PE-inject 1.0


InjectMappedFile

The InjectMappedFile injects MSL file into a Windows executable. Both files have to be mapped in memory before calling this function.

DWORD InjectFile(
 LPVOID lpMappedFile, 	// pointer to executable to inject
 PDWORD lpFileSize, 	// pointer to size of file to inject
 LPVOID lpMappedMsl, 	// pointer to MSL to inject into executable
 DWORD dwMslSize,	// size of MSL file
 LPVOID lpExtraData,	// pointer to extra data
 DWORD dwExtraDataSize,	// size of extra data
 DWORD dwFlags		// injection options
);

Parameters
lpMappedFile
Points to executable data to inject. The file has to be mapped in memory (using MapViewOfFile or by other means).
lpFileSize
Points to a DWORD containing the size of data pointed to by lpMappedFile. After the function returns, the DWORD will contain the size of resulting injected file.
lpMappedMsl
Points to MSL data to inject into executable. The file has to be mapped in memory (using MapViewOfFile or by other means).
dwMslSize
Contains size of MSL file pointed by lpMappedMsl.
lpExtraData
Pointer to a memory location containing extra data, which should be included into resulting executable. The pointer to extra data will be passed to BeforeHandlers and AfterHandlers functions in the STUB_CONFIGURATION structure. This parameter can be NULL to indicate that no extra data should be included.
dwExtraDataSize
Determines the size of extra data. If lpExtraData is NULL, the dwExtraData parameter should be zero.
dwFlags
Set of bit flags that specify how the executable should be processed. To configure the behavior, use one or more of the following values:
INJECT_FLAG_DOIMPORTS
tells the PE-inject stub to process import table of host application. If you do not specify this flag, you will have to process them in BeforeHandlers or AfterHandlers.
INJECT_FLAG_JUMPTOOEP
this will save the entry point of host executable and jump to it, after all startup operations finished. If you do not specify it, it won't be saved, you will have to save it manually and manually perform the jump to entrypoint.
INJECT_FLAG_HANDLERELOC
enables relocation handling routines. If you do not specify this, you will have to handle relocations manually.
INJECT_FLAG_STRIPRELOCS
this will strip away the relocations. This is possible only for EXE files, DLL's can't have the relocatins stripped. If specified, it will reduce resulting executable size by a few kilobytes.
INJECT_FLAG_COMPRESSDLL
enables the compression of injected DLL file. It will reduce resulting executable size at the cost of several miliseconds delay while unpacking the linked DLL everytime the host application is executed.
JCALG1 compression by Jeremy Collake is being used.
INJECT_FLAG_BACKUPTLS
this will make a backup of Tread Local Storage. It is recommended to keep this option enabled, unless you know what you are doing :)
Return Values
If the function succeeds, the return value is a pointer to injected executable.
If the function fails, the return value is NULL.
Remarks
For MSL creation and management routines, see libMSL (http://www.migeel.sk).
When you no longer need the buffer returned by InjectMappedFile, use InjectFree to free the occupied memory.