1. #include <windows.h>
2. #include <stdio.h>
3.  
4. #define BUFSIZE 512
5.  
6. BOOL InjectDLL(DWORD procID, const wchar_t* dllPath) {
7.     HANDLE hHandle = OpenProcess(
8.         PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,
9.         FALSE, procID);
10.     if (!hHandle) {
11.         wprintf(L"OpenProcess failed with error %d\n", GetLastError());
12.         return FALSE;
13.     }
14.  
15.     wchar_t fullDllPath[BUFSIZE];
16.     if (!GetFullPathName(dllPath, BUFSIZE, fullDllPath, NULL)) {
17.         wprintf(L"GetFullPathName failed with error %d\n", GetLastError());
18.         CloseHandle(hHandle);
19.         return FALSE;
20.     }
21.  
22.     void* dllPathAddr = VirtualAllocEx(hHandle, 0, (wcslen(fullDllPath) + 1) * sizeof(wchar_t), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
23.     if (!dllPathAddr) {
24.         wprintf(L"VirtualAllocEx failed with error %d\n", GetLastError());
25.         CloseHandle(hHandle);
26.         return FALSE;
27.     }
28.  
29.     if (!WriteProcessMemory(hHandle, dllPathAddr, fullDllPath, (wcslen(fullDllPath) + 1) * sizeof(wchar_t), NULL)) {
30.         wprintf(L"WriteProcessMemory failed with error %d\n", GetLastError());
31.         VirtualFreeEx(hHandle, dllPathAddr, 0, MEM_RELEASE);
32.         CloseHandle(hHandle);
33.         return FALSE;
34.     }
35.  
36.     HMODULE hKernel32 = GetModuleHandle(L"kernel32.dll");
37.     if (!hKernel32) {
38.         wprintf(L"GetModuleHandle failed with error %d\n", GetLastError());
39.         VirtualFreeEx(hHandle, dllPathAddr, 0, MEM_RELEASE);
40.         CloseHandle(hHandle);
41.         return FALSE;
42.     }
43.  
44.     FARPROC loadLibAddr = GetProcAddress(hKernel32, "LoadLibraryW");
45.     if (!loadLibAddr) {
46.         wprintf(L"GetProcAddress failed with error %d\n", GetLastError());
47.         VirtualFreeEx(hHandle, dllPathAddr, 0, MEM_RELEASE);
48.         CloseHandle(hHandle);
49.         return FALSE;
50.     }
51.  
52.     HANDLE rThread = CreateRemoteThread(hHandle, NULL, 0, (LPTHREAD_START_ROUTINE)loadLibAddr, dllPathAddr, 0, NULL);
53.     if (!rThread) {
54.         wprintf(L"CreateRemoteThread failed with error %d\n", GetLastError());
55.         VirtualFreeEx(hHandle, dllPathAddr, 0, MEM_RELEASE);
56.         CloseHandle(hHandle);
57.         return FALSE;
58.     }
59.  
60.     WaitForSingleObject(rThread, INFINITE);
61.  
62.     VirtualFreeEx(hHandle, dllPathAddr, 0, MEM_RELEASE);
63.     CloseHandle(rThread);
64.     CloseHandle(hHandle);
65.  
66.     return TRUE;
67. }
68.  
69. int main() {
70.     DWORD procID = 1412;
71.     const wchar_t* dllPath = L"C:\\Users\\tmqrx\\source\\repos\\Dll1\\x64\\Debug\\Dll1.dll";
72.  
73.     if (InjectDLL(procID, dllPath)) {
74.         wprintf(L"DLL injection successful.\n");
75.     }
76.     else {
77.         wprintf(L"DLL injection failed.\n");
78.     }
79.  
80.     return 0;
81. }