diff --git a/inject.lua b/inject.lua new file mode 100644 index 0000000..9fdcd6d --- /dev/null +++ b/inject.lua @@ -0,0 +1,52 @@ +--Struct size 292 +local fullPath = "D:\\WinAPI\\Release\\dx9hook.dll" +local strLen = 0 + +function GetProcessName(obj) + obj:ResetPtr() + obj:Skip(36) + return obj:GetString() +end + +function GetProcessId(obj) + obj:ResetPtr() + obj:Skip(8) + return obj:GetNumber(DWORD) +end + +mem = samurai.Alloc(292) +pcEntry = mem:ToStruct() + +pcEntry:ResetPtr() +pcEntry:PushNumber(DWORD,292) + +snapshot = invoke(kernel32.CreateToolhelp32Snapshot,2,NULL) + +if invoke(kernel32.Process32First,snapshot,mem:ToPointer()) == 1 then + while invoke(kernel32.Process32Next,snapshot,mem:ToPointer()) == 1 do + if GetProcessName(pcEntry) == "SimpleApp.exe" then + pId = GetProcessId(pcEntry) + print(pId) + end + end +else + print("Process32First failed") +end + +invoke(kernel32.CloseHandle,snapshot) +mem:Free() +strLen = string.len(fullPath) + +hProcess = invoke(kernel32.OpenProcess,2035711,0,pId) + +nmem = invoke(kernel32.VirtualAllocEx,hProcess,NULL,strLen,12288,64) +print("nmem "..nmem) +invoke(kernel32.WriteProcessMemory,hProcess,nmem,fullPath,strLen,NULL) + +thr = invoke(kernel32.CreateRemoteThread,hProcess,0,0,kernel32.LoadLibraryA,nmem,0,0) +print("thr "..thr) +invoke(kernel32.WaitForSingleObject,thr,4294967295) +invoke(kernel32.CloseHandle,thr) + +invoke(kernel32.VirtualFreeEx,hProcess,nmem,strLen,49152) +invoke(kernel32.CloseHandle,hProcess) \ No newline at end of file