#include <Windows.h>
#include <string>
#include <stdexcept>
#include <filesystem>
#include <Psapi.h>
void ShowError(DWORD);
void ShowLastError();
using std::filesystem::path;
int __stdcall wWinMain(
HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPWSTR lpCmdLine,
int nShowCmd
)
{
int numArgs = 0;
LPWSTR* args = CommandLineToArgvW(lpCmdLine, &numArgs);
if (numArgs < 1 || std::wcslen(lpCmdLine) == 0)
{
MessageBoxA(NULL, "No PID", "Error", MB_OK);
return -1;
}
int pid = -1;
try
{
pid = std::stoi(args[0]);
}
catch (std::invalid_argument e)
{
char msg[256];
sprintf_s(msg, "Invalid process id: %s", e.what());
MessageBoxA(NULL, msg, "Error", MB_OK);
return -1;
}
CreateProcess(L"%localappdata%/wsltty/bin/mintty.exe", L"", NULL, NULL, FALSE, 0, NULL, NULL,)
HANDLE process = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION, FALSE, pid);
if (process == NULL)
{
ShowLastError();
return -1;
}
HMODULE kernel = GetModuleHandle(L"kernel32.dll");
if (kernel == NULL)
{
ShowLastError();
return -1;
}
path lib;
try
{
lib = std::filesystem::canonical(path("InjectAppUserModelId_x64.dll"));
}
catch (std::filesystem::filesystem_error e)
{
ShowError(e.code().value());
return -1;
}
const std::string s = lib.string();
char* libCstr = new char[s.length() + 1];
memcpy(libCstr, s.c_str(), s.length() + 1);
FARPROC loadLibraryAddr = GetProcAddress(kernel, "LoadLibraryA");
if (loadLibraryAddr == NULL)
{
ShowLastError();
return -1;
}
HMODULE injected = LoadLibrary(lib.c_str());
if (injected == NULL)
{
ShowLastError();
return -1;
}
FARPROC targetAddr = GetProcAddress(injected, "DoWork");
if (targetAddr == NULL)
{
ShowLastError();
return -1;
}
INT_PTR offset = (INT_PTR)targetAddr - (INT_PTR)injected;
void* remoteMem = VirtualAllocEx(process, NULL, strlen(libCstr) + 1, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
if (!WriteProcessMemory(process, remoteMem, libCstr, strlen(libCstr) + 1, NULL))
{
ShowLastError();
return -1;
}
HANDLE thread = CreateRemoteThread(process, NULL, 0, (LPTHREAD_START_ROUTINE)loadLibraryAddr, remoteMem, 0, NULL);
WaitForSingleObject(thread, INFINITE);
DWORD ret = 0;
GetExitCodeThread(thread, &ret);
if (ret == NULL)
{
ShowError(ret);
return -1;
}
HMODULE* remoteModuleList = new HMODULE[1000];
DWORD needed = 0;
EnumProcessModules(process, remoteModuleList, 1000, &needed);
int numModules = needed / sizeof(HMODULE);
bool found = false;
wchar_t* name = new wchar_t[1024];
for (int i = 0; i < numModules; i++)
{
GetModuleFileNameEx(process, remoteModuleList[i], name, 1023);
std::wstring modName(name);
if (modName.find(L"Inject") != std::wstring::npos)
{
const char* msg = "Message from here";
void* remoteMem = VirtualAllocEx(process, NULL, strlen(msg) + 1, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
if (!WriteProcessMemory(process, remoteMem, msg, strlen(msg) + 1, NULL))
{
ShowLastError();
return -1;
}
HANDLE thread = CreateRemoteThread(process, NULL, 0, (LPTHREAD_START_ROUTINE)((INT_PTR)remoteModuleList[i] + offset), remoteMem, 0, NULL);
WaitForSingleObject(thread, INFINITE);
DWORD ret = 0;
GetExitCodeThread(thread, &ret);
if (ret != 0)
{
char err[128];
sprintf_s(err, "Error from injected function: %d", ret);
MessageBoxA(NULL, err, "Error", MB_OK);
return -1;
}
found = true;
break;
}
}
if (!found)
{
MessageBox(NULL, L"Couldn't find injected dll", L"Error", MB_OK);
return -1;
}
MessageBoxA(NULL, "Success!", "OK", MB_OK);
return 0;
}
void ShowLastError()
{
ShowError(GetLastError());
}
void ShowError(DWORD error)
{
LPTSTR err;
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM, NULL, error, 0, (LPTSTR)&err, 0, NULL);
MessageBoxW(NULL, err, L"Error", MB_OK);
}