parameters: (self, dllname, procname = None, lpParameter = 0,
                                                 bWait = True, dwTimeout = None)
return_statement: return aThread
docstring: Injects a DLL into the process memory.
  
          @warning: Setting C{bWait} to C{True} when the process is frozen by a
              debug event will cause a deadlock in your debugger.
  
          @warning: This involves allocating memory in the target process.
              This is how the freeing of this memory is handled:
  
               - If the C{bWait} flag is set to C{True} the memory will be freed
                 automatically before returning from this method.
               - If the C{bWait} flag is set to C{False}, the memory address is
                 set as the L{Thread.pInjectedMemory} property of the returned
                 thread object.
               - L{Debug} objects free L{Thread.pInjectedMemory} automatically
                 both when it detaches from a process and when the injected
                 thread finishes its execution.
               - The {Thread.kill} method also frees L{Thread.pInjectedMemory}
                 automatically, even if you're not attached to the process.
  
              You could still be leaking memory if not careful. For example, if
              you inject a dll into a process you're not attached to, you don't
              wait for the thread's completion and you don't kill it either, the
              memory would be leaked.
  
          @see: L{inject_code}
  
          @type  dllname: str
          @param dllname: Name of the DLL module to load.
  
          @type  procname: str
          @param procname: (Optional) Procedure to call when the DLL is loaded.
  
          @type  lpParameter: int
          @param lpParameter: (Optional) Parameter to the C{procname} procedure.
  
          @type  bWait: bool
          @param bWait: C{True} to wait for the process to finish.
              C{False} to return immediately.
  
          @type  dwTimeout: int
          @param dwTimeout: (Optional) Timeout value in milliseconds.
              Ignored if C{bWait} is C{False}.
  
          @rtype: L{Thread}
          @return: Newly created thread object. If C{bWait} is set to C{True} the
              thread will be dead, otherwise it will be alive.
  
          @raise NotImplementedError: The target platform is not supported.
              Currently calling a procedure in the library is only supported in
              the I{i386} architecture.
  
          @raise WindowsError: An exception is raised on error.
docstring_summary: Injects a DLL into the process memory.
docstring_tokens: Injects a DLL into the process memory .
function: def inject_dll(self, dllname, procname = None, lpParameter = 0,
                                                 bWait = True, dwTimeout = None):
          """
          Injects a DLL into the process memory.
  
          @warning: Setting C{bWait} to C{True} when the process is frozen by a
              debug event will cause a deadlock in your debugger.
  
          @warning: This involves allocating memory in the target process.
              This is how the freeing of this memory is handled:
  
               - If the C{bWait} flag is set to C{True} the memory will be freed
                 automatically before returning from this method.
               - If the C{bWait} flag is set to C{False}, the memory address is
                 set as the L{Thread.pInjectedMemory} property of the returned
                 thread object.
               - L{Debug} objects free L{Thread.pInjectedMemory} automatically
                 both when it detaches from a process and when the injected
                 thread finishes its execution.
               - The {Thread.kill} method also frees L{Thread.pInjectedMemory}
                 automatically, even if you're not attached to the process.
  
              You could still be leaking memory if not careful. For example, if
              you inject a dll into a process you're not attached to, you don't
              wait for the thread's completion and you don't kill it either, the
              memory would be leaked.
  
          @see: L{inject_code}
  
          @type  dllname: str
          @param dllname: Name of the DLL module to load.
  
          @type  procname: str
          @param procname: (Optional) Procedure to call when the DLL is loaded.
  
          @type  lpParameter: int
          @param lpParameter: (Optional) Parameter to the C{procname} procedure.
  
          @type  bWait: bool
          @param bWait: C{True} to wait for the process to finish.
              C{False} to return immediately.
  
          @type  dwTimeout: int
          @param dwTimeout: (Optional) Timeout value in milliseconds.
              Ignored if C{bWait} is C{False}.
  
          @rtype: L{Thread}
          @return: Newly created thread object. If C{bWait} is set to C{True} the
              thread will be dead, otherwise it will be alive.
  
          @raise NotImplementedError: The target platform is not supported.
              Currently calling a procedure in the library is only supported in
              the I{i386} architecture.
  
          @raise WindowsError: An exception is raised on error.
          """
  
          # Resolve kernel32.dll
          aModule = self.get_module_by_name(compat.b('kernel32.dll'))
          if aModule is None:
              self.scan_modules()
              aModule = self.get_module_by_name(compat.b('kernel32.dll'))
          if aModule is None:
              raise RuntimeError(
                  "Cannot resolve kernel32.dll in the remote process")
  
          # Old method, using shellcode.
          if procname:
              if self.get_arch() != win32.ARCH_I386:
                  raise NotImplementedError()
              dllname = compat.b(dllname)
  
              # Resolve kernel32.dll!LoadLibraryA
              pllib = aModule.resolve(compat.b('LoadLibraryA'))
              if not pllib:
                  raise RuntimeError(
                      "Cannot resolve kernel32.dll!LoadLibraryA"
                      " in the remote process")
  
              # Resolve kernel32.dll!GetProcAddress
              pgpad = aModule.resolve(compat.b('GetProcAddress'))
              if not pgpad:
                  raise RuntimeError(
                      "Cannot resolve kernel32.dll!GetProcAddress"
                      " in the remote process")
  
              # Resolve kernel32.dll!VirtualFree
              pvf = aModule.resolve(compat.b('VirtualFree'))
              if not pvf:
                  raise RuntimeError(
                      "Cannot resolve kernel32.dll!VirtualFree"
                      " in the remote process")
  
              # Shellcode follows...
              code  = compat.b('')
  
              # push dllname
              code += compat.b('\xe8') + struct.pack('<L', len(dllname) + 1) + dllname + compat.b('\0')
  
              # mov eax, LoadLibraryA
              code += compat.b('\xb8') + struct.pack('<L', pllib)
  
              # call eax
              code += compat.b('\xff\xd0')
  
              if procname:
  
                  # push procname
                  code += compat.b('\xe8') + struct.pack('<L', len(procname) + 1)
                  code += procname + compat.b('\0')
  
                  # push eax
                  code += compat.b('\x50')
  
                  # mov eax, GetProcAddress
                  code += compat.b('\xb8') + struct.pack('<L', pgpad)
  
                  # call eax
                  code += compat.b('\xff\xd0')
  
                  # mov ebp, esp      ; preserve stack pointer
                  code += compat.b('\x8b\xec')
  
                  # push lpParameter
                  code += compat.b('\x68') + struct.pack('<L', lpParameter)
  
                  # call eax
                  code += compat.b('\xff\xd0')
  
                  # mov esp, ebp      ; restore stack pointer
                  code += compat.b('\x8b\xe5')
  
              # pop edx       ; our own return address
              code += compat.b('\x5a')
  
              # push MEM_RELEASE  ; dwFreeType
              code += compat.b('\x68') + struct.pack('<L', win32.MEM_RELEASE)
  
              # push 0x1000       ; dwSize, shellcode max size 4096 bytes
              code += compat.b('\x68') + struct.pack('<L', 0x1000)
  
              # call $+5
              code += compat.b('\xe8\x00\x00\x00\x00')
  
              # and dword ptr [esp], 0xFFFFF000   ; align to page boundary
              code += compat.b('\x81\x24\x24\x00\xf0\xff\xff')
  
              # mov eax, VirtualFree
              code += compat.b('\xb8') + struct.pack('<L', pvf)
  
              # push edx      ; our own return address
              code += compat.b('\x52')
  
              # jmp eax   ; VirtualFree will return to our own return address
              code += compat.b('\xff\xe0')
  
              # Inject the shellcode.
              # There's no need to free the memory,
              # because the shellcode will free it itself.
              aThread, lpStartAddress = self.inject_code(code, lpParameter)
  
          # New method, not using shellcode.
          else:
  
              # Resolve kernel32.dll!LoadLibrary (A/W)
              if type(dllname) == type(u''):
                  pllibname = compat.b('LoadLibraryW')
                  bufferlen = (len(dllname) + 1) * 2
                  dllname = win32.ctypes.create_unicode_buffer(dllname).raw[:bufferlen + 1]
              else:
                  pllibname = compat.b('LoadLibraryA')
                  dllname   = compat.b(dllname) + compat.b('\x00')
                  bufferlen = len(dllname)
              pllib = aModule.resolve(pllibname)
              if not pllib:
                  msg = "Cannot resolve kernel32.dll!%s in the remote process"
                  raise RuntimeError(msg % pllibname)
  
              # Copy the library name into the process memory space.
              pbuffer = self.malloc(bufferlen)
              try:
                  self.write(pbuffer, dllname)
  
                  # Create a new thread to load the library.
                  try:
                      aThread = self.start_thread(pllib, pbuffer)
                  except WindowsError:
                      e = sys.exc_info()[1]
                      if e.winerror != win32.ERROR_NOT_ENOUGH_MEMORY:
                          raise
  
                      # This specific error is caused by trying to spawn a new
                      # thread in a process belonging to a different Terminal
                      # Services session (for example a service).
                      raise NotImplementedError(
                          "Target process belongs to a different"
                          " Terminal Services session, cannot inject!"
                      )
  
                  # Remember the buffer address.
                  #  It will be freed ONLY by the Thread.kill() method
                  #  and the EventHandler class, otherwise you'll have to
                  #  free it in your code.
                  aThread.pInjectedMemory = pbuffer
  
              # Free the memory on error.
              except Exception:
                  self.free(pbuffer)
                  raise
  
          # Wait for the thread to finish.
          if bWait:
              aThread.wait(dwTimeout)
              self.free(aThread.pInjectedMemory)
              del aThread.pInjectedMemory
  
          # Return the thread object.
          return aThread
function_tokens: def inject_dll ( self , dllname , procname = None , lpParameter = 0 , bWait = True , dwTimeout = None ) : # Resolve kernel32.dll aModule = self . get_module_by_name ( compat . b ( 'kernel32.dll' ) ) if aModule is None : self . scan_modules ( ) aModule = self . get_module_by_name ( compat . b ( 'kernel32.dll' ) ) if aModule is None : raise RuntimeError ( "Cannot resolve kernel32.dll in the remote process" ) # Old method, using shellcode. if procname : if self . get_arch ( ) != win32 . ARCH_I386 : raise NotImplementedError ( ) dllname = compat . b ( dllname ) # Resolve kernel32.dll!LoadLibraryA pllib = aModule . resolve ( compat . b ( 'LoadLibraryA' ) ) if not pllib : raise RuntimeError ( "Cannot resolve kernel32.dll!LoadLibraryA" " in the remote process" ) # Resolve kernel32.dll!GetProcAddress pgpad = aModule . resolve ( compat . b ( 'GetProcAddress' ) ) if not pgpad : raise RuntimeError ( "Cannot resolve kernel32.dll!GetProcAddress" " in the remote process" ) # Resolve kernel32.dll!VirtualFree pvf = aModule . resolve ( compat . b ( 'VirtualFree' ) ) if not pvf : raise RuntimeError ( "Cannot resolve kernel32.dll!VirtualFree" " in the remote process" ) # Shellcode follows... code = compat . b ( '' ) # push dllname code += compat . b ( '\xe8' ) + struct . pack ( '<L' , len ( dllname ) + 1 ) + dllname + compat . b ( '\0' ) # mov eax, LoadLibraryA code += compat . b ( '\xb8' ) + struct . pack ( '<L' , pllib ) # call eax code += compat . b ( '\xff\xd0' ) if procname : # push procname code += compat . b ( '\xe8' ) + struct . pack ( '<L' , len ( procname ) + 1 ) code += procname + compat . b ( '\0' ) # push eax code += compat . b ( '\x50' ) # mov eax, GetProcAddress code += compat . b ( '\xb8' ) + struct . pack ( '<L' , pgpad ) # call eax code += compat . b ( '\xff\xd0' ) # mov ebp, esp      ; preserve stack pointer code += compat . b ( '\x8b\xec' ) # push lpParameter code += compat . b ( '\x68' ) + struct . pack ( '<L' , lpParameter ) # call eax code += compat . b ( '\xff\xd0' ) # mov esp, ebp      ; restore stack pointer code += compat . b ( '\x8b\xe5' ) # pop edx       ; our own return address code += compat . b ( '\x5a' ) # push MEM_RELEASE  ; dwFreeType code += compat . b ( '\x68' ) + struct . pack ( '<L' , win32 . MEM_RELEASE ) # push 0x1000       ; dwSize, shellcode max size 4096 bytes code += compat . b ( '\x68' ) + struct . pack ( '<L' , 0x1000 ) # call $+5 code += compat . b ( '\xe8\x00\x00\x00\x00' ) # and dword ptr [esp], 0xFFFFF000   ; align to page boundary code += compat . b ( '\x81\x24\x24\x00\xf0\xff\xff' ) # mov eax, VirtualFree code += compat . b ( '\xb8' ) + struct . pack ( '<L' , pvf ) # push edx      ; our own return address code += compat . b ( '\x52' ) # jmp eax   ; VirtualFree will return to our own return address code += compat . b ( '\xff\xe0' ) # Inject the shellcode. # There's no need to free the memory, # because the shellcode will free it itself. aThread , lpStartAddress = self . inject_code ( code , lpParameter ) # New method, not using shellcode. else : # Resolve kernel32.dll!LoadLibrary (A/W) if type ( dllname ) == type ( u'' ) : pllibname = compat . b ( 'LoadLibraryW' ) bufferlen = ( len ( dllname ) + 1 ) * 2 dllname = win32 . ctypes . create_unicode_buffer ( dllname ) . raw [ : bufferlen + 1 ] else : pllibname = compat . b ( 'LoadLibraryA' ) dllname = compat . b ( dllname ) + compat . b ( '\x00' ) bufferlen = len ( dllname ) pllib = aModule . resolve ( pllibname ) if not pllib : msg = "Cannot resolve kernel32.dll!%s in the remote process" raise RuntimeError ( msg % pllibname ) # Copy the library name into the process memory space. pbuffer = self . malloc ( bufferlen ) try : self . write ( pbuffer , dllname ) # Create a new thread to load the library. try : aThread = self . start_thread ( pllib , pbuffer ) except WindowsError : e = sys . exc_info ( ) [ 1 ] if e . winerror != win32 . ERROR_NOT_ENOUGH_MEMORY : raise # This specific error is caused by trying to spawn a new # thread in a process belonging to a different Terminal # Services session (for example a service). raise NotImplementedError ( "Target process belongs to a different" " Terminal Services session, cannot inject!" ) # Remember the buffer address. #  It will be freed ONLY by the Thread.kill() method #  and the EventHandler class, otherwise you'll have to #  free it in your code. aThread . pInjectedMemory = pbuffer # Free the memory on error. except Exception : self . free ( pbuffer ) raise # Wait for the thread to finish. if bWait : aThread . wait ( dwTimeout ) self . free ( aThread . pInjectedMemory ) del aThread . pInjectedMemory # Return the thread object. return aThread