DLL Injector (x86 + x64, Unicode + MBCS)

[Cypher]

Figured I'd release the current build of my loader for an internal project I'm working on:

Compiled and working on both IA-32 and AMD64.
Compiled and working with both Unicode and MBCS/ASCII compiler flags. (Defaults to Unicode for obvious reasons.)

Also supports unloading the module.

Code is written in C++ with full exception handling (none of this annoying C-based return value checking crap).

Only tested on MSVC++. Visual Studio 2008 project files supplied.

Note: The AMD64 version can only inject into AMD64 processes, and the IA-32 version can only inject into IA-32 processes. It is possible to inject into IA-32 from AMD64 but I didn't bother because I needed an IA-32 version anyway and the code is much cleaner if I don't have to support that.

Furthermore, don't touch the EH compiler settings, they're set the way they are for a reason and the code won't work properly if you change it. If you modify it then you can't mix SEH and C++ EH and so all the SehGuard code will fail and you won't be able to proxy SEH to C++ EH. In short: If you don't know what it does, just leave it alone.

Pretty much all the code should be documented but I might have missed some (I didn't check). It should be very easy to follow though for any Windows programmer.

Obviously you'll need to change the module name to the name of your module.

Comments, suggestions, and criticisms appreciated.

Credits:
Kynox
Greyman
Jeffrey M Richter / Christophe Nasarre
jaredpar
All of GD
Anyone I forgot (let me know)

Download:
Injector v20090421a
Injector v20090421b (Thanks Patrick! <3)

Updates will be posted here.

[jagged software]

Cool stuff dude, thanks for sharing your methods. +rep

[Zephir]

awesome I surely can learn plenty from it +rep

[ostapus]

Nicely commented code As i understand, this is common method with remotethread/loadlibrary approach. But in this way loaded module name will be shown up in loaded modules list, right ?

[Cypher]

Nicely commented code As i understand, this is common method with remotethread/loadlibrary approach. But in this way loaded module name will be shown up in loaded modules list, right ?

Correct, hence the creation of:
Module Cloaker v2 « Ramblings++