Hooking explorer.exe (inject.cpp:)

//Filename:inject.cpp
#include "main.h"

typedef DWORD NTSTATUS;

struct NtCreateThreadExBuffer{
ULONG Size;
ULONG Unknown1;
ULONG Unknown2;
PULONG Unknown3;
ULONG Unknown4;
ULONG Unknown5;
ULONG Unknown6;
PULONG Unknown7;
ULONG Unknown8;
};


typedef NTSTATUS (WINAPI *LPFUN_NtCreateThreadEx)
(
OUT PHANDLE hThread,
IN ACCESS_MASK DesiredAccess,
IN LPVOID ObjectAttributes,
IN HANDLE ProcessHandle,
IN LPTHREAD_START_ROUTINE lpStartAddress,
IN LPVOID lpParameter,
IN BOOL CreateSuspended,
IN ULONG StackZeroBits,
IN ULONG SizeOfStackCommit,
IN ULONG SizeOfStackReserve,
OUT LPVOID lpBytesBuffer
);

using namespace std;

#define CREATE_THREAD_ACCESS (PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ)

BOOL LoadDll(char *procName, char *dllName);
BOOL InjectDLL(DWORD dwProcessID, char *dllName);

BOOL LoadDll(char *dllName, DWORD dwProcID){

 printf("Process Id to Inject: %d",dwProcID);

 if(!dwProcID){
  printf("No vailid PID\n");
  return false;
 }

 FILE* FileCheck = fopen(dllName, "r");

 if(FileCheck==NULL){
printf("\nUnable to inject %s", dllName);
return false;
 }

 fclose(FileCheck);


 if(!InjectDLL(dwProcID, dllName)){

  printf("injection failed\n");
return false;
 } else {
return true;
 }

}



BOOL InjectDLL(DWORD dwProcessID, char *dllName){

HANDLE hProc;
HANDLE hToken;
char buf[50]={0};
LPVOID RemoteString, LoadLibAddy;

if(!dwProcessID)return false;


HANDLE hCurrentProc = GetCurrentProcess();

if (!OpenProcessToken(hCurrentProc,TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES,&hToken)){

 printf("OpenProcessToken Error:%d\n", GetLastError());
 

} else {

 if (!RaisePrivleges(hToken, (char*)SE_DEBUG_NAME)){

  printf("SetPrivleges SE_DEBUG_NAME Error:%d\n", GetLastError());
  

 }

}

if (hToken)CloseHandle(hToken);

hProc = OpenProcess(CREATE_THREAD_ACCESS, FALSE, dwProcessID);

if(!hProc){

 printf("OpenProcess() failed: %d", GetLastError());
 return false;

}

LoadLibAddy = (LPVOID)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");

if(!LoadLibAddy){

 printf("GetProcAddress() failed: %d", GetLastError());
 return false;

}

RemoteString = (LPVOID)VirtualAllocEx(hProc, NULL, strlen(dllName), MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);

if(RemoteString == NULL){

 printf("VirtualAllocEx() failed: %d", GetLastError());
 return false;

}

if(WriteProcessMemory(hProc, (LPVOID)RemoteString, dllName, strlen(dllName), NULL) == NULL){

printf("WriteProcessMemoery() failed: %d", GetLastError());
return false;

}
/*
if(!CreateRemoteThread(hProc, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, NULL, NULL)){

  printf("CreateRemoteThread() failed: %d", GetLastError());
     return false;

}
*/

HMODULE modNtDll = GetModuleHandle("ntdll.dll");

if( !modNtDll )
{
printf("n failed to get module handle for ntdll.dll, Error=0x%.8x", GetLastError());
return 0;
}

LPFUN_NtCreateThreadEx funNtCreateThreadEx =
(LPFUN_NtCreateThreadEx) GetProcAddress(modNtDll, "NtCreateThreadEx");

if( !funNtCreateThreadEx )
{
printf("n failed to get funtion (NTCreateThreadEx) address from ntdll.dll, Error=0x%.8x\nTrying CreateRemoteThread api\n", GetLastError());

if(!CreateRemoteThread(hProc, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, NULL, NULL)){

  printf("CreateRemoteThread() failed: %d", GetLastError());
     return false;

} else {
 printf("CreateRemoteThread success!\n");
 return true;
}


return 0;
} 

NtCreateThreadExBuffer ntbuffer;

memset (&ntbuffer,0,sizeof(NtCreateThreadExBuffer));
DWORD temp1 = 0;
DWORD temp2 = 0;
HANDLE pRemoteThread = NULL;

ntbuffer.Size = sizeof(NtCreateThreadExBuffer);
ntbuffer.Unknown1 = 0x10003;
ntbuffer.Unknown2 = 0x8;
ntbuffer.Unknown3 = &temp2;
ntbuffer.Unknown4 = 0;
ntbuffer.Unknown5 = 0x10004;
ntbuffer.Unknown6 = 4;
ntbuffer.Unknown7 = &temp1;
ntbuffer.Unknown8 = 0;

NTSTATUS status = funNtCreateThreadEx(
&pRemoteThread,
0x1FFFFF,
NULL,
hProc,
(LPTHREAD_START_ROUTINE) LoadLibAddy,
(LPVOID)RemoteString,
FALSE, //start instantly
NULL,
NULL,
NULL,
&ntbuffer
);

// Resume the thread execution





CloseHandle(hProc);
return true;

}


BOOL RaisePrivleges( HANDLE hToken, char *pPriv ){

TOKEN_PRIVILEGES tkp;
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
tkp.Privileges[0].Luid.HighPart = 0;
tkp.Privileges[0].Luid.LowPart = 0;

if (!LookupPrivilegeValue(NULL, pPriv, &tkp.Privileges[0].Luid)){

 printf("LookupPrivilegeValue Error:%d\n", GetLastError());
 return FALSE;

}

int iRet = AdjustTokenPrivileges(hToken, FALSE, &tkp, 0x10, (PTOKEN_PRIVILEGES)NULL, 0);

if (iRet == NULL){

 printf( "AdjustTokenPrivileges Error:%d\n", GetLastError());
 return TRUE;

} else {

 iRet = GetLastError();

switch (iRet){

 case ERROR_NOT_ALL_ASSIGNED:{
 printf("AdjustTokenPrivileges ERROR_NOT_ALL_ASSIGNED\n" );
 return FALSE;
        }

 case ERROR_SUCCESS:{
 return TRUE;
        }
 default:{
 printf("AdjustTokenPrivileges Unknow Error:%d\n", iRet);
 return FALSE;
   }
}
}
}