(self, dll_path, pid)
Inject a DLL of your choice into a running process.

        @type    dll_name: String
        @param   dll_name: The path to the DLL you wish to inject
        @type    pid:      Integer
        @param   pid:      The process ID that you wish to inject into

        @raise pdx: An exception is raised on failure.
Inject a DLL of your choice into a running process.
Inject a DLL of your choice into a running process .
def inject_dll (self, dll_path, pid):
        '''
        Inject a DLL of your choice into a running process.

        @type    dll_name: String
        @param   dll_name: The path to the DLL you wish to inject
        @type    pid:      Integer
        @param   pid:      The process ID that you wish to inject into

        @raise pdx: An exception is raised on failure.
        '''

        dll_len = len(dll_path)

        # get a handle to the process we are injecting into.
        h_process = kernel32.OpenProcess(PROCESS_ALL_ACCESS, False, pid)

        # now we have to allocate enough bytes for the name and path of our DLL.
        arg_address = kernel32.VirtualAllocEx(h_process, 0, dll_len, VIRTUAL_MEM, PAGE_READWRITE)

        # Write the path of the DLL into the previously allocated space. The pointer returned
        written = c_int(0)
        kernel32.WriteProcessMemory(h_process, arg_address, dll_path, dll_len, byref(written))

        # resolve the address of LoadLibraryA()
        h_kernel32 = kernel32.GetModuleHandleA("kernel32.dll")
        h_loadlib  = kernel32.GetProcAddress(h_kernel32, "LoadLibraryA")

        # wow we try to create the remote thread.
        thread_id = c_ulong(0)
        if not kernel32.CreateRemoteThread(h_process, None, 0, h_loadlib, arg_address, 0, byref(thread_id)):
            # free the opened handles.
            kernel32.CloseHandle(h_process)
            kernel32.CloseHandle(h_kernel32)

            raise pdx("CreateRemoteThread failed, unable to inject the DLL %s into PID: %d." % (dll_path, pid), True)

        # free the opened handles.
        kernel32.CloseHandle(h_process)
        kernel32.CloseHandle(h_kernel32)
def inject_dll ( self , dll_path , pid ) : dll_len = len ( dll_path ) # get a handle to the process we are injecting into. h_process = kernel32 . OpenProcess ( PROCESS_ALL_ACCESS , False , pid ) # now we have to allocate enough bytes for the name and path of our DLL. arg_address = kernel32 . VirtualAllocEx ( h_process , 0 , dll_len , VIRTUAL_MEM , PAGE_READWRITE ) # Write the path of the DLL into the previously allocated space. The pointer returned written = c_int ( 0 ) kernel32 . WriteProcessMemory ( h_process , arg_address , dll_path , dll_len , byref ( written ) ) # resolve the address of LoadLibraryA() h_kernel32 = kernel32 . GetModuleHandleA ( "kernel32.dll" ) h_loadlib = kernel32 . GetProcAddress ( h_kernel32 , "LoadLibraryA" ) # wow we try to create the remote thread. thread_id = c_ulong ( 0 ) if not kernel32 . CreateRemoteThread ( h_process , None , 0 , h_loadlib , arg_address , 0 , byref ( thread_id ) ) : # free the opened handles. kernel32 . CloseHandle ( h_process ) kernel32 . CloseHandle ( h_kernel32 ) raise pdx ( "CreateRemoteThread failed, unable to inject the DLL %s into PID: %d." % ( dll_path , pid ) , True ) # free the opened handles. kernel32 . CloseHandle ( h_process ) kernel32 . CloseHandle ( h_kernel32 )