Function ExecuteRemoteKernelFuntion

emmy_tool/src/windows/utility.cpp:204–229

}

bool ExecuteRemoteKernelFuntion(HANDLE process, const char *functionName, LPVOID param, DWORD &exitCode) {
	HMODULE kernelModule = GetModuleHandle("Kernel32");
	FARPROC function = GetProcAddress(kernelModule, functionName);

	if (function == nullptr) {
		return false;
	}

	DWORD threadId;
	HANDLE thread = CreateRemoteThread(process,
	                                   nullptr,
	                                   0,
	                                   (LPTHREAD_START_ROUTINE) function,
	                                   param,
	                                   0,
	                                   &threadId);

	if (thread != nullptr) {
		WaitForSingleObject(thread, INFINITE);
		GetExitCodeThread(thread, &exitCode);

		CloseHandle(thread);
		return true;
	}
	return false;
}

bool IsBeingInjected(DWORD processId, LPCSTR moduleFileName) {
	HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId);