injection dll qui fait planter le processus cible

#include <iostream>
 #include <windows.h>
 #include <tlhelp32.h>

 using namespace std;

 void SetDebugPrivilege();
 DWORD GetPIDByProcess(char argv[]);
 int DllInject(char dll[], char process[]);

 //Privilege DEBUG
 void SetDebugPrivilege()
 {
 TOKEN_PRIVILEGES privilege;
 LUID Luid;
 HANDLE handle1;
 HANDLE handle2;
 handle1 = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId());
 OpenProcessToken(handle1, TOKEN_ALL_ACCESS, &handle2);
 LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &Luid);
 privilege.PrivilegeCount = 1;
 privilege.Privileges[0].Luid = Luid;
 privilege.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
 AdjustTokenPrivileges(handle2, FALSE, &privilege, sizeof(privilege), NULL, NULL);
 CloseHandle(handle2);
 CloseHandle(handle1);
 }
 //GetPIDByProcess
 DWORD GetPIDByProcess(char argv[])
 {
 HANDLE hSnapShot;
 PROCESSENTRY32 uProcess;

 hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
uProcess.dwSize = (DWORD) sizeof(PROCESSENTRY32);

 int p = 0;
 DWORD PID;

 p = Process32First(hSnapShot, &uProcess);

 while(p)
 {
 if(strstr(uProcess.szExeFile, argv))
 {
 PID = uProcess.th32ProcessID;
 break;
 }
 p = Process32Next(hSnapShot, &uProcess);
 }
 CloseHandle(hSnapShot);
 return PID;
 }

 HANDLE DllInject(char dll[], DWORD PID)
 {
 SetDebugPrivilege();

 char aloader[] = "\xB8\x00\x00\x00\x00" //Mov eax, LoadLibraryA
 "\x68\x00\x00\x00\x00" //PUSH OFFSET szDLL_PATH
 "\xFF\xD0" //Call EAX
 "\xC3"; //RETN

 // Note; il y a plus simple, CreateReamoteThread(,,LoadLibraryA,OFFSET szDLL_PATH,,,);
 // Mais j'avais envie de le faire avec un peu d'assembleur :)


 /* DLL INJECT :
 inject the dll to the target process !
 1) OpenProcess
 2) VirtualAlloc shellcode
 3) VirtualAlloc string
 4) Create Shell
 5) WriteMemory Shell
 6) WriteMemory String
 7) CreatRemoteThread
 */

 HANDLE hproc;
 LPVOID RStr,RShell;
 HANDLE RThread;
 DWORD RThreadId;
 FILE* file=NULL;

 int writtenbytes;


 file = fopen(dll,"r");
 if(file==NULL)
 {
printf("Impossible de localiser le fichier DLL\n");

 fclose(file);
 }
 else
 {
     printf("Dll localiser avec succes!!!\n");
 }



 /* 1 */
 hproc = OpenProcess(PROCESS_ALL_ACCESS,NULL,PID);
 if(hproc) printf("Processus ouvert avec succes!!\n");
 else
 {
     printf("Impossible d'ouvrir le processus\n");

 }


 /* 2 */
 RStr = VirtualAllocEx(hproc,0,strlen(dll)+1,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
 if(RStr) printf("Memoire allouer pour le code avec succes!!\n");
 else
 {
     printf("Impossible d'allouer la memoire\n");

 }

 /* 3 */
 RShell = VirtualAllocEx(hproc,0,sizeof(aloader),MEM_COMMIT,PAGE_EXECUTE_READWRITE);
 if(RShell) printf("Memoire allouer avec succes!!\n");
 else
 {
     printf("Impossible d'allouer la memoire\n");

 }

 /* 4 */
 DWORD *PTR;
 PTR = (DWORD*)(aloader + 1);
 *PTR = (DWORD)LoadLibrary;
 PTR = (DWORD*)(aloader + 6);
 *PTR = (DWORD)RStr;

 /* 5 */
 WriteProcessMemory(hproc,RShell,(LPCVOID) aloader,(SIZE_T)sizeof(aloader),(SIZE_T*)&writtenbytes);
 if(writtenbytes < sizeof(aloader))
 {
     printf("Impossible d'ecrire dans la memoire du processus\n");

 }
 else
 {
     printf("code ecrit dans la Memoire du processus avec succes!!\n");
 }


 /* 6 */

 WriteProcessMemory(hproc,RStr,(LPCVOID) dll,(SIZE_T)strlen(dll) +1,(SIZE_T*)&writtenbytes);
 if(writtenbytes < strlen(dll) +1 )
 {
     printf("erreur\n");

 }
 else
 {
     printf("writeProcessMemory string ok!!\n");
 }

 /* 7 */
 RThread = CreateRemoteThread(hproc,NULL,0,(LPTHREAD_START_ROUTINE)RShell,0,0,&RThreadId);
 if(RThread) printf("Execution des donnees dans un thread avec succes!!\n");
 else
 {
     printf("Impossible d'execute des donnees\n");

 }
fclose(file);
 return RThread;



 }

 int main()
 {
 SetDebugPrivilege();

 char dll[100];
DWORD PID;
printf("PID=0 pour quitter\n");
do
{

 cout<<"\nPID:";
 cin>>PID;
 cout<<"DLL:";
 cin>>dll;

 DllInject(dll, PID);
}while(PID!=0);

 system("pause");
 return 0;
 }

#include <stdio.h>
#include <windows.h>
#include <stdlib.h>

BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
					 )
{
    switch (ul_reason_for_call)
	{
		case DLL_PROCESS_ATTACH:
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
		case DLL_PROCESS_DETACH:
			break;
    }
    return TRUE;
}


extern "C" __declspec(dllexport) int fonction()
{

    MessageBox (NULL, "Bonjour" , "Bonjour", 0 + MB_ICONEXCLAMATION);


}