(self, dllname, procname = None, lpParameter = 0,
                                               bWait = True, dwTimeout = None)
return aThread
Injects a DLL into the process memory.

        @warning: Setting C{bWait} to C{True} when the process is frozen by a
            debug event will cause a deadlock in your debugger.

        @warning: This involves allocating memory in the target process.
            This is how the freeing of this memory is handled:

             - If the C{bWait} flag is set to C{True} the memory will be freed
               automatically before returning from this method.
             - If the C{bWait} flag is set to C{False}, the memory address is
               set as the L{Thread.pInjectedMemory} property of the returned
               thread object.
             - L{Debug} objects free L{Thread.pInjectedMemory} automatically
               both when it detaches from a process and when the injected
               thread finishes its execution.
             - The {Thread.kill} method also frees L{Thread.pInjectedMemory}
               automatically, even if you're not attached to the process.

            You could still be leaking memory if not careful. For example, if
            you inject a dll into a process you're not attached to, you don't
            wait for the thread's completion and you don't kill it either, the
            memory would be leaked.

        @see: L{inject_code}

        @type  dllname: str
        @param dllname: Name of the DLL module to load.

        @type  procname: str
        @param procname: (Optional) Procedure to call when the DLL is loaded.

        @type  lpParameter: int
        @param lpParameter: (Optional) Parameter to the C{procname} procedure.

        @type  bWait: bool
        @param bWait: C{True} to wait for the process to finish.
            C{False} to return immediately.

        @type  dwTimeout: int
        @param dwTimeout: (Optional) Timeout value in milliseconds.
            Ignored if C{bWait} is C{False}.

        @rtype: L{Thread}
        @return: Newly created thread object. If C{bWait} is set to C{True} the
            thread will be dead, otherwise it will be alive.

        @raise NotImplementedError: The target platform is not supported.
            Currently calling a procedure in the library is only supported in
            the I{i386} architecture.

        @raise WindowsError: An exception is raised on error.
Injects a DLL into the process memory.
Injects a DLL into the process memory .
def inject_dll(self, dllname, procname = None, lpParameter = 0,
                                               bWait = True, dwTimeout = None):
        """
        Injects a DLL into the process memory.

        @warning: Setting C{bWait} to C{True} when the process is frozen by a
            debug event will cause a deadlock in your debugger.

        @warning: This involves allocating memory in the target process.
            This is how the freeing of this memory is handled:

             - If the C{bWait} flag is set to C{True} the memory will be freed
               automatically before returning from this method.
             - If the C{bWait} flag is set to C{False}, the memory address is
               set as the L{Thread.pInjectedMemory} property of the returned
               thread object.
             - L{Debug} objects free L{Thread.pInjectedMemory} automatically
               both when it detaches from a process and when the injected
               thread finishes its execution.
             - The {Thread.kill} method also frees L{Thread.pInjectedMemory}
               automatically, even if you're not attached to the process.

            You could still be leaking memory if not careful. For example, if
            you inject a dll into a process you're not attached to, you don't
            wait for the thread's completion and you don't kill it either, the
            memory would be leaked.

        @see: L{inject_code}

        @type  dllname: str
        @param dllname: Name of the DLL module to load.

        @type  procname: str
        @param procname: (Optional) Procedure to call when the DLL is loaded.

        @type  lpParameter: int
        @param lpParameter: (Optional) Parameter to the C{procname} procedure.

        @type  bWait: bool
        @param bWait: C{True} to wait for the process to finish.
            C{False} to return immediately.

        @type  dwTimeout: int
        @param dwTimeout: (Optional) Timeout value in milliseconds.
            Ignored if C{bWait} is C{False}.

        @rtype: L{Thread}
        @return: Newly created thread object. If C{bWait} is set to C{True} the
            thread will be dead, otherwise it will be alive.

        @raise NotImplementedError: The target platform is not supported.
            Currently calling a procedure in the library is only supported in
            the I{i386} architecture.

        @raise WindowsError: An exception is raised on error.
        """

        # Resolve kernel32.dll
        aModule = self.get_module_by_name(compat.b('kernel32.dll'))
        if aModule is None:
            self.scan_modules()
            aModule = self.get_module_by_name(compat.b('kernel32.dll'))
        if aModule is None:
            raise RuntimeError(
                "Cannot resolve kernel32.dll in the remote process")

        # Old method, using shellcode.
        if procname:
            if self.get_arch() != win32.ARCH_I386:
                raise NotImplementedError()
            dllname = compat.b(dllname)

            # Resolve kernel32.dll!LoadLibraryA
            pllib = aModule.resolve(compat.b('LoadLibraryA'))
            if not pllib:
                raise RuntimeError(
                    "Cannot resolve kernel32.dll!LoadLibraryA"
                    " in the remote process")

            # Resolve kernel32.dll!GetProcAddress
            pgpad = aModule.resolve(compat.b('GetProcAddress'))
            if not pgpad:
                raise RuntimeError(
                    "Cannot resolve kernel32.dll!GetProcAddress"
                    " in the remote process")

            # Resolve kernel32.dll!VirtualFree
            pvf = aModule.resolve(compat.b('VirtualFree'))
            if not pvf:
                raise RuntimeError(
                    "Cannot resolve kernel32.dll!VirtualFree"
                    " in the remote process")

            # Shellcode follows...
            code  = compat.b('')

            # push dllname
            code += compat.b('\xe8') + struct.pack('<L', len(dllname) + 1) + dllname + compat.b('\0')

            # mov eax, LoadLibraryA
            code += compat.b('\xb8') + struct.pack('<L', pllib)

            # call eax
            code += compat.b('\xff\xd0')

            if procname:

                # push procname
                code += compat.b('\xe8') + struct.pack('<L', len(procname) + 1)
                code += procname + compat.b('\0')

                # push eax
                code += compat.b('\x50')

                # mov eax, GetProcAddress
                code += compat.b('\xb8') + struct.pack('<L', pgpad)

                # call eax
                code += compat.b('\xff\xd0')

                # mov ebp, esp      ; preserve stack pointer
                code += compat.b('\x8b\xec')

                # push lpParameter
                code += compat.b('\x68') + struct.pack('<L', lpParameter)

                # call eax
                code += compat.b('\xff\xd0')

                # mov esp, ebp      ; restore stack pointer
                code += compat.b('\x8b\xe5')

            # pop edx       ; our own return address
            code += compat.b('\x5a')

            # push MEM_RELEASE  ; dwFreeType
            code += compat.b('\x68') + struct.pack('<L', win32.MEM_RELEASE)

            # push 0x1000       ; dwSize, shellcode max size 4096 bytes
            code += compat.b('\x68') + struct.pack('<L', 0x1000)

            # call $+5
            code += compat.b('\xe8\x00\x00\x00\x00')

            # and dword ptr [esp], 0xFFFFF000   ; align to page boundary
            code += compat.b('\x81\x24\x24\x00\xf0\xff\xff')

            # mov eax, VirtualFree
            code += compat.b('\xb8') + struct.pack('<L', pvf)

            # push edx      ; our own return address
            code += compat.b('\x52')

            # jmp eax   ; VirtualFree will return to our own return address
            code += compat.b('\xff\xe0')

            # Inject the shellcode.
            # There's no need to free the memory,
            # because the shellcode will free it itself.
            aThread, lpStartAddress = self.inject_code(code, lpParameter)

        # New method, not using shellcode.
        else:

            # Resolve kernel32.dll!LoadLibrary (A/W)
            if type(dllname) == type(u''):
                pllibname = compat.b('LoadLibraryW')
                bufferlen = (len(dllname) + 1) * 2
                dllname = win32.ctypes.create_unicode_buffer(dllname).raw[:bufferlen + 1]
            else:
                pllibname = compat.b('LoadLibraryA')
                dllname   = compat.b(dllname) + compat.b('\x00')
                bufferlen = len(dllname)
            pllib = aModule.resolve(pllibname)
            if not pllib:
                msg = "Cannot resolve kernel32.dll!%s in the remote process"
                raise RuntimeError(msg % pllibname)

            # Copy the library name into the process memory space.
            pbuffer = self.malloc(bufferlen)
            try:
                self.write(pbuffer, dllname)

                # Create a new thread to load the library.
                try:
                    aThread = self.start_thread(pllib, pbuffer)
                except WindowsError:
                    e = sys.exc_info()[1]
                    if e.winerror != win32.ERROR_NOT_ENOUGH_MEMORY:
                        raise

                    # This specific error is caused by trying to spawn a new
                    # thread in a process belonging to a different Terminal
                    # Services session (for example a service).
                    raise NotImplementedError(
                        "Target process belongs to a different"
                        " Terminal Services session, cannot inject!"
                    )

                # Remember the buffer address.
                #  It will be freed ONLY by the Thread.kill() method
                #  and the EventHandler class, otherwise you'll have to
                #  free it in your code.
                aThread.pInjectedMemory = pbuffer

            # Free the memory on error.
            except Exception:
                self.free(pbuffer)
                raise

        # Wait for the thread to finish.
        if bWait:
            aThread.wait(dwTimeout)
            self.free(aThread.pInjectedMemory)
            del aThread.pInjectedMemory

        # Return the thread object.
        return aThread
def inject_dll ( self , dllname , procname = None , lpParameter = 0 , bWait = True , dwTimeout = None ) : # Resolve kernel32.dll aModule = self . get_module_by_name ( compat . b ( 'kernel32.dll' ) ) if aModule is None : self . scan_modules ( ) aModule = self . get_module_by_name ( compat . b ( 'kernel32.dll' ) ) if aModule is None : raise RuntimeError ( "Cannot resolve kernel32.dll in the remote process" ) # Old method, using shellcode. if procname : if self . get_arch ( ) != win32 . ARCH_I386 : raise NotImplementedError ( ) dllname = compat . b ( dllname ) # Resolve kernel32.dll!LoadLibraryA pllib = aModule . resolve ( compat . b ( 'LoadLibraryA' ) ) if not pllib : raise RuntimeError ( "Cannot resolve kernel32.dll!LoadLibraryA" " in the remote process" ) # Resolve kernel32.dll!GetProcAddress pgpad = aModule . resolve ( compat . b ( 'GetProcAddress' ) ) if not pgpad : raise RuntimeError ( "Cannot resolve kernel32.dll!GetProcAddress" " in the remote process" ) # Resolve kernel32.dll!VirtualFree pvf = aModule . resolve ( compat . b ( 'VirtualFree' ) ) if not pvf : raise RuntimeError ( "Cannot resolve kernel32.dll!VirtualFree" " in the remote process" ) # Shellcode follows... code = compat . b ( '' ) # push dllname code += compat . b ( '\xe8' ) + struct . pack ( '<L' , len ( dllname ) + 1 ) + dllname + compat . b ( '\0' ) # mov eax, LoadLibraryA code += compat . b ( '\xb8' ) + struct . pack ( '<L' , pllib ) # call eax code += compat . b ( '\xff\xd0' ) if procname : # push procname code += compat . b ( '\xe8' ) + struct . pack ( '<L' , len ( procname ) + 1 ) code += procname + compat . b ( '\0' ) # push eax code += compat . b ( '\x50' ) # mov eax, GetProcAddress code += compat . b ( '\xb8' ) + struct . pack ( '<L' , pgpad ) # call eax code += compat . b ( '\xff\xd0' ) # mov ebp, esp      ; preserve stack pointer code += compat . b ( '\x8b\xec' ) # push lpParameter code += compat . b ( '\x68' ) + struct . pack ( '<L' , lpParameter ) # call eax code += compat . b ( '\xff\xd0' ) # mov esp, ebp      ; restore stack pointer code += compat . b ( '\x8b\xe5' ) # pop edx       ; our own return address code += compat . b ( '\x5a' ) # push MEM_RELEASE  ; dwFreeType code += compat . b ( '\x68' ) + struct . pack ( '<L' , win32 . MEM_RELEASE ) # push 0x1000       ; dwSize, shellcode max size 4096 bytes code += compat . b ( '\x68' ) + struct . pack ( '<L' , 0x1000 ) # call $+5 code += compat . b ( '\xe8\x00\x00\x00\x00' ) # and dword ptr [esp], 0xFFFFF000   ; align to page boundary code += compat . b ( '\x81\x24\x24\x00\xf0\xff\xff' ) # mov eax, VirtualFree code += compat . b ( '\xb8' ) + struct . pack ( '<L' , pvf ) # push edx      ; our own return address code += compat . b ( '\x52' ) # jmp eax   ; VirtualFree will return to our own return address code += compat . b ( '\xff\xe0' ) # Inject the shellcode. # There's no need to free the memory, # because the shellcode will free it itself. aThread , lpStartAddress = self . inject_code ( code , lpParameter ) # New method, not using shellcode. else : # Resolve kernel32.dll!LoadLibrary (A/W) if type ( dllname ) == type ( u'' ) : pllibname = compat . b ( 'LoadLibraryW' ) bufferlen = ( len ( dllname ) + 1 ) * 2 dllname = win32 . ctypes . create_unicode_buffer ( dllname ) . raw [ : bufferlen + 1 ] else : pllibname = compat . b ( 'LoadLibraryA' ) dllname = compat . b ( dllname ) + compat . b ( '\x00' ) bufferlen = len ( dllname ) pllib = aModule . resolve ( pllibname ) if not pllib : msg = "Cannot resolve kernel32.dll!%s in the remote process" raise RuntimeError ( msg % pllibname ) # Copy the library name into the process memory space. pbuffer = self . malloc ( bufferlen ) try : self . write ( pbuffer , dllname ) # Create a new thread to load the library. try : aThread = self . start_thread ( pllib , pbuffer ) except WindowsError : e = sys . exc_info ( ) [ 1 ] if e . winerror != win32 . ERROR_NOT_ENOUGH_MEMORY : raise # This specific error is caused by trying to spawn a new # thread in a process belonging to a different Terminal # Services session (for example a service). raise NotImplementedError ( "Target process belongs to a different" " Terminal Services session, cannot inject!" ) # Remember the buffer address. #  It will be freed ONLY by the Thread.kill() method #  and the EventHandler class, otherwise you'll have to #  free it in your code. aThread . pInjectedMemory = pbuffer # Free the memory on error. except Exception : self . free ( pbuffer ) raise # Wait for the thread to finish. if bWait : aThread . wait ( dwTimeout ) self . free ( aThread . pInjectedMemory ) del aThread . pInjectedMemory # Return the thread object. return aThread