C / C++ / MFC

WAVEFORMATEX	        _oFormat;
LPWAVEFORMATEX	        _pFormat = NULL;
HGLOBAL			_hWaveData;
PCHAR			_pWaveData;
HGLOBAL                 _hWaveHeader;
LPWAVEHDR               _pWaveHeader;
HWAVEOUT		_hOutputDevice = NULL;
DWORD			_nAlignedBufferSize = 0;
MMRESULT		rc = 0;
HANDLE			fileHandle = NULL;
DWORD			size = 0;
DWORD			readBytes = 0;
void*			block = NULL;

	_pFormat = &_oFormat;
	_pFormat->wFormatTag = WAVE_FORMAT_PCM;
	_pFormat->nChannels = 1;
	_pFormat->nSamplesPerSec = 8000;
	_pFormat->wBitsPerSample = 8;
	_pFormat->nBlockAlign = 1;
	_pFormat->nAvgBytesPerSec = 8000;
	_pFormat->cbSize = 0;

	//allocate and lock memory for the buffers...
	_hWaveHeader = GlobalAlloc(GMEM_MOVEABLE | GMEM_SHARE | GMEM_ZEROINIT, (DWORD)sizeof(WAVEHDR));
	if(!_hWaveHeader) return false;
	_pWaveHeader = (LPWAVEHDR) GlobalLock(_hWaveHeader);
	if(!_pWaveHeader) return false;
	_hWaveData = GlobalAlloc(GMEM_MOVEABLE | GMEM_SHARE, AUDIO_BUFFER_SIZE);
	if(!_hWaveData) return false;
	_pWaveHeader->lpData = _pWaveData = (LPSTR)GlobalLock(_hWaveData);

	//open suitable device for output(input or outpur)
	rc = waveOutOpen(&_hOutputDevice, WAVE_MAPPER,_pFormat, (DWORD) &waveOutProc, 0, CALLBACK_FUNCTION);
	if (rc!=MMSYSERR_NOERROR)
		MessageBox(NULL,"Error:","",NULL);

	//creating file to read from.....ringout, the same file from c:\windows\media\ringout.wav
	if ((fileHandle = CreateFile("\sounds\\ringout.wav", GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,0,NULL)) == INVALID_HANDLE_VALUE)
		return NULL;

	do {
		if( (size = GetFileSize(fileHandle,NULL)) == 0)
			break;

		if ( (block = HeapAlloc(GetProcessHeap(), 0, size)) == NULL)
			break;

		ReadFile(fileHandle, block, size, &readBytes, NULL);
	} while(0);

	CloseHandle(fileHandle);
	CopyMemory(_pWaveHeader, &block, sizeof(block));

	// prepare buffers and pass to output device
	_nAlignedBufferSize = (AUDIO_BUFFER_SIZE - AUDIO_BUFFER_SIZE % _pFormat->nBlockAlign ); //buffer size
	_pWaveHeader->dwFlags = 0;
	_pWaveHeader->dwBufferLength = _nAlignedBufferSize;
	rc = waveOutPrepareHeader(_hOutputDevice, _pWaveHeader, sizeof(WAVEHDR));


	rc = waveOutWrite(_hOutputDevice, _pWaveHeader, sizeof(WAVEHDR));

#include "windows.h"
#include "stdio.h"
#include <tlhelp32.h>
#include <shlwapi.h>


BOOL Inject_DLL(DWORD dwID)

{
	HANDLE hToken = NULL;
	HANDLE hProc = NULL;
	HANDLE hThread = NULL;
	BOOL bReturn = FALSE;
	BOOL bLibLoaded = FALSE;
	BOOL bWriteCheck = FALSE;
	char szErrBuff[MAX_PATH] = "";	
	char szDllFolder[2 * MAX_PATH] = "";
	char szDllPath[2 * MAX_PATH] = "C:\\DelDll\\DetourExample.dll";
	//char szDllPath[2 * MAX_PATH] = "D:\\Working_Ashish\\DetourExample\\release\\DetourExample.dll";
	void*   pLibRemote = NULL;
	HMODULE hKernel32 = NULL;
	DWORD	err = 0;
	TCHAR	szTemp[MAX_PATH] = "";
	DWORD dwDesiredAccess;
	TCHAR	szError[MAX_PATH] = "";

	//Access Identifiers to open the target process
	dwDesiredAccess = PROCESS_CREATE_THREAD |
					  PROCESS_QUERY_INFORMATION |
					  PROCESS_VM_OPERATION|
					  PROCESS_VM_WRITE |
					  PROCESS_VM_READ;


	//Opening the target process.
	hProc = OpenProcess(dwDesiredAccess, FALSE, dwID);	
	if(hProc == NULL || hProc == INVALID_HANDLE_VALUE)
	{
		MessageBox(NULL, "Cannot Open Process", "Error", MB_OK);
		printf("Cannot Open Process\n");
		goto Cleanup;
	}

	

	hKernel32 = GetModuleHandle("Kernel32");
	if(hKernel32 == INVALID_HANDLE_VALUE || hKernel32 == NULL)
	{
		hKernel32 = LoadLibrary("Kernel32");
		if(hKernel32 == INVALID_HANDLE_VALUE || hKernel32 == NULL)
		{
			MessageBox(NULL, "Cannot Load Kernel", "Error", MB_OK);
			printf("Cannot Load Kernel32");			
			goto Cleanup;
		}
		else
		{
			bLibLoaded = TRUE;
		}
	}	

	//Allocate memory for the DLL name in the remote target process.
	pLibRemote = VirtualAllocEx(hProc, NULL, sizeof(szDllPath), MEM_COMMIT, PAGE_READWRITE );
	if(pLibRemote == NULL)
	{
		MessageBox(NULL, "Virtual Alloc Failed", "Error", MB_OK);
		printf("Virtual Alloc Failed\n");
		goto Cleanup;
	}


	//Write the DLL name, including full path, to the allocated memory.
	bWriteCheck = WriteProcessMemory(hProc, pLibRemote, (void*)szDllPath, sizeof(szDllPath), NULL );	
	if(bWriteCheck == 0)
	{
		MessageBox(NULL, "WriteProcess Memory Failed", "Error", MB_OK);
		printf("WriteProcessMemory Failes\n");
		goto Cleanup;
	}


	//Mapping our DLL to the remote process via CreateRemoteThread & LoadLibrary..
	hThread = CreateRemoteThread(	hProc,
									NULL,
									NULL,
									(LPTHREAD_START_ROUTINE)GetProcAddress(hKernel32,"LoadLibraryA"),
									pLibRemote,
									NULL, NULL);
	
	
	//Waiting until the remote thread terminates.
	if(hThread != INVALID_HANDLE_VALUE && hThread != NULL)
	{
		WaitForSingleObject( hThread, INFINITE );
		bReturn = TRUE;
	}
	else
	{
		DWORD err = GetLastError();
		TCHAR szTemp[MAX_PATH] = "";
		sprintf(szTemp, "CreateRemoteThread Failed, Error = %d", err);
		MessageBox(NULL, szTemp, "Error", MB_OK);
	}


//Cleaning up the modules, handles, memory.
Cleanup:

	if(hThread != INVALID_HANDLE_VALUE && hThread != NULL)
	{
		CloseHandle(hThread);
		hThread = NULL;
	}

	if(pLibRemote)
	{
		VirtualFreeEx(hProc, pLibRemote, sizeof(szDllPath), MEM_DECOMMIT);
		pLibRemote = NULL;
	}

	if(hProc != INVALID_HANDLE_VALUE && hProc != NULL)
	{
		CloseHandle(hProc);
		hProc = NULL;
		
	}

	if((hKernel32 != INVALID_HANDLE_VALUE && hKernel32 != NULL) && bLibLoaded)
	{
		FreeLibrary(hKernel32);
		hKernel32 = NULL;
	}

	//DeleteFile(szDllPath);

	return bReturn;
}

int main()
{
	BOOL bReturn = FALSE;

	bReturn  = Inject_DLL(3188);

	return bReturn;

}