#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <winnt.h>
#include <tlhelp32.h>
#define DIE_IFNOT(cond, msg) if(!(cond)) fprintf(stderr, "%s\n", msg), exit(1);

void DisplayImportTableEx(HANDLE hProcess, HMODULE hModImage);
HMODULE RemoteGetModuleHandle(DWORD dwProcessId, LPCSTR lpModuleName);
FARPROC RemoteGetProcAddress(HMODULE hModule, HMODULE hModuleRemote, LPCSTR lpProcName);
extern "C" __declspec(dllexport) int PrintInput();

static DWORD dwCRT; // address of CreateRemoteThread

BOOL WINAPI DllMain(HINSTANCE hInstdll,DWORD fwdReason, LPVOID lpvReserved)
{
 switch (fwdReason)
 {
 case DLL_PROCESS_ATTACH:
  PrintInput();
  break;
 }
 return TRUE;
}

extern "C" __declspec(dllexport) int PrintInput()
{
 DWORD dwProcessId;
 printf("Process ID (Current = %d): ", GetCurrentProcessId());
 if (scanf("%u", &dwProcessId) < 1) return 1;

 HMODULE hModRemote;
 printf("EXE/DLL Base Address: 0x");
 if (scanf("%p", &hModRemote) < 1) return 1;

 CreateRemoteThread(0, 0, 0, 0, 0, 0, 0); // Test

 dwCRT = (DWORD)RemoteGetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), RemoteGetModuleHandle(dwProcessId, "kernel32.dll"), "CreateRemoteThread");

 HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
 DisplayImportTableEx(hProcess, hModRemote);
 CloseHandle(hProcess);
}

void DisplayImportTableEx(HANDLE hProcess, HMODULE hModImage)
{
 DWORD cbRead;
 IMAGE_DOS_HEADER idh;
 DIE_IFNOT(ReadProcessMemory(hProcess, hModImage, &idh, sizeof idh, &cbRead), "[!] Failed to read process memory!");
 DIE_IFNOT(idh.e_magic == IMAGE_DOS_SIGNATURE, "[!] Invalid DOS Signature!");

 IMAGE_NT_HEADERS inh;
 DIE_IFNOT(ReadProcessMemory(hProcess, (PCHAR)hModImage + idh.e_lfanew, &inh, sizeof inh, &cbRead), "[!] Failed to read process memory!");
 DIE_IFNOT(inh.Signature == IMAGE_NT_SIGNATURE, "[!] Invalid PE Signature!");

 IMAGE_DATA_DIRECTORY dirImport = inh.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
 DIE_IFNOT(dirImport.VirtualAddress && dirImport.Size, "[!] No Import Table Found!");

 PIMAGE_IMPORT_DESCRIPTOR lpImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)((PCHAR)hModImage + dirImport.VirtualAddress);
 IMAGE_IMPORT_DESCRIPTOR impDesc;
 DIE_IFNOT(ReadProcessMemory(hProcess, lpImportDesc, &impDesc, sizeof impDesc, &cbRead), "[!] Failed to read process memory!");
 while (impDesc.Characteristics) {
  CHAR szImportDllName[MAX_PATH];
  DIE_IFNOT(ReadProcessMemory(hProcess, (PCHAR)hModImage + impDesc.Name, szImportDllName, sizeof szImportDllName, &cbRead), "[!] Failed to read process memory!");
  printf("[+] %s\n", szImportDllName);

  PIMAGE_THUNK_DATA lpImportThunk = (PIMAGE_THUNK_DATA)((PCHAR)hModImage + lpImportDesc->FirstThunk);
  IMAGE_THUNK_DATA impThunk;
  DIE_IFNOT(ReadProcessMemory(hProcess, lpImportThunk, &impThunk, sizeof impThunk, &cbRead), "[!] Failed to read process memory!");
  while (impThunk.u1.Function) {
   printf("\t[+] Function: 0xlX", impThunk.u1.Function);

   if ((DWORD)impThunk.u1.Function == dwCRT) {
    printf(" (Gotcha! This is CreateRemoteThread)");
   }

   putchar('\n');
   DIE_IFNOT(ReadProcessMemory(hProcess, ++lpImportThunk, &impThunk, sizeof impThunk, &cbRead), "[!] Failed to read process memory!");
  }

  DIE_IFNOT(ReadProcessMemory(hProcess, ++lpImportDesc, &impDesc, sizeof impDesc, &cbRead), "[!] Failed to read process memory!");
 }
}

HMODULE RemoteGetModuleHandle(DWORD dwProcessId, LPCSTR lpModuleName) {
 HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
 if (hSnapshot != INVALID_HANDLE_VALUE) {
  MODULEENTRY32 me = { sizeof(MODULEENTRY32) };
  BOOL bRet = Module32First(hSnapshot, &me);
  while (bRet) {
   if (!strcmpi((const char *)me.szModule, lpModuleName))
    return me.hModule;
   bRet = Module32Next(hSnapshot, &me);
  }
  CloseHandle(hSnapshot);
 }
 return NULL;
}

FARPROC RemoteGetProcAddress(HMODULE hModule, HMODULE hModuleRemote, LPCSTR lpProcName) {
 FARPROC fp = GetProcAddress(hModule, lpProcName);
 if (!fp) return NULL;

 return (FARPROC)((PCHAR)fp - (PCHAR)hModule + (PCHAR)hModuleRemote);
}


--------------

DLL 이렇게 만들었는데 메인에선 인젝션 성공했다고 나오는데.. 성공 되면 ID하고 주소 입력받는게 떠야하는데 그게 안떠요