Example #1
0
        public IntPtr LoadLibraryRemote(string library)
        {
            ////////////////////////////////////////////////////////////////////////////////
            IntPtr hmodule         = Unmanaged.GetModuleHandle("kernel32.dll");
            IntPtr loadLibraryAddr = Unmanaged.GetProcAddress(hmodule, "LoadLibraryA");

            ////////////////////////////////////////////////////////////////////////////////
            IntPtr lpAddress     = IntPtr.Zero;
            UInt32 dwSize        = (UInt32)((library.Length + 1) * Marshal.SizeOf(typeof(char)));
            IntPtr lpBaseAddress = Unmanaged.VirtualAllocEx(hProcess, lpAddress, dwSize, Unmanaged.MEM_COMMIT | Unmanaged.MEM_RESERVE, Unmanaged.PAGE_READWRITE);

            ////////////////////////////////////////////////////////////////////////////////
            UInt32  lpNumberOfBytesWritten   = 0;
            IntPtr  libraryPtr               = Marshal.StringToHGlobalAnsi(library);
            Boolean writeProcessMemoryResult = Unmanaged.WriteProcessMemory(hProcess, lpBaseAddress, libraryPtr, dwSize, ref lpNumberOfBytesWritten);

            ////////////////////////////////////////////////////////////////////////////////
            UInt32  lpflOldProtect         = 0;
            Boolean virtualProtectExResult = Unmanaged.VirtualProtectEx(hProcess, lpBaseAddress, dwSize, Unmanaged.PAGE_EXECUTE_READ, ref lpflOldProtect);

            ////////////////////////////////////////////////////////////////////////////////
            IntPtr lpThreadAttributes = IntPtr.Zero;
            UInt32 dwStackSize        = 0;
            IntPtr lpParameter        = IntPtr.Zero;
            UInt32 dwCreationFlags    = 0;
            UInt32 threadId           = 0;
            IntPtr hThread            = Unmanaged.CreateRemoteThread(hProcess, lpThreadAttributes, dwStackSize, loadLibraryAddr, lpBaseAddress, dwCreationFlags, ref threadId);

            return(hThread);
        }