C / C++ / MFC

#include "windows.h"
#include "stdio.h"
#include <tlhelp32.h>
#include <shlwapi.h>


BOOL Inject_DLL(DWORD dwID)

{
	HANDLE hToken = NULL;
	HANDLE hProc = NULL;
	HANDLE hThread = NULL;
	BOOL bReturn = FALSE;
	BOOL bLibLoaded = FALSE;
	BOOL bWriteCheck = FALSE;
	char szErrBuff[MAX_PATH] = "";	
	char szDllFolder[2 * MAX_PATH] = "";
	char szDllPath[2 * MAX_PATH] = "C:\\DelDll\\DetourExample.dll";
	//char szDllPath[2 * MAX_PATH] = "D:\\Working_Ashish\\DetourExample\\release\\DetourExample.dll";
	void*   pLibRemote = NULL;
	HMODULE hKernel32 = NULL;
	DWORD	err = 0;
	TCHAR	szTemp[MAX_PATH] = "";
	DWORD dwDesiredAccess;
	TCHAR	szError[MAX_PATH] = "";

	//Access Identifiers to open the target process
	dwDesiredAccess = PROCESS_CREATE_THREAD |
					  PROCESS_QUERY_INFORMATION |
					  PROCESS_VM_OPERATION|
					  PROCESS_VM_WRITE |
					  PROCESS_VM_READ;


	//Opening the target process.
	hProc = OpenProcess(dwDesiredAccess, FALSE, dwID);	
	if(hProc == NULL || hProc == INVALID_HANDLE_VALUE)
	{
		MessageBox(NULL, "Cannot Open Process", "Error", MB_OK);
		printf("Cannot Open Process\n");
		goto Cleanup;
	}

	

	hKernel32 = GetModuleHandle("Kernel32");
	if(hKernel32 == INVALID_HANDLE_VALUE || hKernel32 == NULL)
	{
		hKernel32 = LoadLibrary("Kernel32");
		if(hKernel32 == INVALID_HANDLE_VALUE || hKernel32 == NULL)
		{
			MessageBox(NULL, "Cannot Load Kernel", "Error", MB_OK);
			printf("Cannot Load Kernel32");			
			goto Cleanup;
		}
		else
		{
			bLibLoaded = TRUE;
		}
	}	

	//Allocate memory for the DLL name in the remote target process.
	pLibRemote = VirtualAllocEx(hProc, NULL, sizeof(szDllPath), MEM_COMMIT, PAGE_READWRITE );
	if(pLibRemote == NULL)
	{
		MessageBox(NULL, "Virtual Alloc Failed", "Error", MB_OK);
		printf("Virtual Alloc Failed\n");
		goto Cleanup;
	}


	//Write the DLL name, including full path, to the allocated memory.
	bWriteCheck = WriteProcessMemory(hProc, pLibRemote, (void*)szDllPath, sizeof(szDllPath), NULL );	
	if(bWriteCheck == 0)
	{
		MessageBox(NULL, "WriteProcess Memory Failed", "Error", MB_OK);
		printf("WriteProcessMemory Failes\n");
		goto Cleanup;
	}


	//Mapping our DLL to the remote process via CreateRemoteThread & LoadLibrary..
	hThread = CreateRemoteThread(	hProc,
									NULL,
									NULL,
									(LPTHREAD_START_ROUTINE)GetProcAddress(hKernel32,"LoadLibraryA"),
									pLibRemote,
									NULL, NULL);
	
	
	//Waiting until the remote thread terminates.
	if(hThread != INVALID_HANDLE_VALUE && hThread != NULL)
	{
		WaitForSingleObject( hThread, INFINITE );
		bReturn = TRUE;
	}
	else
	{
		DWORD err = GetLastError();
		TCHAR szTemp[MAX_PATH] = "";
		sprintf(szTemp, "CreateRemoteThread Failed, Error = %d", err);
		MessageBox(NULL, szTemp, "Error", MB_OK);
	}


//Cleaning up the modules, handles, memory.
Cleanup:

	if(hThread != INVALID_HANDLE_VALUE && hThread != NULL)
	{
		CloseHandle(hThread);
		hThread = NULL;
	}

	if(pLibRemote)
	{
		VirtualFreeEx(hProc, pLibRemote, sizeof(szDllPath), MEM_DECOMMIT);
		pLibRemote = NULL;
	}

	if(hProc != INVALID_HANDLE_VALUE && hProc != NULL)
	{
		CloseHandle(hProc);
		hProc = NULL;
		
	}

	if((hKernel32 != INVALID_HANDLE_VALUE && hKernel32 != NULL) && bLibLoaded)
	{
		FreeLibrary(hKernel32);
		hKernel32 = NULL;
	}

	//DeleteFile(szDllPath);

	return bReturn;
}

int main()
{
	BOOL bReturn = FALSE;

	bReturn  = Inject_DLL(3188);

	return bReturn;

}

stringc swapChars(stringc& str1)
{
 std::string str(str1.c_str());
 std::string strChar;
 std::string strChar1;
 int length = str.size();
 stringstream ss;
 stringstream ss1;
 char chr =65 +  rand() % 26;
 char chr1 = chr;
 ss << chr;
 ss >> strChar;
 str.replace((int)length/3,1,strChar);
 while(chr == chr1)
 {
  chr = 65 + rand() % 26;
 }
 chr = chr + 32;
 ss1 << chr;
 ss1 >> strChar1;
 str.replace((int)length*2/3,1,strChar1);
 return str.c_str();
}

vector<stringc> players;
array<stringc> nameFirstPart,nameSecondPart;
unsigned int t = time(NULL);
for(register int i = 0; i<players.size()-1; i++)
{
 srand(t);
 nameSecondPart.push_back(swapChars(players[++i]));
 t++;
}

for(register int k = 0; k < nameSecondPart.size(); k++)
{
 printf("%s \n",nameSecondPart[k].c_str());
}