simple tool that uses Windows APIs to trick a process to load a dll to its memory.
OpenProcess
: get a handle for a process in memory knowing its PID .
VirtualAllocEx
: Allocate memory in a process knowing its handle .
WriteProcessMemory
: Write to a memory in a process knowing its handle .
LoadLibraryW
: load dll into a process (This is the function that our process need to execute ) .
CreateRemoteThread
: Create thread in another process knowing its handle .
first it search for the pid of the process given in arguments and it open a handle to the process to write the path of the dll in its memory , then it create a remote thread calling the function loadlibraryW to import the dll .
bypassing ASLR
this works because kernel32 would have the same base address in all process and the same offsets for all the functions , so loadlibrary will have the same address in our process (Inject.exe) and in the process we want to inject to .
Inject.exe process_name Fullpathofdll.dll