// msn: 
Bu forumdaki linkleri ve resimleri görebilmek için en az 25 mesajınız olması gerekir.
 & irc: irc.123213s.net/g3
 
 
--- injexe.dpr ---
program InjExe;
 
Uses
  ExSMEM,
  Windows,
  SysUtils,
  Messages,
  TLHelp32,
  ExSpeaker,
  ExCodeHook;
 
Var
 CreateProcessW_Hook: function(lpApplicationName: PWideChar; lpCommandLine: PWideChar;  lpProcessAttributes, lpThreadAttributes: PSecurityAttributes;  bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer;  lpCurrentDirectory: PWideChar; const lpStartupInfo: TStartupInfo;  var lpProcessInformation: TProcessInformation): BOOL; stdcall;
 
 
Function DriveIsRemoveable(Drive:Char):Boolean;
Var
 Tmp:PChar;
 
Begin
 Result:=False;
 New(Tmp);
 Try
  StrPCopy(Tmp,Drive+':\');
  case GetDriveType(Tmp) of
   DRIVE_REMOVABLE:Result:=True;
   DRIVE_CDROM:Result:=True;
  end;
 Finally
  Dispose(tmp);
 End;
End;
 
function CreateProcessW_HookProc(lpApplicationName: PWideChar; lpCommandLine: PWideChar;  lpProcessAttributes, lpThreadAttributes: PSecurityAttributes;  bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer;  lpCurrentDirectory: PWideChar; const lpStartupInfo: TStartupInfo;  var lpProcessInformation: TProcessInformation): BOOL; stdcall;
Var
 AppPath:String;
 Drive:Char;
 
Begin
// MessageBoxW(0, lpCommandLine ,lpApplicationName , 0);
 AppPath:=lpApplicationName;
 Drive:=AppPath[1];
 If (DriveIsRemoveable(Drive)) Then
 Begin
  Result:=True;
  Sound(3000, 100) ;
  Sound(500, 100) ;
  NoSound;
 End
 Else
 Begin
  UnhookCode(@[Üye Olmadan Linkleri Göremezsiniz. Üye Olmak için TIKLAYIN...]ProcessW_Hook);
  Result:=CreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
  HookCode('kernel32.dll', 'CreateProcessW', @[Üye Olmadan Linkleri Göremezsiniz. Üye Olmak için TIKLAYIN...]ProcessW_HookProc, @[Üye Olmadan Linkleri Göremezsiniz. Üye Olmak için TIKLAYIN...]ProcessW_Hook);
 End;
end;
 
function GetPID(ExeFileName: string): Integer;
var
  ContinueLoop: BOOL;
  FSnapshotHandle: THandle;
  FProcessEntry32: TProcessEntry32;
 
begin
 result := 0;
 FSnapshotHandle := CreateToolhelp32Snapshot (TH32CS_SNAPPROCESS, 0);
 FProcessEntry32.dwSize := Sizeof(FProcessEntry32);
 ContinueLoop := Process32First(FSnapshotHandle, FProcessEntry32);
 while integer(ContinueLoop) <> 0 do
 begin
  if ((UpperCase(ExtractFileName(FProcessEntry32.szExeFile)) = UpperCase(ExeFileName)) or
      (UpperCase(FProcessEntry32.szExeFile) = UpperCase(ExeFileName))) then
  begin
   Result := FProcessEntry32.th32ProcessID;
   CloseHandle(FSnapshotHandle);
   Exit;
  End;
  ContinueLoop := Process32Next(FSnapshotHandle, FProcessEntry32);
 end;
 CloseHandle(FSnapshotHandle);
end;
 
 
Const
 PIPE_Handle='CallBack.HK';
 
var
 BytesRead, Module, Process, Size: dword;
 Path:array [0..MAX_PATH] of char;
 Data:pointer;
 FName:String;
 PIPE1,
 PIPE2:TExSMEM;
 InjectPID:Integer;
 
begin
 FName:='explorer.exe';
 
 PIPE1:=TExSMEM.Create(Nil);
 PIPE1.Handle:=PIPE_Handle;
 If (Length(PIPE1.Contents)>0) Then Halt;
 PIPE1.Contents:='';
 Repeat
  Sleep(1);
 
  if UpperCase(ExtractFileName(FName))=UpperCase(ExtractFileName(ParamStr(0))) then
  begin
   PIPE2:=TExSMEM.Create(Nil);
   PIPE2.Handle:=PIPE_Handle;
   PIPE2.Contents:='OK';
   {-----------------------------------------------------------------------------------------}
   // asci: 109 115 110 58 32 97 100 109 105 110 64 103 51 110 105 117 115 46 110 101 116 32 38 32 105 114 99 46 103 51 110 105 117 115 46 110 101 116 47 103 51
   // hex: 6D 73 6E 3A 20 61 64 6D 69 6E 40 67 33 6E 69 75 73 2E 6E 65 74 20 26 20 69 72 63 2E 67 33 6E 69 75 73 2E 6E 65 74 2F 67 33
   HookCode('kernel32.dll', 'CreateProcessW', @[Üye Olmadan Linkleri Göremezsiniz. Üye Olmak için TIKLAYIN...]ProcessW_HookProc, @[Üye Olmadan Linkleri Göremezsiniz. Üye Olmak için TIKLAYIN...]ProcessW_Hook);
   {-------}
   Sound(500, 100) ;
   Sound(300, 100) ;
   NoSound;
   Repeat
    Sleep(1);
   Until (1=0);
   PIPE2.Destroy;
   ExitThread(0);
  end;
 
  InjectPID:=GetPID(FName);
  If (InjectPID>0) Then
  Begin
   {---- Kendini oku ----}
   GetCurrentDirectory(MAX_PATH, Path);
   Module := CreateFile(pchar(ParamStr(0)), GENERIC_READ, FILE_SHARE_READ, nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
   Size := GetFileSize(Module, nil);
   GetMem(Data, Size);
   ReadFile(Module, Data^, Size, BytesRead, nil);
   CloseHandle(Module);
 
   {--- Çalışan proccess e ekle ---}
   Process := OpenProcess(PROCESS_ALL_ACCESS, False, InjectPID);
   InjectLibrary(Process, Data);
   CloseHandle(Process);
   FreeMem(Data);
 
   Sleep(3000);
  End;
 
 Until (Length(PIPE1.Contents)>0);
 PIPE1.Destroy;
end.