dink.cpp

#include <windows.h>
#include "resource.h"
#include <commdlg.h>
#include <string>
#include <tchar.h>
#include <tlhelp32.h>
#include <vector>
#include <winternl.h>

#pragma comment(lib, "version.lib")
#pragma comment(linker, "\"/manifestdependency:type='win32' \
name='Microsoft.Windows.Common-Controls' \
version='6.0.0.0' \
processorArchitecture='*' \
publicKeyToken='6595b64144ccf1df' \
language='*'\"")

using pfnNtCreateThreadEx = NTSTATUS(NTAPI *)(
    PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess,
    LPVOID ObjectAttributes, HANDLE ProcessHandle,
    LPVOID StartAddress, LPVOID Parameter,
    BOOL CreateSuspended, ULONG_PTR StackZeroBits,
    SIZE_T SizeOfStackCommit, SIZE_T SizeOfStackReserve,
    LPVOID BytesBuffer);

using pfnRtlCreateUserThread = NTSTATUS(NTAPI *)(
    HANDLE ProcessHandle, PSECURITY_DESCRIPTOR SecurityDescriptor,
    BOOLEAN CreateSuspended, ULONG StackZeroBits,
    PULONG StackReserved, PULONG StackCommit,
    PVOID StartAddress, PVOID StartParameter,
    PHANDLE ThreadHandle, PVOID ClientID);

using pfnNtCreateSection = NTSTATUS(NTAPI *)(
    PHANDLE SectionHandle, ACCESS_MASK DesiredAccess,
    LPVOID ObjectAttributes, PLARGE_INTEGER MaximumSize,
    ULONG SectionPageProtection, ULONG AllocationAttributes,
    HANDLE FileHandle);

using pfnNtMapViewOfSection = NTSTATUS(NTAPI *)(
    HANDLE SectionHandle, HANDLE ProcessHandle,
    PVOID* BaseAddress, ULONG_PTR ZeroBits,
    SIZE_T CommitSize, PLARGE_INTEGER SectionOffset,
    PSIZE_T ViewSize, DWORD InheritDisposition,
    ULONG AllocationType, ULONG Win32Protect);

using pfnNtUnmapViewOfSection = NTSTATUS(NTAPI *)(
    HANDLE ProcessHandle, PVOID BaseAddress);

struct SelectedProcessInfo
{
    TCHAR szDisplayString[512];
    DWORD dwProcessID;
    bool bSelected;
};

std::wstring GetProcessFullPath(DWORD dwProcessId)
{
    std::wstring result = L"";
    HANDLE hProcess =
        OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, dwProcessId);
    if (hProcess)
    {
        wchar_t szPath[MAX_PATH];
        DWORD dwSize = MAX_PATH;
        if (QueryFullProcessImageNameW(hProcess, 0, szPath, &dwSize))
        {
            result = szPath;
        }
        CloseHandle(hProcess);
    }
    return result;
}

std::wstring GetProcessDescription(const wchar_t* szFilePath)
{
    DWORD dwHandle = 0;
    DWORD dwSize = GetFileVersionInfoSizeW(szFilePath, &dwHandle);
    if (dwSize == 0)
        return L"";

    std::vector<BYTE> buffer(dwSize);
    if (!GetFileVersionInfoW(szFilePath, dwHandle, dwSize, &buffer[0]))
        return L"";

    struct LANGANDCODEPAGE
    {
        WORD wLanguage;
        WORD wCodePage;
    } * lpTranslate;
    UINT cbTranslate = 0;

    if (VerQueryValueW(&buffer[0], L"\\VarFileInfo\\Translation",
                       (LPVOID*)&lpTranslate, &cbTranslate))
    {
        for (unsigned int i = 0; i < (cbTranslate / sizeof(struct LANGANDCODEPAGE));
             i++)
        {
            wchar_t subBlock[256];
            swprintf_s(subBlock, 256, L"\\StringFileInfo\\%04x%04x\\FileDescription",
                       lpTranslate[i].wLanguage, lpTranslate[i].wCodePage);

            wchar_t* lpDescription = nullptr;
            UINT cbBytes = 0;
            if (VerQueryValueW(&buffer[0], subBlock, (LPVOID*)&lpDescription,
                               &cbBytes) &&
                cbBytes > 0)
            {
                return lpDescription;
            }
        }
    }
    return L"";
}

static bool IsProcessWow64(HANDLE hProcess)
{
    BOOL bWow64 = FALSE;
    IsWow64Process(hProcess, &bWow64);
    return bWow64 == TRUE;
}

static DWORD FindFirstThreadOfProcess(DWORD dwOwnerPID)
{
    DWORD dwTID = 0;
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
    if (hSnap == INVALID_HANDLE_VALUE) return 0;
    THREADENTRY32 te = {};
    te.dwSize = sizeof(te);
    if (Thread32First(hSnap, &te))
    {
        do
        {
            if (te.th32OwnerProcessID == dwOwnerPID)
            {
                dwTID = te.th32ThreadID;
                break;
            }
        }
        while (Thread32Next(hSnap, &te));
    }
    CloseHandle(hSnap);
    return dwTID;
}

static std::vector<DWORD> GetAllThreadsOfProcess(DWORD dwOwnerPID)
{
    std::vector<DWORD> tids;
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
    if (hSnap == INVALID_HANDLE_VALUE) return tids;
    THREADENTRY32 te = {};
    te.dwSize = sizeof(te);
    if (Thread32First(hSnap, &te))
    {
        do
        {
            if (te.th32OwnerProcessID == dwOwnerPID)
                tids.push_back(te.th32ThreadID);
        }
        while (Thread32Next(hSnap, &te));
    }
    CloseHandle(hSnap);
    return tids;
}

static DWORD FindExportRVA(const BYTE* pFileBase, SIZE_T fileSize,
                           const char* pszName)
{
    if (!pFileBase || fileSize < sizeof(IMAGE_DOS_HEADER)) return 0;
    auto* pDOS = reinterpret_cast<const IMAGE_DOS_HEADER*>(pFileBase);
    if (pDOS->e_magic != IMAGE_DOS_SIGNATURE) return 0;
    auto* pNT = reinterpret_cast<const IMAGE_NT_HEADERS*>(
        pFileBase + pDOS->e_lfanew);
    if (pNT->Signature != IMAGE_NT_SIGNATURE) return 0;
    DWORD exportRVA = pNT->OptionalHeader
                         .DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]
        .VirtualAddress;
    if (!exportRVA) return 0;
    auto* pSec = IMAGE_FIRST_SECTION(pNT);
    WORD nSec = pNT->FileHeader.NumberOfSections;
    auto rvaToOffset = [&](DWORD rva) -> DWORD
    {
        for (WORD i = 0; i < nSec; i++)
        {
            DWORD start = pSec[i].VirtualAddress;
            DWORD end = start + pSec[i].SizeOfRawData;
            if (rva >= start && rva < end)
                return pSec[i].PointerToRawData + (rva - start);
        }
        return 0;
    };
    DWORD exportOff = rvaToOffset(exportRVA);
    if (!exportOff) return 0;
    auto* pExport = reinterpret_cast<const IMAGE_EXPORT_DIRECTORY*>(
        pFileBase + exportOff);
    auto* pNames = reinterpret_cast<const DWORD*>(
        pFileBase + rvaToOffset(pExport->AddressOfNames));
    auto* pOrdinals = reinterpret_cast<const WORD*>(
        pFileBase + rvaToOffset(pExport->AddressOfNameOrdinals));
    auto* pFunctions = reinterpret_cast<const DWORD*>(
        pFileBase + rvaToOffset(pExport->AddressOfFunctions));
    if (!pNames || !pOrdinals || !pFunctions) return 0;
    for (DWORD i = 0; i < pExport->NumberOfNames; i++)
    {
        DWORD nameOff = rvaToOffset(pNames[i]);
        if (!nameOff) continue;
        auto name = reinterpret_cast<const char*>(pFileBase + nameOff);
        if (strcmp(name, pszName) == 0)
            return pFunctions[pOrdinals[i]];
    }
    return 0;
}


static bool Inject_CreateRemoteThread(DWORD dwPID, const wchar_t* dllPath,
                                      std::wstring& outMsg)
{
    const SIZE_T pathBytes = (wcslen(dllPath) + 1) * sizeof(wchar_t);

    HANDLE hProc = OpenProcess(
        PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE |
        PROCESS_VM_READ | PROCESS_QUERY_INFORMATION,
        FALSE, dwPID);
    if (!hProc)
    {
        outMsg = L"OpenProcess failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }


    if (IsProcessWow64(hProc))
    {
        CloseHandle(hProc);
        outMsg = L"Target is a 32-bit process. This injector "
            L"cannot inject into 32-bit targets.";
        return false;
    }

    LPVOID pRemote = VirtualAllocEx(hProc, nullptr, pathBytes,
                                    MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (!pRemote)
    {
        CloseHandle(hProc);
        outMsg = L"VirtualAllocEx failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }

    if (!WriteProcessMemory(hProc, pRemote, dllPath, pathBytes, nullptr))
    {
        VirtualFreeEx(hProc, pRemote, 0, MEM_RELEASE);
        CloseHandle(hProc);
        outMsg = L"WriteProcessMemory failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }

    FARPROC pLoadLib = GetProcAddress(GetModuleHandleW(L"kernel32.dll"),
                                      "LoadLibraryW");
    HANDLE hThread = CreateRemoteThread(
        hProc, nullptr, 0,
        reinterpret_cast<LPTHREAD_START_ROUTINE>(pLoadLib),
        pRemote, 0, nullptr);
    if (!hThread)
    {
        VirtualFreeEx(hProc, pRemote, 0, MEM_RELEASE);
        CloseHandle(hProc);
        outMsg = L"CreateRemoteThread failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }

    WaitForSingleObject(hThread, 8000);
    DWORD dwExitCode = 0;
    GetExitCodeThread(hThread, &dwExitCode);
    CloseHandle(hThread);
    VirtualFreeEx(hProc, pRemote, 0, MEM_RELEASE);
    CloseHandle(hProc);

    if (dwExitCode == 0)
    {
        outMsg = L"Remote thread returned NULL — LoadLibraryW likely failed "
            L"(DLL not found or access denied in target).";
        return false;
    }
    outMsg = L"[CreateRemoteThread] Injection succeeded. "
        L"HMODULE in target: 0x" + std::to_wstring(dwExitCode);
    return true;
}


static bool Inject_NativeThread(DWORD dwPID, const wchar_t* dllPath,
                                std::wstring& outMsg)
{
    const SIZE_T pathBytes = (wcslen(dllPath) + 1) * sizeof(wchar_t);

    HANDLE hProc = OpenProcess(
        PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE |
        PROCESS_QUERY_INFORMATION,
        FALSE, dwPID);
    if (!hProc)
    {
        outMsg = L"OpenProcess failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    if (IsProcessWow64(hProc))
    {
        CloseHandle(hProc);
        outMsg = L"Target is a 32-bit (WOW64) process. Unsupported.";
        return false;
    }

    LPVOID pRemote = VirtualAllocEx(hProc, nullptr, pathBytes,
                                    MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (!pRemote || !WriteProcessMemory(hProc, pRemote, dllPath, pathBytes, nullptr))
    {
        if (pRemote) VirtualFreeEx(hProc, pRemote, 0, MEM_RELEASE);
        CloseHandle(hProc);
        outMsg = L"Memory allocation/write failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }

    FARPROC pLoadLib = GetProcAddress(GetModuleHandleW(L"kernel32.dll"),
                                      "LoadLibraryW");
    HANDLE hThread = nullptr;
    NTSTATUS status = 0;
    bool usedNtCreate = false;

    HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");


    auto pNtCreateThreadEx = reinterpret_cast<pfnNtCreateThreadEx>(
        GetProcAddress(hNtdll, "NtCreateThreadEx"));
    if (pNtCreateThreadEx)
    {
        status = pNtCreateThreadEx(
            &hThread, THREAD_ALL_ACCESS, nullptr, hProc,
            reinterpret_cast<PVOID>(pLoadLib), pRemote,
            FALSE, 0, 0, 0, nullptr);
        usedNtCreate = true;
    }


    if (!usedNtCreate || !NT_SUCCESS(status) || !hThread)
    {
        auto pRtlCreateUserThread = reinterpret_cast<pfnRtlCreateUserThread>(
            GetProcAddress(hNtdll, "RtlCreateUserThread"));
        if (!pRtlCreateUserThread)
        {
            VirtualFreeEx(hProc, pRemote, 0, MEM_RELEASE);
            CloseHandle(hProc);
            outMsg = L"Neither NtCreateThreadEx nor RtlCreateUserThread resolved.";
            return false;
        }
        status = pRtlCreateUserThread(
            hProc, nullptr, FALSE, 0, nullptr, nullptr,
            reinterpret_cast<PVOID>(pLoadLib), pRemote, &hThread, nullptr);
        usedNtCreate = false;
    }

    if (!NT_SUCCESS(status) || !hThread)
    {
        VirtualFreeEx(hProc, pRemote, 0, MEM_RELEASE);
        CloseHandle(hProc);
        outMsg = L"Thread creation failed. NTSTATUS: 0x" +
            std::to_wstring(static_cast<ULONG>(status));
        return false;
    }

    WaitForSingleObject(hThread, 8000);
    DWORD dwExitCode = 0;
    GetExitCodeThread(hThread, &dwExitCode);
    CloseHandle(hThread);
    VirtualFreeEx(hProc, pRemote, 0, MEM_RELEASE);
    CloseHandle(hProc);

    const wchar_t* apiName = usedNtCreate
                                 ? L"NtCreateThreadEx"
                                 : L"RtlCreateUserThread";
    if (dwExitCode == 0)
    {
        outMsg = std::wstring(L"[") + apiName + L"] Remote thread returned NULL "
            L"— LoadLibraryW likely failed.";
        return false;
    }
    outMsg = std::wstring(L"[") + apiName +
        L"] Injection succeeded. HMODULE: 0x" + std::to_wstring(dwExitCode);
    return true;
}


static bool Inject_ThreadHijack(DWORD dwPID, const wchar_t* dllPath,
                                std::wstring& outMsg)
{
    HANDLE hProc = OpenProcess(
        PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ |
        PROCESS_QUERY_INFORMATION,
        FALSE, dwPID);
    if (!hProc)
    {
        outMsg = L"OpenProcess failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    if (IsProcessWow64(hProc))
    {
        CloseHandle(hProc);
        outMsg = L"Target is a 32-bit (WOW64) process. Unsupported.";
        return false;
    }

    DWORD dwTID = FindFirstThreadOfProcess(dwPID);
    if (!dwTID)
    {
        CloseHandle(hProc);
        outMsg = L"No threads found in target process.";
        return false;
    }

    HANDLE hThread = OpenThread(
        THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT | THREAD_SET_CONTEXT,
        FALSE, dwTID);
    if (!hThread)
    {
        CloseHandle(hProc);
        outMsg = L"OpenThread failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }

    if (SuspendThread(hThread) == static_cast<DWORD>(-1))
    {
        CloseHandle(hThread);
        CloseHandle(hProc);
        outMsg = L"SuspendThread failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }

    CONTEXT ctx = {};
    ctx.ContextFlags = CONTEXT_FULL;
    if (!GetThreadContext(hThread, &ctx))
    {
        ResumeThread(hThread);
        CloseHandle(hThread);
        CloseHandle(hProc);
        outMsg = L"GetThreadContext failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }


    const SIZE_T pathBytes = (wcslen(dllPath) + 1) * sizeof(wchar_t);
    const SIZE_T totalSize = pathBytes + 128;
    LPVOID pBase = VirtualAllocEx(hProc, nullptr, totalSize,
                                  MEM_COMMIT | MEM_RESERVE,
                                  PAGE_EXECUTE_READWRITE);
    if (!pBase)
    {
        ResumeThread(hThread);
        CloseHandle(hThread);
        CloseHandle(hProc);
        outMsg = L"VirtualAllocEx failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }

    ULONG_PTR pRemotePath = reinterpret_cast<ULONG_PTR>(pBase);
    ULONG_PTR pRemoteShell = pRemotePath + pathBytes;
    ULONG_PTR pLoadLib = reinterpret_cast<ULONG_PTR>(
        GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "LoadLibraryW"));
    ULONG_PTR originalRIP = ctx.Rip;


    BYTE shell[64] = {};
    int off = 0;

    shell[off++] = 0x48;
    shell[off++] = 0x83;
    shell[off++] = 0xEC;
    shell[off++] = 0x28;

    shell[off++] = 0x48;
    shell[off++] = 0xB9;
    memcpy(&shell[off], &pRemotePath, 8);
    off += 8;

    shell[off++] = 0x48;
    shell[off++] = 0xB8;
    memcpy(&shell[off], &pLoadLib, 8);
    off += 8;

    shell[off++] = 0xFF;
    shell[off++] = 0xD0;

    shell[off++] = 0x48;
    shell[off++] = 0x83;
    shell[off++] = 0xC4;
    shell[off++] = 0x28;

    shell[off++] = 0x48;
    shell[off++] = 0xB8;
    memcpy(&shell[off], &originalRIP, 8);
    off += 8;

    shell[off++] = 0xFF;
    shell[off++] = 0xE0;


    WriteProcessMemory(hProc, reinterpret_cast<LPVOID>(pRemotePath),
                       dllPath, pathBytes, nullptr);
    WriteProcessMemory(hProc, reinterpret_cast<LPVOID>(pRemoteShell),
                       shell, sizeof(shell), nullptr);


    ctx.Rip = pRemoteShell;
    SetThreadContext(hThread, &ctx);
    ResumeThread(hThread);


    Sleep(2000);
    VirtualFreeEx(hProc, pBase, 0, MEM_RELEASE);
    CloseHandle(hThread);
    CloseHandle(hProc);

    outMsg = L"[Thread Context Hijacking] RIP redirected to shellcode in target "
        L"thread (TID " + std::to_wstring(dwTID) + L"). "
        L"DLL should load within ~2 seconds. "
        L"Note: target may crash if thread was inside a system call.";
    return true;
}


static bool Inject_APC(DWORD dwPID, const wchar_t* dllPath,
                       std::wstring& outMsg)
{
    const SIZE_T pathBytes = (wcslen(dllPath) + 1) * sizeof(wchar_t);

    HANDLE hProc = OpenProcess(
        PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_QUERY_INFORMATION,
        FALSE, dwPID);
    if (!hProc)
    {
        outMsg = L"OpenProcess failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    if (IsProcessWow64(hProc))
    {
        CloseHandle(hProc);
        outMsg = L"Target is a 32-bit (WOW64) process. Unsupported.";
        return false;
    }

    LPVOID pRemote = VirtualAllocEx(hProc, nullptr, pathBytes,
                                    MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (!pRemote || !WriteProcessMemory(hProc, pRemote, dllPath, pathBytes, nullptr))
    {
        if (pRemote) VirtualFreeEx(hProc, pRemote, 0, MEM_RELEASE);
        CloseHandle(hProc);
        outMsg = L"Memory allocation/write failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }

    FARPROC pLoadLib = GetProcAddress(GetModuleHandleW(L"kernel32.dll"),
                                      "LoadLibraryW");
    auto tids = GetAllThreadsOfProcess(dwPID);
    if (tids.empty())
    {
        VirtualFreeEx(hProc, pRemote, 0, MEM_RELEASE);
        CloseHandle(hProc);
        outMsg = L"No threads found in target process.";
        return false;
    }

    int queued = 0;
    for (DWORD tid : tids)
    {
        HANDLE hThread = OpenThread(THREAD_SET_CONTEXT, FALSE, tid);
        if (!hThread) continue;
        if (QueueUserAPC(reinterpret_cast<PAPCFUNC>(pLoadLib),
                         hThread,
                         reinterpret_cast<ULONG_PTR>(pRemote)))
            queued++;
        CloseHandle(hThread);
    }
    CloseHandle(hProc);


    if (queued == 0)
    {
        outMsg = L"QueueUserAPC failed on all " + std::to_wstring(tids.size()) +
            L" threads. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    outMsg = L"[APC Injection] APC queued on " + std::to_wstring(queued) +
        L" of " + std::to_wstring(tids.size()) + L" threads. "
        L"DLL will load when any thread next enters an alertable wait "
        L"(e.g. SleepEx, WaitForSingleObjectEx with bAlertable=TRUE).";
    return true;
}


static bool Inject_WindowHook(DWORD dwPID, const wchar_t* dllPath,
                              std::wstring& outMsg)
{
    HMODULE hMod = LoadLibraryExW(dllPath, nullptr, DONT_RESOLVE_DLL_REFERENCES);
    if (!hMod)
    {
        outMsg = L"LoadLibraryEx failed on target DLL. Error: " +
            std::to_wstring(GetLastError());
        return false;
    }

    auto pGetMsgProc = reinterpret_cast<HOOKPROC>(
        GetProcAddress(hMod, "GetMsgProc"));
    if (!pGetMsgProc)
    {
        FreeLibrary(hMod);
        outMsg = L"[Window Hook] The selected DLL does not export \"GetMsgProc\". "
            L"This method requires the target DLL to export a function named "
            L"GetMsgProc(int nCode, WPARAM wParam, LPARAM lParam).";
        return false;
    }


    struct FindCtx
    {
        DWORD pid;
        DWORD tid;
    };
    FindCtx ctx = {dwPID, 0};
    EnumWindows([](HWND hwnd, LPARAM lp) -> BOOL
    {
        auto* c = reinterpret_cast<FindCtx*>(lp);
        DWORD pid = 0;
        DWORD tid = GetWindowThreadProcessId(hwnd, &pid);
        if (pid == c->pid && IsWindowVisible(hwnd))
        {
            c->tid = tid;
            return FALSE;
        }
        return TRUE;
    }, reinterpret_cast<LPARAM>(&ctx));

    if (!ctx.tid)
    {
        FreeLibrary(hMod);
        outMsg = L"[Window Hook] No visible window found in target process. "
            L"This method requires the target to have a GUI message loop.";
        return false;
    }

    HHOOK hHook = SetWindowsHookExW(WH_GETMESSAGE, pGetMsgProc, hMod, ctx.tid);
    if (!hHook)
    {
        FreeLibrary(hMod);
        outMsg = L"SetWindowsHookEx failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }


    PostThreadMessageW(ctx.tid, WM_NULL, 0, 0);
    Sleep(1000);
    UnhookWindowsHookEx(hHook);
    FreeLibrary(hMod);

    outMsg = L"[Window Hook] Hook installed on thread " +
        std::to_wstring(ctx.tid) + L" and triggered via WM_NULL. "
        L"DLL should now be mapped into target. "
        L"NOTE: DLL must export GetMsgProc(int, WPARAM, LPARAM).";
    return true;
}


static bool Inject_ManualMap(DWORD dwPID, const wchar_t* dllPath,
                             std::wstring& outMsg)
{
    HANDLE hFile = CreateFileW(dllPath, GENERIC_READ, FILE_SHARE_READ,
                               nullptr, OPEN_EXISTING, 0, nullptr);
    if (hFile == INVALID_HANDLE_VALUE)
    {
        outMsg = L"Cannot open DLL file. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    DWORD fileSize = GetFileSize(hFile, nullptr);
    std::vector<BYTE> fileBuffer(fileSize);
    DWORD bytesRead = 0;
    ReadFile(hFile, fileBuffer.data(), fileSize, &bytesRead, nullptr);
    CloseHandle(hFile);
    if (bytesRead != fileSize)
    {
        outMsg = L"Failed to read DLL file completely.";
        return false;
    }


    auto* pDOS = reinterpret_cast<IMAGE_DOS_HEADER*>(fileBuffer.data());
    if (pDOS->e_magic != IMAGE_DOS_SIGNATURE)
    {
        outMsg = L"Not a valid PE file (bad DOS signature).";
        return false;
    }
    auto* pNT = reinterpret_cast<IMAGE_NT_HEADERS*>(
        fileBuffer.data() + pDOS->e_lfanew);
    if (pNT->Signature != IMAGE_NT_SIGNATURE)
    {
        outMsg = L"Not a valid PE file (bad NT signature).";
        return false;
    }
    if (pNT->FileHeader.Machine != IMAGE_FILE_MACHINE_AMD64)
    {
        outMsg = L"[Manual Map] DLL is not x64. This injector only supports x64 DLLs.";
        return false;
    }

    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID);
    if (!hProc)
    {
        outMsg = L"OpenProcess failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    if (IsProcessWow64(hProc))
    {
        CloseHandle(hProc);
        outMsg = L"Target is a 32-bit (WOW64) process. Unsupported.";
        return false;
    }


    SIZE_T imageSize = pNT->OptionalHeader.SizeOfImage;
    LPVOID pRemoteBase = VirtualAllocEx(
        hProc,
        reinterpret_cast<LPVOID>(pNT->OptionalHeader.ImageBase),
        imageSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if (!pRemoteBase)
        pRemoteBase = VirtualAllocEx(hProc, nullptr, imageSize,
                                     MEM_COMMIT | MEM_RESERVE,
                                     PAGE_EXECUTE_READWRITE);
    if (!pRemoteBase)
    {
        CloseHandle(hProc);
        outMsg = L"VirtualAllocEx (image) failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }


    WriteProcessMemory(hProc, pRemoteBase, fileBuffer.data(),
                       pNT->OptionalHeader.SizeOfHeaders, nullptr);


    auto* pSec = IMAGE_FIRST_SECTION(pNT);
    for (WORD i = 0; i < pNT->FileHeader.NumberOfSections; i++)
    {
        if (pSec[i].SizeOfRawData == 0) continue;
        auto dest = reinterpret_cast<LPVOID>(
            reinterpret_cast<ULONG_PTR>(pRemoteBase) + pSec[i].VirtualAddress);
        WriteProcessMemory(hProc, dest,
                           fileBuffer.data() + pSec[i].PointerToRawData,
                           pSec[i].SizeOfRawData, nullptr);
    }

    ULONG_PTR delta = reinterpret_cast<ULONG_PTR>(pRemoteBase) -
        pNT->OptionalHeader.ImageBase;


    if (delta != 0)
    {
        DWORD relocRVA = pNT->OptionalHeader
                            .DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]
            .VirtualAddress;
        DWORD relocSize = pNT->OptionalHeader
                             .DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]
            .Size;
        ULONG_PTR relocBase =
            reinterpret_cast<ULONG_PTR>(fileBuffer.data()) + relocRVA;
        ULONG_PTR relocEnd = relocBase + relocSize;
        while (relocBase < relocEnd)
        {
            auto* block = reinterpret_cast<IMAGE_BASE_RELOCATION*>(relocBase);
            if (!block->SizeOfBlock) break;
            DWORD count = (block->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) /
                sizeof(WORD);
            auto* entries = reinterpret_cast<WORD*>(block + 1);
            for (DWORD j = 0; j < count; j++)
            {
                if ((entries[j] >> 12) == IMAGE_REL_BASED_DIR64)
                {
                    ULONG_PTR patchVA =
                        reinterpret_cast<ULONG_PTR>(pRemoteBase) +
                        block->VirtualAddress + (entries[j] & 0x0FFF);
                    ULONG_PTR orig = 0;
                    ReadProcessMemory(hProc,
                                      reinterpret_cast<LPVOID>(patchVA),
                                      &orig, sizeof(orig), nullptr);
                    orig += delta;
                    WriteProcessMemory(hProc,
                                       reinterpret_cast<LPVOID>(patchVA),
                                       &orig, sizeof(orig), nullptr);
                }
            }
            relocBase += block->SizeOfBlock;
        }
    }


    DWORD importRVA = pNT->OptionalHeader
                         .DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]
        .VirtualAddress;
    if (importRVA)
    {
        auto* pImport = reinterpret_cast<IMAGE_IMPORT_DESCRIPTOR*>(
            fileBuffer.data() + importRVA);
        for (; pImport->Name; pImport++)
        {
            auto libName = reinterpret_cast<char*>(
                fileBuffer.data() + pImport->Name);

            HMODULE hImport = LoadLibraryA(libName);
            if (!hImport) continue;

            auto* pThunk = reinterpret_cast<IMAGE_THUNK_DATA*>(
                fileBuffer.data() + (pImport->OriginalFirstThunk
                                         ? pImport->OriginalFirstThunk
                                         : pImport->FirstThunk));
            ULONG_PTR iatVA =
                reinterpret_cast<ULONG_PTR>(pRemoteBase) + pImport->FirstThunk;

            while (pThunk->u1.AddressOfData)
            {
                FARPROC pFunc = nullptr;
                if (IMAGE_SNAP_BY_ORDINAL(pThunk->u1.Ordinal))
                {
                    pFunc = GetProcAddress(
                        hImport, MAKEINTRESOURCEA(
                            IMAGE_ORDINAL(pThunk->u1.Ordinal)));
                }
                else
                {
                    auto* pImportByName =
                        reinterpret_cast<IMAGE_IMPORT_BY_NAME*>(
                            fileBuffer.data() + pThunk->u1.AddressOfData);
                    pFunc = GetProcAddress(hImport, pImportByName->Name);
                }
                WriteProcessMemory(hProc, reinterpret_cast<LPVOID>(iatVA),
                                   &pFunc, sizeof(pFunc), nullptr);
                pThunk++;
                iatVA += sizeof(ULONG_PTR);
            }
        }
    }


    ULONG_PTR dllMainVA = reinterpret_cast<ULONG_PTR>(pRemoteBase) +
        pNT->OptionalHeader.AddressOfEntryPoint;
    ULONG_PTR hModuleVA = reinterpret_cast<ULONG_PTR>(pRemoteBase);
    constexpr ULONG_PTR reasonAttach = DLL_PROCESS_ATTACH;

    BYTE entryShell[64] = {};
    int off = 0;

    entryShell[off++] = 0x48;
    entryShell[off++] = 0x83;
    entryShell[off++] = 0xEC;
    entryShell[off++] = 0x28;

    entryShell[off++] = 0x48;
    entryShell[off++] = 0xB9;
    memcpy(&entryShell[off], &hModuleVA, 8);
    off += 8;

    entryShell[off++] = 0x48;
    entryShell[off++] = 0xBA;
    memcpy(&entryShell[off], &reasonAttach, 8);
    off += 8;

    entryShell[off++] = 0x4D;
    entryShell[off++] = 0x31;
    entryShell[off++] = 0xC0;

    entryShell[off++] = 0x48;
    entryShell[off++] = 0xB8;
    memcpy(&entryShell[off], &dllMainVA, 8);
    off += 8;

    entryShell[off++] = 0xFF;
    entryShell[off++] = 0xD0;

    entryShell[off++] = 0x48;
    entryShell[off++] = 0x83;
    entryShell[off++] = 0xC4;
    entryShell[off++] = 0x28;

    entryShell[off++] = 0xC3;

    LPVOID pShellRemote = VirtualAllocEx(hProc, nullptr, sizeof(entryShell),
                                         MEM_COMMIT | MEM_RESERVE,
                                         PAGE_EXECUTE_READWRITE);
    if (!pShellRemote)
    {
        VirtualFreeEx(hProc, pRemoteBase, 0, MEM_RELEASE);
        CloseHandle(hProc);
        outMsg = L"VirtualAllocEx (shellcode) failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    WriteProcessMemory(hProc, pShellRemote, entryShell, sizeof(entryShell), nullptr);

    HANDLE hThread = CreateRemoteThread(
        hProc, nullptr, 0,
        reinterpret_cast<LPTHREAD_START_ROUTINE>(pShellRemote),
        nullptr, 0, nullptr);
    if (!hThread)
    {
        VirtualFreeEx(hProc, pShellRemote, 0, MEM_RELEASE);
        VirtualFreeEx(hProc, pRemoteBase, 0, MEM_RELEASE);
        CloseHandle(hProc);
        outMsg = L"CreateRemoteThread (DllMain) failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    WaitForSingleObject(hThread, 8000);
    CloseHandle(hThread);
    VirtualFreeEx(hProc, pShellRemote, 0, MEM_RELEASE);

    CloseHandle(hProc);

    outMsg = L"[Manual Mapping] DLL mapped at remote base 0x" +
        std::to_wstring(reinterpret_cast<ULONG_PTR>(pRemoteBase)) +
        L". Module will NOT appear in target's loaded module list. "
        L"Note: TLS callbacks and C++ exception tables are not processed.";
    return true;
}


static bool Inject_Reflective(DWORD dwPID, const wchar_t* dllPath,
                              std::wstring& outMsg)
{
    HANDLE hFile = CreateFileW(dllPath, GENERIC_READ, FILE_SHARE_READ,
                               nullptr, OPEN_EXISTING, 0, nullptr);
    if (hFile == INVALID_HANDLE_VALUE)
    {
        outMsg = L"Cannot open DLL file. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    DWORD fileSize = GetFileSize(hFile, nullptr);
    std::vector<BYTE> fileBuffer(fileSize);
    DWORD bytesRead = 0;
    ReadFile(hFile, fileBuffer.data(), fileSize, &bytesRead, nullptr);
    CloseHandle(hFile);


    DWORD loaderRVA = FindExportRVA(fileBuffer.data(), fileSize,
                                    "ReflectiveLoader");
    if (!loaderRVA)
    {
        outMsg = L"[Reflective] Export \"ReflectiveLoader\" not found in DLL. "
            L"The DLL must be compiled with a reflective loader "
            L"(e.g. using Stephen Fewer's ReflectiveDLLInjection framework).";
        return false;
    }

    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID);
    if (!hProc)
    {
        outMsg = L"OpenProcess failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    if (IsProcessWow64(hProc))
    {
        CloseHandle(hProc);
        outMsg = L"Target is a 32-bit (WOW64) process. Unsupported.";
        return false;
    }


    LPVOID pRemoteBase = VirtualAllocEx(hProc, nullptr, fileSize,
                                        MEM_COMMIT | MEM_RESERVE,
                                        PAGE_EXECUTE_READWRITE);
    if (!pRemoteBase)
    {
        CloseHandle(hProc);
        outMsg = L"VirtualAllocEx failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    if (!WriteProcessMemory(hProc, pRemoteBase, fileBuffer.data(), fileSize, nullptr))
    {
        VirtualFreeEx(hProc, pRemoteBase, 0, MEM_RELEASE);
        CloseHandle(hProc);
        outMsg = L"WriteProcessMemory failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }


    ULONG_PTR pRemoteLoader =
        reinterpret_cast<ULONG_PTR>(pRemoteBase) + loaderRVA;

    HANDLE hThread = CreateRemoteThread(
        hProc, nullptr, 0,
        reinterpret_cast<LPTHREAD_START_ROUTINE>(pRemoteLoader),
        pRemoteBase, 0, nullptr);
    if (!hThread)
    {
        VirtualFreeEx(hProc, pRemoteBase, 0, MEM_RELEASE);
        CloseHandle(hProc);
        outMsg = L"CreateRemoteThread (ReflectiveLoader) failed. Error: " +
            std::to_wstring(GetLastError());
        return false;
    }
    WaitForSingleObject(hThread, 8000);
    CloseHandle(hThread);


    VirtualFreeEx(hProc, pRemoteBase, 0, MEM_RELEASE);
    CloseHandle(hProc);

    outMsg = L"[Reflective DLL] ReflectiveLoader executed in target. "
        L"The DLL has self-mapped and DllMain should have run.";
    return true;
}


static bool Inject_SectionMap(DWORD dwPID, const wchar_t* dllPath,
                              std::wstring& outMsg)
{
    const SIZE_T pathBytes = (wcslen(dllPath) + 1) * sizeof(wchar_t);

    HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
    auto pNtCreateSection = reinterpret_cast<pfnNtCreateSection>(
        GetProcAddress(hNtdll, "NtCreateSection"));
    auto pNtMapViewOfSection = reinterpret_cast<pfnNtMapViewOfSection>(
        GetProcAddress(hNtdll, "NtMapViewOfSection"));
    auto pNtUnmapViewOfSection = reinterpret_cast<pfnNtUnmapViewOfSection>(
        GetProcAddress(hNtdll, "NtUnmapViewOfSection"));

    if (!pNtCreateSection || !pNtMapViewOfSection || !pNtUnmapViewOfSection)
    {
        outMsg = L"Failed to resolve NT section APIs from ntdll.";
        return false;
    }

    HANDLE hProc = OpenProcess(
        PROCESS_VM_OPERATION | PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION,
        FALSE, dwPID);
    if (!hProc)
    {
        outMsg = L"OpenProcess failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    if (IsProcessWow64(hProc))
    {
        CloseHandle(hProc);
        outMsg = L"Target is a 32-bit (WOW64) process. Unsupported.";
        return false;
    }


    LARGE_INTEGER sectionSize = {};
    sectionSize.QuadPart = static_cast<LONGLONG>(pathBytes);

    HANDLE hSection = nullptr;
    NTSTATUS status = pNtCreateSection(
        &hSection, SECTION_ALL_ACCESS, nullptr, &sectionSize,
        PAGE_READWRITE, SEC_COMMIT, nullptr);
    if (!NT_SUCCESS(status))
    {
        CloseHandle(hProc);
        outMsg = L"NtCreateSection failed. NTSTATUS: 0x" +
            std::to_wstring(static_cast<ULONG>(status));
        return false;
    }


    PVOID pLocalView = nullptr;
    SIZE_T viewSize = 0;
    status = pNtMapViewOfSection(
        hSection, GetCurrentProcess(), &pLocalView, 0, 0, nullptr,
        &viewSize, 2, 0, PAGE_READWRITE);
    if (!NT_SUCCESS(status))
    {
        CloseHandle(hSection);
        CloseHandle(hProc);
        outMsg = L"NtMapViewOfSection (local) failed. NTSTATUS: 0x" +
            std::to_wstring(static_cast<ULONG>(status));
        return false;
    }
    memcpy(pLocalView, dllPath, pathBytes);
    pNtUnmapViewOfSection(GetCurrentProcess(), pLocalView);


    PVOID pRemoteView = nullptr;
    viewSize = 0;
    status = pNtMapViewOfSection(
        hSection, hProc, &pRemoteView, 0, 0, nullptr,
        &viewSize, 2, 0, PAGE_READWRITE);
    if (!NT_SUCCESS(status))
    {
        CloseHandle(hSection);
        CloseHandle(hProc);
        outMsg = L"NtMapViewOfSection (target) failed. NTSTATUS: 0x" +
            std::to_wstring(static_cast<ULONG>(status));
        return false;
    }


    FARPROC pLoadLib = GetProcAddress(GetModuleHandleW(L"kernel32.dll"),
                                      "LoadLibraryW");
    HANDLE hThread = CreateRemoteThread(
        hProc, nullptr, 0,
        reinterpret_cast<LPTHREAD_START_ROUTINE>(pLoadLib),
        pRemoteView, 0, nullptr);
    if (!hThread)
    {
        pNtUnmapViewOfSection(hProc, pRemoteView);
        CloseHandle(hSection);
        CloseHandle(hProc);
        outMsg = L"CreateRemoteThread failed. Error: " + std::to_wstring(GetLastError());
        return false;
    }
    WaitForSingleObject(hThread, 8000);
    DWORD dwExitCode = 0;
    GetExitCodeThread(hThread, &dwExitCode);
    CloseHandle(hThread);
    pNtUnmapViewOfSection(hProc, pRemoteView);
    CloseHandle(hSection);
    CloseHandle(hProc);

    if (dwExitCode == 0)
    {
        outMsg = L"[Section Mapping] Remote thread returned NULL — "
            L"LoadLibraryW likely failed (DLL not found or access denied).";
        return false;
    }
    outMsg = L"[Section Mapping] Injection succeeded via shared section. "
        L"HMODULE in target: 0x" + std::to_wstring(dwExitCode) +
        L". No VirtualAllocEx was called in target process space.";
    return true;
}

INT_PTR CALLBACK ProcessDialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam,
                                   LPARAM lParam)
{
    switch (uMsg)
    {
    case WM_INITDIALOG:
        {
            SetWindowLongPtr(hwndDlg, DWLP_USER, lParam);
            HWND hwndList = GetDlgItem(hwndDlg, LSTPROCESSES);

            HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
            if (hSnapshot != INVALID_HANDLE_VALUE)
            {
                PROCESSENTRY32 pe32;
                pe32.dwSize = sizeof(pe32);
                if (Process32First(hSnapshot, &pe32))
                {
                    do
                    {
                        if (pe32.th32ProcessID == 0)
                            continue;

                        std::wstring exeName = pe32.szExeFile;
                        std::wstring fullPath = GetProcessFullPath(pe32.th32ProcessID);
                        std::wstring friendlyName = GetProcessDescription(fullPath.c_str());
                        std::wstring pid = std::to_wstring(pe32.th32ProcessID);

                        std::wstring displayName;
                        if (!friendlyName.empty())
                        {
                            displayName = friendlyName + L" (" + exeName + L") | PID: " + pid;
                        }
                        else
                        {
                            std::wstring baseName = exeName;
                            size_t dotPos = baseName.find_last_of(L'.');
                            if (dotPos != std::wstring::npos)
                            {
                                baseName = baseName.substr(0, dotPos);
                            }
                            displayName = baseName + L" (" + exeName + L") | PID: " +
                                std::to_wstring(pe32.th32ProcessID);
                        }

                        int index = static_cast<int>(SendMessage(hwndList, LB_ADDSTRING, 0,
                                                                 (LPARAM)displayName.c_str()));
                        if (index != LB_ERR)
                        {
                            SendMessage(hwndList, LB_SETITEMDATA, index,
                                        pe32.th32ProcessID);
                        }
                    }
                    while (Process32Next(hSnapshot, &pe32));
                }
                CloseHandle(hSnapshot);
            }
            return TRUE;
        }

    case WM_COMMAND:
        switch (LOWORD(wParam))
        {
        case IDOK:
            {
                HWND hwndList = GetDlgItem(hwndDlg, LSTPROCESSES);
                int index = static_cast<int>(SendMessage(hwndList, LB_GETCURSEL, 0, 0));
                if (index != LB_ERR)
                {
                    auto pInfo =
                        (SelectedProcessInfo*)GetWindowLongPtr(hwndDlg, DWLP_USER);
                    if (pInfo)
                    {
                        SendMessage(hwndList, LB_GETTEXT, index,
                                    (LPARAM)pInfo->szDisplayString);


                        LRESULT itemData = SendMessage(hwndList, LB_GETITEMDATA, index, 0);
                        pInfo->dwProcessID = (itemData != LB_ERR) ? static_cast<DWORD>(itemData) : 0;
                        pInfo->bSelected = true;
                    }
                    EndDialog(hwndDlg, IDOK);
                }
                else
                {
                    MessageBox(hwndDlg, _T("Please select a process from the list."),
                               _T("Selection Required"), MB_OK | MB_ICONWARNING);
                }
                return TRUE;
            }

        case IDCANCEL:
            EndDialog(hwndDlg, IDCANCEL);
            return TRUE;

        case LSTPROCESSES:
            if (HIWORD(wParam) == LBN_DBLCLK)
            {
                SendMessage(hwndDlg, WM_COMMAND, MAKEWPARAM(IDOK, 0), 0);
                return TRUE;
            }
            break;
        }
        break;
    }
    return FALSE;
}

INT_PTR CALLBACK DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam,
                            LPARAM lParam);

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
                   LPSTR lpCmdLine, int nCmdShow)
{
    DialogBox(hInstance, MAKEINTRESOURCE(IDD_DIALOG1), NULL, DialogProc);

    return 0;
}

INT_PTR CALLBACK DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam,
                            LPARAM lParam)
{
    switch (uMsg)
    {
    case WM_INITDIALOG:
        {
            SetDlgItemText(hwndDlg, EDCPROCESS, _T(""));
            SetDlgItemText(hwndDlg, EDCFILE, _T(""));

            HWND hwndCombo = GetDlgItem(hwndDlg, CBCMETHOD);
            if (hwndCombo)
            {
                SendMessage(hwndCombo, CB_ADDSTRING, 0,
                            (LPARAM)_T("Create Remote Thread"));
                SendMessage(hwndCombo, CB_ADDSTRING, 0,
                            (LPARAM)_T("Native Thread Creation"));
                SendMessage(hwndCombo, CB_ADDSTRING, 0,
                            (LPARAM)_T("Thread Context Hijacking"));
                SendMessage(hwndCombo, CB_ADDSTRING, 0,
                            (LPARAM)_T("Asynchronous Procedure Calls"));
                SendMessage(hwndCombo, CB_ADDSTRING, 0,
                            (LPARAM)_T("Window Hook Injection"));
                SendMessage(hwndCombo, CB_ADDSTRING, 0, (LPARAM)_T("Manual Mapping"));
                SendMessage(hwndCombo, CB_ADDSTRING, 0,
                            (LPARAM)_T("Reflective DLL Injection"));
                SendMessage(hwndCombo, CB_ADDSTRING, 0, (LPARAM)_T("Section Mapping"));

                SendMessage(hwndCombo, CB_SETCURSEL, 0, 0);
            }
            return TRUE;
        }

    case WM_COMMAND:
        switch (LOWORD(wParam))
        {
        case BTNSELPROC:
            if (HIWORD(wParam) == BN_CLICKED)
            {
                SelectedProcessInfo info = {};
                info.bSelected = false;
                info.dwProcessID = 0;

                DialogBoxParam(GetModuleHandle(nullptr),
                               MAKEINTRESOURCE(IDD_PROCESS_DIALOG), hwndDlg,
                               ProcessDialogProc, (LPARAM)&info);

                if (info.bSelected)
                {
                    SetDlgItemText(hwndDlg, EDCPROCESS, info.szDisplayString);
                    SetWindowLongPtr(hwndDlg, DWLP_USER, info.dwProcessID);
                }
            }
            return TRUE;

        case BTNBROWSE:
            if (HIWORD(wParam) == BN_CLICKED)
            {
                OPENFILENAME ofn;
                TCHAR szFile[MAX_PATH] = {0};

                ZeroMemory(&ofn, sizeof(ofn));
                ofn.lStructSize = sizeof(ofn);
                ofn.hwndOwner = hwndDlg;
                ofn.lpstrFile = szFile;
                ofn.nMaxFile = sizeof(szFile) / sizeof(szFile[0]);
                ofn.lpstrFilter =
                    _T("Dynamic Link Libraries (*.dll)\0*.dll\0All Files (*.*)\0*.*\0");
                ofn.nFilterIndex = 1;
                ofn.lpstrFileTitle = nullptr;
                ofn.nMaxFileTitle = 0;
                ofn.lpstrInitialDir = nullptr;
                ofn.Flags = OFN_PATHMUSTEXIST | OFN_FILEMUSTEXIST;

                if (GetOpenFileName(&ofn) == TRUE)
                {
                    SetDlgItemText(hwndDlg, EDCFILE, ofn.lpstrFile);
                }
            }
            return TRUE;

        case BTNINJECT:
            if (HIWORD(wParam) == BN_CLICKED)
            {
                TCHAR processName[256];
                TCHAR dllPath[MAX_PATH];

                GetDlgItemText(hwndDlg, EDCPROCESS, processName, 256);
                GetDlgItemText(hwndDlg, EDCFILE, dllPath, MAX_PATH);

                DWORD dwTargetPID = static_cast<DWORD>(GetWindowLongPtr(hwndDlg, DWLP_USER));

                if (_tcslen(processName) == 0 || dwTargetPID == 0 ||
                    _tcslen(dllPath) == 0)
                {
                    MessageBox(hwndDlg, _T("Please select a process and a DLL."),
                               _T("Error"), MB_OK | MB_ICONERROR);
                }
                else
                {
                    HWND hwndCombo = GetDlgItem(hwndDlg, CBCMETHOD);
                    int method = static_cast<int>(SendMessage(hwndCombo, CB_GETCURSEL, 0, 0));

                    std::wstring statusMsg;
                    bool ok = false;

                    switch (method)
                    {
                    case 0: ok = Inject_CreateRemoteThread(dwTargetPID, dllPath, statusMsg);
                        break;
                    case 1: ok = Inject_NativeThread(dwTargetPID, dllPath, statusMsg);
                        break;
                    case 2: ok = Inject_ThreadHijack(dwTargetPID, dllPath, statusMsg);
                        break;
                    case 3: ok = Inject_APC(dwTargetPID, dllPath, statusMsg);
                        break;
                    case 4: ok = Inject_WindowHook(dwTargetPID, dllPath, statusMsg);
                        break;
                    case 5: ok = Inject_ManualMap(dwTargetPID, dllPath, statusMsg);
                        break;
                    case 6: ok = Inject_Reflective(dwTargetPID, dllPath, statusMsg);
                        break;
                    case 7: ok = Inject_SectionMap(dwTargetPID, dllPath, statusMsg);
                        break;
                    default:
                        statusMsg = L"Unknown injection method selected.";
                        break;
                    }

                    MessageBox(hwndDlg, statusMsg.c_str(),
                               ok ? _T("Injection Succeeded") : _T("Injection Failed"),
                               MB_OK | (ok ? MB_ICONINFORMATION : MB_ICONERROR));
                }
            }
            return TRUE;

        case IDCANCEL:
            EndDialog(hwndDlg, 0);
            return TRUE;
        }
        break;
    }
    return FALSE;
}