Skip to content

Commit e8f1afd

Browse files
ZygoteCodeZygoteCode
authored
Add README documentation for TrueInjector
Added detailed documentation for TrueInjector, including features, injection methods, installation instructions, usage guidelines, technical details, security considerations, dependencies, and requirements.
1 parent 9a1974c commit e8f1afd

File tree

1 file changed

+186
-0
lines changed

1 file changed

+186
-0
lines changed

‎README.MD‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
# TrueInjector
2+
3+
Advanced DLL injection tool with multiple injection techniques for Windows processes.
4+
5+
![TrueInjector Interface](syringe.ico)
6+
7+
## Table of Contents
8+
9+
- [Overview](#overview)
10+
- [Features](#features)
11+
- [Injection Methods](#injection-methods)
12+
- [Standard Injection](#standard-injection)
13+
- [Manual Mapping](#manual-mapping)
14+
- [Thread Hijacking](#thread-hijacking)
15+
- [Installation](#installation)
16+
- [Usage](#usage)
17+
- [Technical Details](#technical-details)
18+
- [Requirements](#requirements)
19+
- [License](#license)
20+
21+
## Overview
22+
23+
TrueInjector is a powerful DLL injection tool designed for security researchers, reverse engineers, and developers who need to inject DLLs into running processes on Windows systems. It offers multiple injection techniques to bypass various anti-cheat and security mechanisms.
24+
25+
The tool provides a clean, intuitive graphical interface built with Guna UI2 and MetroSuite, allowing users to easily select target processes, choose injection methods, and customize injection parameters.
26+
27+
## Features
28+
29+
- **Multiple Injection Techniques**: Supports Standard Injection, Manual Mapping, and Thread Hijacking
30+
- **Process Enumeration**: Lists all running processes with their PID and names
31+
- **Process Filtering**: Search for specific processes by name or PID
32+
- **Architecture Validation**: Automatically checks DLL and process architecture compatibility
33+
- **Customizable Injection Parameters**: Fine-tune injection with various API combinations
34+
- **Real-time Process Monitoring**: Continuously updates the process list
35+
- **Modern UI**: Clean, dark-themed interface with smooth animations
36+
37+
## Injection Methods
38+
39+
### Standard Injection
40+
41+
The traditional DLL injection method using Windows API functions. This technique allocates memory in the target process, writes the DLL path to that memory, and creates a remote thread to execute LoadLibrary.
42+
43+
#### Configuration Options:
44+
45+
- **Load Library Function**:
46+
- `LoadLibraryA`: ANSI version of LoadLibrary
47+
- `LoadLibraryW`: Unicode version of LoadLibrary
48+
49+
- **Thread Creation Method**:
50+
- `CreateRemoteThread`: Standard Windows API
51+
- `RtlCreateUserThread`: Native NT API
52+
- `NtCreateThreadEx`: Low-level NT API
53+
- `NtQueueApcThread`: Asynchronous procedure call injection
54+
- `NtQueueApcThreadEx`: Extended APC injection
55+
56+
- **Memory Writing Method**:
57+
- `WriteProcessMemory`: Standard Windows API
58+
- `NtWriteVirtualMemory`: Native NT API
59+
- `ZwWriteVirtualMemory`: Wrapper for NtWriteVirtualMemory
60+
- `NtCreateSection + NtMapViewOfSection`: Section object mapping
61+
- `CreateFileMapping + MapViewOfFile + NtMapViewOfSection`: File mapping approach
62+
63+
- **Memory Allocation Method**:
64+
- `VirtualAllocEx`: Standard memory allocation
65+
- `NtAllocateVirtualMemory`: Native NT API allocation
66+
- `NtCreateSection`: Section-based allocation
67+
- `CreateFileMapping`: File mapping allocation
68+
- `VirtualAlloc2`: Extended allocation API
69+
70+
- **Process Handle Management**:
71+
- `OpenProcess + CloseHandle`: Standard Windows API
72+
- `NtOpenProcess + NtClose`: Native NT API
73+
74+
### Manual Mapping
75+
76+
Also known as "Reflective DLL Injection," this advanced technique manually loads a DLL into a target process without using LoadLibrary. It parses the PE headers, resolves imports, handles relocations, and executes the DLL entry point directly.
77+
78+
#### Key Components:
79+
80+
- **ManualMapper.dll**: C++ library implementing the manual mapping algorithm
81+
- **PE Parsing**: Reads and interprets Portable Executable headers
82+
- **Import Resolution**: Resolves DLL dependencies using LoadLibrary and GetProcAddress
83+
- **Relocation Handling**: Adjusts addresses based on the actual load location
84+
- **TLS Callback Support**: Handles Thread Local Storage callbacks
85+
- **SEH Support**: Structured Exception Handling support for x64
86+
- **Shellcode Execution**: Uses custom shellcode to initialize the injected DLL
87+
88+
### Thread Hijacking
89+
90+
This technique hijacks an existing thread in the target process and redirects its execution to load the DLL. It suspends a thread, modifies its context to point to our shellcode, and resumes it.
91+
92+
#### Key Components:
93+
94+
- **ThreadHijacker.dll**: C++ library implementing the thread hijacking algorithm
95+
- **Thread Enumeration**: Finds threads in the target process
96+
- **Context Manipulation**: Modifies thread register state
97+
- **Shellcode Generation**: Creates assembly code to load the DLL
98+
- **Stealth Injection**: Less detectable than creating new threads
99+
100+
## Installation
101+
102+
1. Clone or download the repository
103+
2. Ensure you have the required dependencies installed:
104+
- .NET Framework 4.8.1
105+
- Visual Studio with C# and C++ support
106+
3. Restore NuGet packages:
107+
```
108+
nuget restore TrueInjector.sln
109+
```
110+
4. Build the solution:
111+
```
112+
msbuild TrueInjector.sln /p:Configuration=Release
113+
```
114+
115+
## Usage
116+
117+
1. Launch TrueInjector.exe
118+
2. Select a target process from the process list:
119+
- Use the search box to filter processes by name or PID
120+
- Click "Refresh processes" to update the list
121+
3. Load a DLL file:
122+
- Click "Load DLL file..." and select your DLL
123+
- Or enter the full path in the DLL file path textbox
124+
4. Choose an injection method:
125+
- **Standard Injection**: Traditional LoadLibrary injection
126+
- **Manual Mapping**: Advanced reflective injection
127+
- **Thread Hijacking**: Thread redirection technique
128+
5. Configure injection parameters (for Standard Injection):
129+
- Select appropriate APIs for your target process
130+
6. Click "Inject DLL file into selected process"
131+
7. Check for success or error messages
132+
133+
## Technical Details
134+
135+
### Architecture
136+
137+
TrueInjector consists of three main components:
138+
139+
1. **Main Application** (C#):
140+
- Graphical user interface
141+
- Process enumeration and selection
142+
- Injection parameter configuration
143+
- Integration with native DLLs
144+
145+
2. **ManualMapper.dll** (C++):
146+
- Implements manual mapping injection
147+
- PE parsing and manipulation
148+
- Memory management using NT APIs
149+
150+
3. **ThreadHijacker.dll** (C++):
151+
- Implements thread hijacking injection
152+
- Thread manipulation and context switching
153+
- Assembly shellcode generation
154+
155+
### Security Considerations
156+
157+
- TrueInjector is intended for legitimate purposes such as:
158+
- Software testing and debugging
159+
- Security research
160+
- Educational purposes
161+
- Reverse engineering
162+
- Use responsibly and only on software you own or have explicit permission to analyze
163+
- Some antivirus software may flag injection tools as suspicious - this is normal
164+
165+
### Dependencies
166+
167+
- **Guna.UI2**: Modern Windows Forms controls
168+
- **MetroSuite**: Custom form styling library
169+
- **PeNet**: PE file analysis library
170+
- **Costura.Fody**: Embedding assemblies into executables
171+
- **Native Windows APIs**: kernel32.dll, ntdll.dll
172+
173+
## Requirements
174+
175+
- **Operating System**: Windows 7 or higher (x64 recommended)
176+
- **Runtime**: .NET Framework 4.8.1
177+
- **Architecture**: x64 (compatible with both x86 and x64 target processes)
178+
- **Privileges**: Administrator rights recommended for injecting into system processes
179+
180+
## License
181+
182+
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
183+
184+
---
185+
186+
*Note: This tool is for educational and legitimate security research purposes only. The developers are not responsible for any misuse or damage caused by this tool.*

0 commit comments

Comments
 (0)