TrueInjector/Utils.cs at main · ZygoteCode/TrueInjector · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
using PeNet;
using PeNet.Header.Pe;
using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;
using System.Windows.Forms;

public class Utils
{
    [DllImport("kernel32.dll")]
    private static extern bool IsWow64Process(IntPtr hProcess, out bool wow64Process);

    public static bool CanBeInjected(int processId, string dllPath)
    {
        try
        {
            if (!File.Exists(dllPath))
            {
                return false;
            }

            if (!Path.GetExtension(dllPath).Equals(".dll", StringComparison.OrdinalIgnoreCase))
            {
                return false;
            }

            var process = Process.GetProcessById(processId);

            if (process == null)
            {
                return false;
            }

            var pe = new PeFile(dllPath);

            if (pe.ImageNtHeaders.OptionalHeader.AddressOfEntryPoint == 0)
            {
                return false;
            }

            var dllArch = pe.ImageNtHeaders.FileHeader.Machine;

            bool processIs64 = Environment.Is64BitOperatingSystem &&
                               IsProcess64Bit(process);

            if (dllArch == MachineType.Amd64 && !processIs64)
            {
                return false;
            }

            if (dllArch == MachineType.I386 && processIs64)
            {
                return false;
            }

            return true;
        }
        catch
        {
            return false;
        }
    }

    public static bool CanBeInjected2(ListView listView, string dllPath)
    {
        try
        {
            if (listView.SelectedItems.Count == 0)
            {
                return false;
            }

            if (!File.Exists(dllPath))
            {
                return false;
            }

            if (!Path.GetExtension(dllPath).Equals(".dll", StringComparison.OrdinalIgnoreCase))
            {
                return false;
            }

            var item = listView.SelectedItems[0];

            if (item == null)
            {
                return false;
            }

            var process = Process.GetProcessById(int.Parse(item.Text));

            if (process == null)
            {
                return false;
            }

            var pe = new PeFile(dllPath);

            if (pe.ImageNtHeaders.OptionalHeader.AddressOfEntryPoint == 0)
            {
                return false;
            }

            var dllArch = pe.ImageNtHeaders.FileHeader.Machine;

            bool processIs64 = Environment.Is64BitOperatingSystem &&
                               IsProcess64Bit(process);

            if (dllArch == MachineType.Amd64 && !processIs64)
            {
                return false;
            }

            if (dllArch == MachineType.I386 && processIs64)
            {
                return false;
            }

            return true;
        }
        catch
        {
            return false;
        }
    }

    private static bool IsProcess64Bit(Process process)
    {
        if (!Environment.Is64BitOperatingSystem)
        {
            return false;
        }

        bool isWow64;
        IsWow64Process(process.Handle, out isWow64);
        return !isWow64;
    }
}