[Autogenerated] I'd like to show a more complex example of using memory.
APIs in conjunction with thread APIs in order to perform
something called DLL injection with an injection,
we want to inject a delay of our choosing to some target
process and there are many ways of doing that.
What I want to show here is the classic one that uses a remote threat and the
basic idea is that the threat is going to run the load library function to load
the dealer of archer using into the target process.
However, since the threat is running in the other process,
we have to make sure all the parameters that threat has are
in fact provided in the target process,
address space and not in the injectors process address space.
The classic example of using this technique is by the buggers.
debugger wants to forcefully break into a process.
It injects a thread into that process and then tells that threat to run the D B
G breakpoint function that will then trigger a breakpoint,
which debugger can then attach to and gain control of the target process.
But this is used for other purposes.
And although from a security perspective,
this is fairly easy to find or to detect by various
security based solutions today,
it's still a very interesting thing to try out in terms of
code in terms of understanding how Windows APIs work in
terms of memory and threading.
So here's what we want to achieve.
We have our target process which could be anything that we can open a
powerful enough handle to and then we have our injector process.
So the injector process is going to use the right process,
memory function to write the path to the deal well
for the threat to run to load.
And once the thread is created by calling the creator remote threat API it's
going to be set on the function load library given that DLL path and then once
that happens the DLL would load and that's it.
It's in the process and it's dealing.
Main function is going to run so it can do anything it wants from that
point on the injected DLL is in the target process.
Then the injector process can go away or not,
depending on the scenario and we've done what we set out to do.
So let's see how to implement this scenario in code