// ReSharper disable once TooManyArguments
private bool OnCreateProcess(
IntPtr applicationName,
IntPtr commandLine,
IntPtr processAttributes,
IntPtr threadAttributes,
bool inheritHandles,
uint creationFlags,
IntPtr environment,
IntPtr currentDirectory,
IntPtr startupInfo,
out ProcessInformation processInformation,
bool isUnicode)
{
var resultValue = isUnicode
? NativeProcess.CreateProcessW(
applicationName,
commandLine,
processAttributes,
threadAttributes,
inheritHandles,
creationFlags,
environment,
currentDirectory,
startupInfo,
out processInformation
)
: NativeProcess.CreateProcessA(
applicationName,
commandLine,
processAttributes,
threadAttributes,
inheritHandles,
creationFlags,
environment,
currentDirectory,
startupInfo,
out processInformation
);
if (!resultValue)
{
return(false);
}
if (processInformation.ProcessId <= 0)
{
return(true);
}
var processId = processInformation.ProcessId;
DebugMessage(nameof(OnCreateProcess),
null,
"A new process with identification number of #{0} is created.",
processId
);
new Thread(() =>
{
Thread.Sleep(InjectionDelay);
var tries = 1;
while (true)
{
try
{
RemoteHooking.Inject(
processId,
InjectionGuessAddress,
InjectionGuessAddress,
AdapterId,
InjectionGuessAddress,
InjectionDelay,
!string.IsNullOrWhiteSpace(LogPath)
);
DebugMessage(
nameof(OnCreateProcess),
null,
"Process #{0} injected with the guest code.",
processId
);
return;
}
catch
{
if (tries < 3)
{
tries++;
Thread.Sleep(1000);
continue;
}
DebugMessage(
nameof(OnCreateProcess),
null,
"Failed to inject the guest code to process #{0}.",
processId
);
return;
}
}
}).Start();
return(true);
}
