$process = Get-Process -Name "uygulamanın .exesiz adı"
if ($process) {
$processId = $process.Id
Inject-DllToProcess -ProcessID $processId -DllPath "dllninpcdekikonunu"
} else {
Write-Host "Gerekli uygulama bulunamadı."
}
function Inject-DllToProcess
{
[CmdletBinding()]
Param (
[Parameter( Mandatory = $true )]
[Int]
$ProcessID,
[Parameter( Mandatory = $true )]
[String]
$DllPath
)
$Kernel32 = Add-Type -Name "Kernel32" -Namespace Win32 -MemberDefinition @"
[DllImport("kernel32.dll")]
public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern IntPtr GetModuleHandle(string lpModuleName);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] buffer, uint size, out IntPtr lpNumberOfBytesWritten);
[DllImport("kernel32.dll")]
public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("kernel32.dll")]
public static extern int CloseHandle(IntPtr hObject);
"@
$process = $Kernel32::OpenProcess(0x001F0FFF, $false, $ProcessID) # PROCESS_ALL_ACCESS
if ($process -eq [IntPtr]::Zero) {
return
}
$dllPathBytes = [System.Text.Encoding]::ASCII.GetBytes($DllPath)
$dllPathLength = $dllPathBytes.Length + 1 # Include null terminator
$remoteMemory = $Kernel32::VirtualAllocEx($process, [IntPtr]::Zero, $dllPathLength, 0x3000, 4) # MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE
$bytesWrittenPtr = [IntPtr]::Zero
$Kernel32::WriteProcessMemory($process, $remoteMemory, $dllPathBytes, $dllPathBytes.Length, [ref] $bytesWrittenPtr)
$loadLibraryAddr = $Kernel32::GetProcAddress($Kernel32::GetModuleHandle("kernel32.dll"), "LoadLibraryA")
$thread = $Kernel32::CreateRemoteThread($process, [IntPtr]::Zero, 0, $loadLibraryAddr, $remoteMemory, 0, [IntPtr
]::Zero)
$Kernel32::CloseHandle($process) | Out-Null
}
if ($process) {
$processId = $process.Id
Inject-DllToProcess -ProcessID $processId -DllPath "dllninpcdekikonunu"
} else {
Write-Host "Gerekli uygulama bulunamadı."
}
function Inject-DllToProcess
{
[CmdletBinding()]
Param (
[Parameter( Mandatory = $true )]
[Int]
$ProcessID,
[Parameter( Mandatory = $true )]
[String]
$DllPath
)
$Kernel32 = Add-Type -Name "Kernel32" -Namespace Win32 -MemberDefinition @"
[DllImport("kernel32.dll")]
public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern IntPtr GetModuleHandle(string lpModuleName);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] buffer, uint size, out IntPtr lpNumberOfBytesWritten);
[DllImport("kernel32.dll")]
public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("kernel32.dll")]
public static extern int CloseHandle(IntPtr hObject);
"@
$process = $Kernel32::OpenProcess(0x001F0FFF, $false, $ProcessID) # PROCESS_ALL_ACCESS
if ($process -eq [IntPtr]::Zero) {
return
}
$dllPathBytes = [System.Text.Encoding]::ASCII.GetBytes($DllPath)
$dllPathLength = $dllPathBytes.Length + 1 # Include null terminator
$remoteMemory = $Kernel32::VirtualAllocEx($process, [IntPtr]::Zero, $dllPathLength, 0x3000, 4) # MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE
$bytesWrittenPtr = [IntPtr]::Zero
$Kernel32::WriteProcessMemory($process, $remoteMemory, $dllPathBytes, $dllPathBytes.Length, [ref] $bytesWrittenPtr)
$loadLibraryAddr = $Kernel32::GetProcAddress($Kernel32::GetModuleHandle("kernel32.dll"), "LoadLibraryA")
$thread = $Kernel32::CreateRemoteThread($process, [IntPtr]::Zero, 0, $loadLibraryAddr, $remoteMemory, 0, [IntPtr
]::Zero)
$Kernel32::CloseHandle($process) | Out-Null
}
. Bu bir hile olmayıp C++;C ile yapılmış dll dosyalarını (Oyunda Çalıştırılacak Scriptleri) belirtilen uygun oyuna injectleme işlemi yapan (kodu oyuna zorla tutturan) bir kod. Ne hilesi aradığını söylersen daha fazla yardımcı olabilirimmm.
