lpLoadLibrary = (uint)Imports.GetProcAddress(Imports.GetModuleHandle("kernel32.dll"), "LoadLibraryA");
if (lpLoadLibrary > 0)
{
Console.WriteLine("[DEBUG] LoadLibraryA found.");
lpDll = Memory.CreateAllocatedMemory(0x1000);
if (lpDll != null)
{
Console.WriteLine("[DEBUG] Memory chunk allocated at 0x{0:X}.", lpDll.Address);
if (Memory.WriteString(lpDll.Address, szDllPath, Encoding.ASCII))
{
Console.WriteLine("[DEBUG] DLL path written into that chunk.");
IntPtr dwThreadId;
hThread = Imports.CreateRemoteThread(hProcess, IntPtr.Zero, 0, (IntPtr)lpLoadLibrary, lpDll.Address,
ThreadFlags.THREAD_EXECUTE_IMMEDIATELY, out dwThreadId);
Console.WriteLine("[DEBUG] Remote thread created at {0}.", hThread);
//wait for thread handle to have signaled state
//exit code will be equal to the base address of the dll
if (Imports.WaitForSingleObject(hThread, 5000) == WaitValues.WAIT_OBJECT_0)
dwBaseAddress = Extensions.GetExitCodeThread(hThread);
Imports.CloseHandle(hThread);
Console.WriteLine("[DEBUG] Remote thread base address.", dwBaseAddress);
}
Imports.VirtualFreeEx(hProcess, (uint)lpDll.Address, 0, MemoryFreeType.MEM_RELEASE);
}
}
