[TUTOR] Simple Suspend & i3exec Injector

[TUTOR] Simple Suspend & i3exec Injector
Diposkan oleh animator freak di 06.35 . Kamis, 06 desember 2010
Label: tips trik

Tutorial by request

Membuat Simple Suspend & i3exec Injector
Source code seadanya, tanpa error handling.
Tools: MS VB 2008

Yang gak mau repot, silahkan donlot project nya:
1. VB
2. Delphi


1. Buka VB,buat project baru (Ctrl+Shift+N)

http://www.ziddu.com/download/12845322/22059446.jpg.html

2. Buka Form1, dan tambahkan object seperti gambar di bawah


http://www.ziddu.com/download/12845351/suspend.jpg.html
3. Klik kanan pada project, pilih Add -> Module
http://www.ziddu.com/download/12845390/38813368.jpg.html

4. Copy & Paste kode dibawah di Module yg baru saja di buat

Module Module1
    Public Const MEM_COMMIT = 4096
    Public Const PAGE_READWRITE = 4
    Public Const PROCESS_CREATE_THREAD = (&H2)
    Public Const PROCESS_VM_OPERATION = (&H8)
    Public Const PROCESS_VM_READ = &H10
    Public Const PROCESS_VM_WRITE = (&H20)

    Public Enum ThreadAccess As Integer
        TERMINATE = (&H1)
        SUSPEND_RESUME = (&H2)
        GET_CONTEXT = (&H8)
        SET_CONTEXT = (&H10)
        SET_INFORMATION = (&H20)
        QUERY_INFORMATION = (&H40)
        SET_THREAD_TOKEN = (&H80)
        IMPERSONATE = (&H100)
        DIRECT_IMPERSONATION = (&H200)
    End Enum

    Public Declare Function OpenThread Lib "kernel32.dll" (ByVal dwDesiredAccess As ThreadAccess, ByVal bInheritHandle As Boolean, ByVal dwThreadId As UInteger) As IntPtr
    Public Declare Function SuspendThread Lib "kernel32.dll" (ByVal hThread As IntPtr) As UInteger
    Public Declare Function ResumeThread Lib "kernel32.dll" (ByVal hThread As IntPtr) As UInteger
    Public Declare Function CloseHandle Lib "kernel32.dll" (ByVal hHandle As IntPtr) As Boolean

    Public Declare Function ReadProcessMemory Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpBaseAddress As Integer, _
    ByVal lpBuffer As String, _
    ByVal nSize As Integer, _
    ByRef lpNumberOfBytesWritten As Integer) As Integer

    Public Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Integer

    Public Declare Function VirtualAllocEx Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpAddress As Integer, _
    ByVal dwSize As Integer, _
    ByVal flAllocationType As Integer, _
    ByVal flProtect As Integer) As Integer

    Public Declare Function WriteProcessMemory Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpBaseAddress As Integer, _
    ByVal lpBuffer As String, _
    ByVal nSize As Integer, _
    ByRef lpNumberOfBytesWritten As Integer) As Integer

    Public Declare Function GetProcAddress Lib "kernel32" ( _
    ByVal hModule As Integer, _
    ByVal lpProcName As String) As Integer

    Public Declare Function GetModuleHandle Lib "Kernel32" Alias "GetModuleHandleA" ( _
    ByVal lpModuleName As String) As Integer

    Public Declare Function CreateRemoteThread Lib "kernel32" ( _
    ByVal hProcess As Integer, _
    ByVal lpThreadAttributes As Integer, _
    ByVal dwStackSize As Integer, _
    ByVal lpStartAddress As Integer, _
    ByVal lpParameter As Integer, _
    ByVal dwCreationFlags As Integer, _
    ByRef lpThreadId As Integer) As Integer

    Public Declare Function OpenProcess Lib "kernel32" ( _
    ByVal dwDesiredAccess As Integer, _
    ByVal bInheritHandle As Integer, _
    ByVal dwProcessId As Integer) As Integer

End Module


5. Kembali ke Form1, klik kanan pilih View Code
6. Skali lagi copas code dibawah

Imports System

Public Class Form1
    Private prPB As Process
    Private szGame As String = "POINTBLANK"
    Private szDLLName As String
    Private dwProcessID As Long = 0
    Private dwStartAddr As Long
    Private dwBuffer As Long

    Private Sub SuspendProcess(ByVal process As System.Diagnostics.Process)
        For Each t As ProcessThread In process.Threads
            Dim th As IntPtr
            th = OpenThread(ThreadAccess.SUSPEND_RESUME, False, t.Id)
            If th <> IntPtr.Zero Then
                SuspendThread(th)
                CloseHandle(th)
            End If
        Next
    End Sub

    Private Sub ResumeProcess(ByVal process As System.Diagnostics.Process)
        For Each t As ProcessThread In process.Threads
            Dim th As IntPtr
            th = OpenThread(ThreadAccess.SUSPEND_RESUME, False, t.Id)
            If th <> IntPtr.Zero Then
                ResumeThread(th)
                CloseHandle(th)
            End If
        Next
    End Sub

    Private Sub Inject()
        dwProcessID = OpenProcess(PROCESS_CREATE_THREAD Or PROCESS_VM_OPERATION Or PROCESS_VM_WRITE, False, prPB.Id)
        dwStartAddr = GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA")
        dwBuffer = Len(szDLLName) + 1
        Dim ret As Integer
        Dim dwLibAdress As Integer
        dwLibAdress = VirtualAllocEx(dwProcessID, 0, dwBuffer, MEM_COMMIT, PAGE_READWRITE)
        ret = WriteProcessMemory(dwProcessID, dwLibAdress, szDLLName, dwBuffer, 0)
        CreateRemoteThread(dwProcessID, 0, 0, dwStartAddr, dwLibAdress, 0, 0)
        CloseHandle(dwProcessID)
    End Sub


    Private Sub Timer1_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer1.Tick
        If (Process.GetProcessesByName(szGame).Length = 0) Then
            Label1.Text = "Waiting " & szGame
            Button1.Enabled = False
            Button2.Enabled = False
        Else
            Timer1.Stop()
            prPB = Process.GetProcessesByName(szGame)(0)
            dwProcessID = prPB.Id
            szDLLName = Mid$(prPB.MainModule.FileName, 1, Len(prPB.MainModule.FileName) - 4) & ".i3exec"
            Label1.Text = "Found " & szGame
            Button1.Enabled = True
            Button2.Enabled = True
        End If
    End Sub

    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        If Button1.Text = "Suspend" Then
            SuspendProcess(prPB)
            Button1.Text = "Resume"
        Else
            ResumeProcess(prPB)
            Button1.Text = "Suspend"
        End If
    End Sub

    Private Sub Button2_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button2.Click
        Inject()
    End Sub

    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Timer1.Interval = 100
        Timer1.Start()
    End Sub
    'EDIT, nambahin Auto Resume pada saat firm di tutup
    '--------------------------------------------------------------
    Private Sub Form1_FormClosing(ByVal sender As System.Object, ByVal e As System.Windows.Forms.FormClosingEventArgs) Handles MyBase.FormClosing
        If Button1.Text = "Resume" Then
            ResumeProcess(prPB)
        End If
    End Sub
    '--------------------------------------------------------------
End Class


7. Build project, Run
http://www.ziddu.com/download/12845425/29408432.jpg.html