Method InjectMultiple

src/InjectionCore.cpp:422–493

Inject multiple images Injection context Error code

/// <param name="pCtx">Injection context</param>
/// <returns>Error code</returns>
NTSTATUS InjectionCore::InjectMultiple( InjectContext* pContext )
{
    NTSTATUS status = ERROR_SUCCESS;
    PROCESS_INFORMATION pi = { 0 };

    // Update PID
    if(pContext->cfg.injectMode == Existing && pContext->pid == 0)
        pContext->pid = pContext->cfg.pid;

    // Log some info
    xlog::Critical(
        "Injection initiated. Mode: %d, process type: %d, pid: %d, mmap flags: 0x%X, "
        "erasePE: %d, unlink: %d, thread hijack: %d, init routine: '%s', init arg: '%ls'",
        pContext->cfg.injectMode,
        pContext->cfg.processMode,
        pContext->pid,
        pContext->cfg.mmapFlags,
        pContext->cfg.erasePE,
        pContext->cfg.unlink,
        pContext->cfg.hijack,
        pContext->cfg.initRoutine.c_str(),
        pContext->cfg.initArgs.c_str()
        );

    // Get process for injection
    status = GetTargetProcess( *pContext, pi );
    if (status != STATUS_SUCCESS)
        return status;

    if (pContext->cfg.delay)
        Sleep( pContext->cfg.delay );

    // Inject all images
    for (auto& img : pContext->images)
    {
        status |= InjectSingle( *pContext, *img );
        if (pContext->cfg.period)
            Sleep( pContext->cfg.period );
    }

    //
    // Cleanup after injection
    //
    if (pi.hThread)
    {
        if (status == STATUS_SUCCESS)
            ResumeThread( pi.hThread );

        CloseHandle( pi.hThread );
    }

    if (pi.hProcess)
    {
        // TODO: Decide if process should be terminated if at least one module failed to inject
        /*if (errCode != ERROR_SUCCESS)
            TerminateProcess( pi.hProcess, 0 );*/

        CloseHandle( pi.hProcess );