PsInjectDll("test.exe", "test.dll")

PsInjectDll(test.exe, "test.dll")

PsInjectDll("test.exe", "D:\test.dll")

PsInjectDll(Process, DllName)   ; Process — PID или Name.exe.
{
    static AccessRights = 0x43A     ; PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION
    ; | PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION
    Process, Exist, %Process%
    If !(PID := ErrorLevel) {
        MsgBox, Процесс не найден: %Process%
        Return 0
    }
    If !FileExist(DllName) {
        MsgBox, DLL не найдена: %DllName%
        Return 0
    }
    hKernel32 := DllCall("GetModuleHandleW", "wstr", "Kernel32.dll", "ptr")
    pLoadLibrary := DllCall("GetProcAddress", "ptr", hKernel32, "astr", "LoadLibraryW", "ptr")
    If !(hProcess := DllCall("OpenProcess", "uint", AccessRights, "int", 0, "uint", PID, "ptr")) {
        MsgBox, Ошибка OpenProcess: %A_LastError%
        Return 0
    }
    RetVal := 0
    cbDllName := (StrLen(DllName) + 1) * 2
    If !(pDllName := DllCall("VirtualAllocEx", "ptr", hProcess
                                             , "ptr", 0
                                             , "ptr", cbDllName
                                             , "uint", 0x3000   ; MEM_RESERVE | MEM_COMMIT
                                             , "uint", 4        ; PAGE_READWRITE
                                             , "ptr")) {
        MsgBox, Ошибка VirtualAllocEx: %A_LastError%
        Goto, Close
    }
    If !DllCall("WriteProcessMemory", "ptr", hProcess
                                    , "ptr", pDllName
                                    , "wstr", DllName
                                    , "ptr", cbDllName
                                    , "ptr *", cbWritten) {
        MsgBox, Ошибка WriteProcessMemory: %A_LastError%
        Goto, Free
    }
    If !(hThread := DllCall("CreateRemoteThread", "ptr", hProcess
                                                , "ptr", 0
                                                , "ptr", 0
                                                , "ptr", pLoadLibrary
                                                , "ptr", pDllName
                                                , "uint", 0
                                                , "ptr", 0
                                                , "ptr")) {
        MsgBox, Ошибка CreateRemoteThread: %A_LastError%
        Goto, Free
    }
    DllCall("CloseHandle", "ptr", hThread)
    RetVal := 1
    Goto, Close
Free:
    DllCall("VirtualFreeEx", "ptr", hProcess, "ptr", pDllName, "ptr", 0, "uint", 0x8000)
    ; 0x8000 = MEM_RELEASE
Close:
    DllCall("CloseHandle", "ptr", hProcess)
    Return RetVal
}

#AutoIt3Wrapper_UseUpx=n
#AutoIt3Wrapper_UseX64=n

#RequireAdmin
#include <GUIConstants.au3>

GUICreate("Beispiel", 275, 100)
GUISetBkColor(0xFFFFFF)
GUICtrlCreateLabel("Prozess:", 10, 10, 50, 17)
$I_ProcessName = GUICtrlCreateInput("", 65, 10, 200, 21)
GUICtrlCreateLabel("DLL:", 10, 40, 50, 17)
$I_DllPath = GUICtrlCreateInput("", 65, 40, 150, 21)
$B_SearchDll = GUICtrlCreateButton("...", 225, 40, 40, 25)
$R_Auto = GUICtrlCreateRadio("Automatisch", 10, 75, 75, 17)
GUICtrlSetState(-1, $GUI_CHECKED)
$R_Man = GUICtrlCreateRadio("Manuell", 130, 75, 55, 17)
$B_Inject = GUICtrlCreateButton("Injizieren", 190, 70, 75, 25)
GUICtrlSetState(-1, $GUI_DISABLE)
GUISetState()

$Injected = False

Do
    $Msg = GUIGetMsg()
    Switch $Msg
        Case $B_SearchDll
            GUICtrlSetData($I_DllPath, FileOpenDialog("Dll", @HomeDrive, "Dynamic Link Library (*.dll)", 3))
        Case $R_Auto
            GUICtrlSetState($B_Inject, $GUI_DISABLE)
        Case $R_Man
            GUICtrlSetState($B_Inject, $GUI_ENABLE)
        Case $B_Inject
            _InjectDll(ProcessExists(GUICtrlRead($I_ProcessName)), GUICtrlRead($I_DllPath))
            _Message(@error)
    EndSwitch

    If BitAND(GUICtrlRead($R_Auto), $GUI_CHECKED) And Not $Injected Then
        $ProcessId = ProcessExists(GUICtrlRead($I_ProcessName))
        If $ProcessId > 0 Then
            _InjectDll($ProcessId, GUICtrlRead($I_DllPath))
            _Message(@error)
            $Injected = True
            ;Exit
        EndIf
    EndIf

    Sleep(10)
Until $Msg == $GUI_EVENT_CLOSE



Func _Message($ErrorCode)
    If $ErrorCode <> 0 Then
        MsgBox(48, "Fehler", "Es ist ein Fehler aufgetreten!" & @CRLF & "Fehlercode: " & @error)
    Else
        MsgBox(64, "Info", "Injektion erfolgreich!")
    EndIf
EndFunc


;=================================================================================================
; Function:            _InjectDll($ProcessId, $DllPath)
; Description:        Injects a .dll into a running program.
; Return Value(s):    On Success - Returns true
;                    On Failure - Returns false
;                    @Error - 0 = No error.
;                             1 = Invalid ProcessId.
;                             2 = File does not exist.
;                             3 = File is not a .dll (invalid file).
;                             4 = Failed to open 'Advapi32.dll'.
;                             5 = Failed to get the full path.
;                             6 = Failed to open the process.
;                             7 = Failed to call 'GetModuleHandle'.
;                             8 = Failed to call 'GetProcAddress'.
;                             9 = Failed to call 'VirtualAllocEx'.
;                             10 = Failed to write the memory.
;                             11 = Failed to create the 'RemoteThread'.
; Author(s):        KillerDeluxe
;=================================================================================================

Func _InjectDll($ProcessId, $DllPath)
    If $ProcessId == 0 Then Return SetError(1, "", False)
    If Not(FileExists($DllPath)) Then Return SetError(2, "", False)
    If Not(StringRight($DllPath, 4) == ".dll") Then Return SetError(3, "", False)

    $Kernel32 = DllOpen("kernel32.dll")
    If @error Then Return SetError(4, "", False)

    $DLL_Path = DllStructCreate("char[255]")
    DllCall($Kernel32, "DWORD", "GetFullPathNameA", "str", $DllPath, "DWORD", 255, "ptr", DllStructGetPtr($DLL_Path), "int", 0)
    If @error Then Return SetError(5, "", False)

    $hProcess = DllCall($Kernel32, "DWORD", "OpenProcess", "DWORD", 0x1F0FFF, "int", 0, "DWORD", $ProcessId)
    If @error Then Return SetError(6, "", False)

    $hModule = DllCall($Kernel32, "DWORD", "GetModuleHandleA", "str", "kernel32.dll")
    If @error Then Return SetError(7, "", False)

    $lpStartAddress = DllCall($Kernel32, "DWORD", "GetProcAddress", "DWORD", $hModule[0], "str", "LoadLibraryA")
    If @error Then Return SetError(8, "", False)

    $lpParameter = DllCall($Kernel32, "DWORD", "VirtualAllocEx", "int", $hProcess[0], "int", 0, "ULONG_PTR", DllStructGetSize($DLL_Path), "DWORD", 0x3000, "int", 4)
    If @error Then Return SetError(9, "", False)

    DllCall("kernel32.dll", "BOOL", "WriteProcessMemory", "int", $hProcess[0], "DWORD", $lpParameter[0], "str", DllStructGetData($DLL_Path, 1), "ULONG_PTR", DllStructGetSize($DLL_Path), "int", 0)
    If @error Then Return SetError(10, "", False)

    $hThread = DllCall($Kernel32, "int", "CreateRemoteThread", "DWORD", $hProcess[0], "int", 0, "int", 0, "DWORD", $lpStartAddress[0], "DWORD", $lpParameter[0], "int", 0, "int", 0)
    If @error Then Return SetError(11, "", False)

    DllCall($Kernel32, "BOOL", "CloseHandle", "DWORD", $hProcess[0])
    DllClose($Kernel32)

    Return SetError(0, "", True)
EndFunc