#include <windows.h>
#include <process.h>
#include <winerror.h>
#include <stdio.h>

typedef int (FAR WINAPI *FARPROC2)( void*, char*, char*, int );

void empty()
{
	MessageBox( 0, 0, 0, MB_OK );
}

int WINAPI test( void* ptr )
{		
	((FARPROC2)ptr)( 0, 0, 0, MB_OK );		
	return 0;
}

int main( int argc, char** argv )
{	
	char pidStr[1024];
	printf( "Enter remote pid: " );
	gets( pidStr );
	DWORD rPid = atol( pidStr );

	HANDLE rProc = OpenProcess( PROCESS_ALL_ACCESS, TRUE, rPid );
	if( !rProc )
	{
		printf( "Error OpenProcess: %ld\n", GetLastError() );	
		return -1;
	}

	LPVOID rPtr = VirtualAllocEx( rProc, NULL, 1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
	if( !rPtr )
	{
		printf( "Error VirtualAllocEx: %ld\n", GetLastError() );
		return -1;
	}

	printf( "Remote ptr: 0x%.X\n", rPtr );

	if( !WriteProcessMemory( rProc, rPtr, test, 100, NULL ) )
	{
		printf( "Error WriteProcessMemory: %ld\n", GetLastError() );
		return -1;
	}

	unsigned char *bfr = (unsigned char*)test;
	for( int i = 0; i < 100; i++ )
	{
		printf( "%.2X ", bfr[i] );
		if( (i % 8) == 0 )
			printf( "\n" );
	}
	printf( "\n" );

	HMODULE userDll = GetModuleHandle( "user32.dll" );
	if( !userDll )
	{
		printf( "Error GetModuleHandle: %ld\n", GetLastError() );
		return -1;
	}

	FARPROC mbPtr = GetProcAddress( userDll, "MessageBoxA" );
	if( !mbPtr )
	{
		printf( "Error GetProcAddress: %ld\n", GetLastError() );
		return -1;
	}		
	
	DWORD rThreadId;
	HANDLE rThread = CreateRemoteThread( rProc, NULL, 0, (LPTHREAD_START_ROUTINE)rPtr, mbPtr, 0, &rThreadId );
	if( !rThread )
	{
		printf( "Error CreateRemoteThread: %ld\n", GetLastError() );
		return -1;
	}

	printf( "Remote Thread ID: %ld\n", rThreadId );

	int a = 6;
	a++;
	if( a == 6 )
		empty();
	return 0;
}