Injecting DLL by Smashing the REF and SetWindowsHookEx

dll.cpp

#include <Windows.h>
#include <string>

void job() {
	TCHAR szExeFileName[MAX_PATH];
	GetModuleFileName(NULL, szExeFileName, MAX_PATH);
	std::wstring exeName = szExeFileName;
	int pos = exeName.find_last_of(L"\\");
	exeName = exeName.substr(pos + 1, exeName.length());
	std::wstring message = L"Injected in " + exeName + L" (PID " + std::to_wstring(GetCurrentProcessId()) + L")";
	MessageBox(NULL, message.c_str(), L"Success", MB_OK);
}
int main() {
	job();
	return EXIT_SUCCESS;
}

// For standalone mode (EXE, GUI)
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {
	job();
	return EXIT_SUCCESS;
}

extern "C" __declspec(dllexport)
BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
					 )
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		CreateThread(NULL, NULL, reinterpret_cast<LPTHREAD_START_ROUTINE>(job), NULL, 0, 0);
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}

extern "C" __declspec(dllexport) int NextHook(int code, WPARAM wParam, LPARAM lParam) {
	return CallNextHookEx(NULL, code, wParam, lParam);
}

loader.cpp

#include <windows.h>
#include <stdio.h>

LRESULT CALLBACK hookCWPProc(int nCode, WPARAM wParam, LPARAM lParam)
{
	PCWPSTRUCT p = (PCWPSTRUCT)lParam;
	if (p->message == WM_SETREDRAW)
	{
		HWND hwnd = FindWindow(NULL, L"Untitled - Notepad");
		DWORD pid = NULL;
		DWORD tid = GetWindowThreadProcessId(hwnd, &pid);
		HMODULE dll = LoadLibraryEx(L"x64\\Release\\HockAndInject.dll", NULL, DONT_RESOLVE_DLL_REFERENCES);
		HOOKPROC addr = (HOOKPROC)GetProcAddress(dll, "NextHook");
		HHOOK handle = SetWindowsHookEx(WH_GETMESSAGE, addr, dll, tid);
		PostThreadMessage(tid, WM_NULL, NULL, NULL);
		Sleep(5000);
		UnhookWindowsHookEx(handle);
		UnhookWindowsHook(WH_CALLWNDPROC, hookCWPProc);
	}
	return 0;
}

void SetVisible(HWND hWnd)
{
	SetWindowsHookEx(WH_CALLWNDPROC, hookCWPProc, NULL, GetCurrentThreadId());
	SendMessage(hWnd, WM_SETREDRAW, 1, 0);
}

LRESULT CALLBACK wndproc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam)
{
	if (msg == WM_NCACTIVATE)
	{
		SetWindowLongPtr(hWnd, GWL_EXSTYLE, WS_EX_COMPOSITED);
	}
	if (msg == WM_STYLECHANGING)
	{
		SetVisible(hWnd);
	}

	return DefWindowProc(hWnd, msg, wParam, lParam);
}

int main()
{
	WNDCLASS wc = { 0 };
	wc.lpfnWndProc = DefWindowProc;
	wc.lpszClassName = L"test";
	RegisterClass(&wc);
	HWND hWnd = CreateWindow(wc.lpszClassName, NULL, 0, 0, 0, 0, NULL, NULL, NULL, NULL, NULL);
	ShowWindow(hWnd, SW_SHOWNA);
	SetWindowLongPtr(hWnd, GWL_EXSTYLE, WS_EX_COMPOSITED);
	SetWindowLongPtr(hWnd, GWLP_WNDPROC, (LONG_PTR)wndproc);
	FLASHWINFO fwi = { 0 };
	fwi.cbSize = sizeof(fwi);
	fwi.hwnd = hWnd;
	fwi.dwFlags = FLASHW_TIMER | FLASHW_CAPTION;
	FlashWindowEx(&fwi);
	return 1;
}