHandle(hProc);<br />
 <br />
    return res;<br />
}