SoFunction
Updated on 2025-03-07

Code to implement memory injection using C# calling system API


//Import the namespace first
using ;
/// <summary>
/// Keep or open a zone in the virtual address space of the specified process.. Unless MEM_RESET is used, the memory area is initialized to 0.
/// </summary>
/// <param name="process">The handle of the process in which space is allocated. This handle must have PROCESS_VM_OPERATION access permission</param>
/// <param name="pAddress">The address area you want to obtain. It is generally automatically allocated by NULL</param>
/// <param name="size">The memory size to be allocated. Byte units. Note that the actual allocated memory size is an integer multiple of the page memory size</param>
/// <param name="type">Type of memory allocation</param>
/// <param name="protect">Memory page protection</param>
/// <returns> If the execution is successful, the first address of the allocated memory will be returned, and if the failure is returned, the first address of the allocated memory will be returned. </returns>
[DllImport("")] //Declare API function
public static extern int VirtualAllocEx(IntPtr process, int pAddress, int size, int type, int protect);
/// <summary>
/// Write to a certain process's memory area. The entry area must be accessible, otherwise the operation will fail
/// </summary>
/// <param name="process">Process handle</param>
/// <param name="baseAddress">The first memory address to be written</param>
/// <param name="buffer">Pointer to the data to be written (data current storage address). </param>
/// <param name="nSize">Number of bytes to be written. </param>
/// <param name="lpNumberOfBytesWritten">Length of actual data</param>
/// <returns>Non-zero means success, zero means failure</returns>
[DllImport("")]
public static extern int WriteProcessMemory(IntPtr process, int baseAddress, string buffer, int nSize, int lpNumberOfBytesWritten);
/// <summary>
/// Retrieve the output library function address in the specified dynamic link library (DLL)
/// </summary>
/// <param name="hModule"> DLL module handle The handle of the DLL module containing this function. The LoadLibrary or GetModuleHandle function can return this handle. </param>
/// <param name="lpProcName">Function name Contains a NULL-end string of the function name, or a specified ordinal value of the function. If this parameter is an ordinal value, it must be at the bottom byte of a word and the high byte must be 0. </param>
/// The <returns> call is successful and returns the output function address in the DLL. The call fails and returns 0. Get further error message and call the function GetLastError. </returns>
[DllImport("")]
public static extern int GetProcAddress(int hModule, string lpProcName);
/// <summary>
/// Get the module handle of an application or dynamic link library
/// </summary>
/// <param name="moduleName">Specify the module name, which is usually the same name as the module's file name</param>
/// <returns> If the execution is successful, return the module handle. Zero means failure</returns>
[DllImport("")]
public static extern int GetModuleHandleA(string moduleName);
/// <summary>
/// Create a thread running in other process address spaces (also known as: creating a remote thread).
/// </summary>
/// <param name="process">handle of the target process</param>
/// <param name="threadAttributes">Pointer to the thread's security description structure, generally set to 0, indicating the use of the default security level</param>
/// <param name="stackSize">Thread stack size, generally set to 0, indicating that the default size is used, generally 1M</param>
/// <param name="startAddress">Address of thread function</param>
/// <param name="parameter">parameters passed to thread function</param>
/// <param name="creationFlags">How to create threads (0 means running immediately after the thread is created CREATE_SUSPENDED 0x00000004 is created in suspended Create will not run until the ResumeThread function is called)</param>
/// <param name="threadid">Pointer to the created thread handle. If the creation fails, the parameter is 0</param>
/// <returns>If the call is successful, return the new thread handle, return 0 if the failure</returns>
[DllImport("")]
public static extern int CreateRemoteThread(IntPtr process, int threadAttributes, int stackSize, int startAddress, int parameter, int creationFlags, int threadid);