i got the New unpatch Code for injector i don't realiy sure is help much. anywhere this is the Code part 1 Code php signed int __fastcall InjectDll(DWORD dwProcessId, const char *dllpath) { //.... hProcc = OpenProcess(0x1FFFFFu, 0, v3); if ( !hProcc ) { v5 = GetLastError(); sub_401F10(&DstBuf, "OpenProcess() failed: %d", v5); printf(&DstBuf); return 0; } v7 = GetModuleHandleA("kernel32.dll"); v8 = (DWORD (__stdcall *)(LPVOID))GetProcAddress(v7, "LoadLibraryA"); v9 = VirtualAllocEx(hProcc, 0, strlen(szDLL), 0x3000u, 4u);// MEM_COMMIT, PAGE_READWRITE WriteProcessMemory(hProcc, v9, szDLL, strlen(szDLL), 0); CreateRemoteThread(hProcc, 0, 0, v8, v9, 0, 0); CloseHandle(hProcc); return 1; } Part 2 php Code BOOL __cdecl FindProcess() { // .... v4 = (unsigned int)&v5 ^ __security_cookie; szExeName = (const CHAR *)dw_szExeName; hSnapShot = CreateToolhelp32Snapshot(2u, 0); if ( hSnapShot == (HANDLE)-1 ) { MessageBoxA(0, "injector Complam ", "2MLoader", 0); printf("Error: injector Error Miss Dll For Somethink!"); return 0; } pe.dwSize = 296; if ( !Process32First(hSnapShot, &pe) ) return 0; while ( !StrStrIA(pe.szExeFile, szExeName) ) { result = Process32Next(hSnapShot, &pe); if ( !result ) return result; } return pe.th32ProcessID; }
