Function InjectDllForProcess

emmy_tool/src/windows/utility.cpp:337–384

和InjectDll 实现不同的是，不会closeHandle

// 和InjectDll 实现不同的是，不会closeHandle
bool InjectDllForProcess(HANDLE hProcess, const char *dllDir, const char *dllFileName) {
	bool success = true;
	DWORD exitCode = 0;

	// Set dll directory
	void *dllDirRemote = RemoteDup(hProcess, dllDir, strlen(dllDir) + 1);
	ExecuteRemoteKernelFuntion(hProcess, "SetDllDirectoryA", dllDirRemote, exitCode);
	VirtualFreeEx(hProcess, dllDirRemote, 0, MEM_RELEASE);

	// Load the DLL.
	void *remoteFileName = RemoteDup(hProcess, dllFileName, strlen(dllFileName) + 1);
	success &= ExecuteRemoteKernelFuntion(hProcess, "LoadLibraryA", remoteFileName, exitCode);
	VirtualFreeEx(hProcess, remoteFileName, 0, MEM_RELEASE);
	if (!success || exitCode == 0) {
		MessageEvent("Failed to load library", MessageType_Error);
		return false;
	}

	// Read shared data & call 'StartupHookMode()'
	TSharedData data;
	if (ReadSharedData(data)) {
		DWORD threadId;
		HANDLE thread = CreateRemoteThread(hProcess,
		                                   nullptr,
		                                   0,
		                                   (LPTHREAD_START_ROUTINE) data.lpInit,
		                                   nullptr,
		                                   0,
		                                   &threadId);

		if (thread != nullptr) {
			WaitForSingleObject(thread, INFINITE);
			GetExitCodeThread(thread, &exitCode);
			CloseHandle(thread);
			success = true;
		} else {
			success = false;
		}
	}

	// Reset dll directory
	ExecuteRemoteKernelFuntion(hProcess, "SetDllDirectoryA", nullptr, exitCode);

	if (success) {
		MessageEvent("Successfully inject dll!");
	}
	return success;
}


void ReceiveLog(DWORD processId) {