title: dll injector 32 bits and x64 dll file don't work in notepad.exe x64
body: <p>I have a DLL injector compiled with Visual Basic 6 and I'm trying to inject my DLL (x64) on x64 notepad.exe, but nothing works.</p>
  <p>I had searched on web about this and saw this:</p>
  <blockquote>
  <p>[IMPORTANT: 32-BIT / 64-BIT]</p>
  <p>This is a portability table:</p>
  <ul>
  <li>32bit program inject 32bit dll in a 32bit target</li>
  <li>32bit program inject 64bit dll in a 64bit target</li>
  <li>64bit program inject 32bit dll in a 32bit target</li>
  <li>64bit program inject 64bit dll in a 64bit target</li>
  </ul>
  </blockquote>
  <p>If this is true, so my injector should is working.</p>
  <p>Can someone help me please?</p>
  <p>Code used:</p>
  <p><em><strong>Module1.bas</strong></em></p>
  <pre><code>Option Explicit
  
  Private Const INFINITE                  As Long = &amp;HFFFF
  
  Private Const TOKEN_ADJUST_PRIVILEGES   As Long = &amp;H20
  Private Const TOKEN_QUERY               As Long = &amp;H8
  Private Const SE_PRIVILEGE_ENABLED      As Long = &amp;H2
  Private Const ANYSIZE_ARRAY             As Long = 1
  
  Private Const SE_DEBUG_NAME             As String = &quot;SeDebugPrivilege&quot;
  
  Private Const PAGE_READWRITE            As Long = &amp;H4
  Private Const MEM_RELEASE               As Long = &amp;H8000
  Private Const MEM_COMMIT                As Long = &amp;H1000
  
  Private Const STANDARD_RIGHTS_REQUIRED  As Long = &amp;HF0000
  Private Const SYNCHRONIZE               As Long = &amp;H100000
  Private Const PROCESS_VM_OPERATION As Long = (&amp;H8)
  Private Const PROCESS_VM_WRITE As Long = (&amp;H20)
  
  Private Const TH32CS_SNAPPROCESS As Long = 2&amp;
  
  
  Private Const PROCESS_ALL_ACCESS        As Long = _
                                          (STANDARD_RIGHTS_REQUIRED Or SYNCHRONIZE Or PROCESS_VM_WRITE Or PROCESS_VM_OPERATION Or &amp;HFFF)
  
  Private Type PROCESSENTRY32
      dwSize As Long
      cntUsage As Long
      th32ProcessID As Long
      th32DefaultHeapID As Long
      th32ModuleID As Long
      cntThreads As Long
      th32ParentProcessID As Long
      pcPriClassBase As Long
      dwFlags As Long
      szexeFile As String * 260
  End Type
  
  Private Type Luid
      lowpart                     As Long
      highpart                    As Long
  End Type
  
  Private Type LUID_AND_ATTRIBUTES
      pLuid                       As Luid
      Attributes                  As Long
  End Type
  
  Private Type TOKEN_PRIVILEGES
      PrivilegeCount              As Long
      Privileges(ANYSIZE_ARRAY)   As LUID_AND_ATTRIBUTES
  End Type
  
  Private Declare Function OpenProcess Lib &quot;kernel32&quot; (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
  Private Declare Function GetProcAddress Lib &quot;kernel32&quot; (ByVal hModule As Long, ByVal lpProcName As String) As Long
  Private Declare Function GetModuleHandle Lib &quot;kernel32&quot; Alias &quot;GetModuleHandleA&quot; (ByVal lpModuleName As String) As Long
  Private Declare Function VirtualAllocEx Lib &quot;kernel32&quot; (ByVal hProcess As Long, ByVal lpAddress As Long, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As Long
  Private Declare Function WriteProcessMemory Lib &quot;kernel32&quot; (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
  Private Declare Function CloseHandle Lib &quot;kernel32&quot; (ByVal hObject As Long) As Long
  Private Declare Function CreateRemoteThread Lib &quot;kernel32&quot; (ByVal hProcess As Long, lpThreadAttributes As Long, ByVal dwStackSize As Long, lpStartAddress As Long, lpParameter As Any, ByVal dwCreationFlags As Long, lpThreadId As Long) As Long
  Private Declare Function VirtualFreeEx Lib &quot;kernel32.dll&quot; (ByVal hProcess As Long, ByRef lpAddress As Any, ByRef dwSize As Long, ByVal dwFreeType As Long) As Long
  Private Declare Function WaitForSingleObject Lib &quot;kernel32&quot; (ByVal hHandle As Long, ByVal dwMilliseconds As Long) As Long
  Private Declare Function OpenProcessToken Lib &quot;advapi32&quot; (ByVal ProcessHandle As Long, ByVal DesiredAccess As Long, TokenHandle As Long) As Long
  Private Declare Function LookupPrivilegeValue Lib &quot;advapi32&quot; Alias &quot;LookupPrivilegeValueA&quot; (ByVal lpSystemName As String, ByVal lpName As String, lpLuid As Luid) As Long
  Private Declare Function AdjustTokenPrivileges Lib &quot;advapi32&quot; (ByVal TokenHandle As Long, ByVal DisableAllPrivileges As Long, NewState As TOKEN_PRIVILEGES, ByVal BufferLength As Long, PreviousState As Any, ReturnLength As Long) As Long
  Private Declare Function GetCurrentProcess Lib &quot;kernel32&quot; () As Long
  Private Declare Function CreateToolhelp32Snapshot Lib &quot;kernel32.dll&quot; (ByVal lFlags As Long, lProcessID As Long) As Long
  Private Declare Function ProcessFirst Lib &quot;kernel32.dll&quot; Alias &quot;Process32First&quot; (ByVal hSnapshot As Long, uProcess As PROCESSENTRY32) As Long
  Private Declare Function ProcessNext Lib &quot;kernel32.dll&quot; Alias &quot;Process32Next&quot; (ByVal hSnapshot As Long, uProcess As PROCESSENTRY32) As Long
  
  
  Public Function InjectByPID(ByVal sDllPath As String, ByVal lProcessID As Long) As Boolean
      Dim lProc As Long
      Dim lLibAdd As Long
      Dim lMem As Long
      Dim lRet As Long
      Dim lThread As Long
  
      On Local Error GoTo InjectByPID_Error
  
      '//Adjust token privileges to open system processes
      Call AdjustPrivileges(GetCurrentProcess)
  
      '// Open the process with all access
      lProc = OpenProcess(PROCESS_ALL_ACCESS, False, lProcessID)
      If lProc = 0 Then GoTo InjectByPID_Error
  
      '// Get the address of LoadLibrary
      lLibAdd = GetProcAddress(GetModuleHandle(&quot;kernel32.dll&quot;), &quot;LoadLibraryA&quot;)
      If lLibAdd = 0 Then GoTo InjectByPID_Error
  
      '// Allocate memory to hold the path to the Dll File in the process's memory
      lMem = VirtualAllocEx(lProc, 0, Len(sDllPath), MEM_COMMIT, PAGE_READWRITE)
      If lMem = 0 Then GoTo InjectByPID_Error
  
      '// Write the path to the Dll File in the location just created
      Call WriteProcessMemory(lProc, ByVal lMem, ByVal sDllPath, Len(sDllPath), lRet)
      If lRet = 0 Then GoTo InjectByPID_Error
  
      '// Create a remote thread that starts begins at the LoadLibrary function and _
       is passed are memory pointer
      lThread = CreateRemoteThread(lProc, ByVal 0, 0, ByVal lLibAdd, ByVal lMem, 0, 0&amp;)
      If lThread = 0 Then GoTo InjectByPID_Error
  
      '// Wait for the thread to finish
      Call WaitForSingleObject(lThread, INFINITE)
  
      '// Free the memory created on the other process
      Call VirtualFreeEx(lProc, lMem, Len(sDllPath), MEM_RELEASE)
  
      '//Release the handle to the other process
      Call CloseHandle(lProc)
  
      InjectByPID = True
  
      On Error GoTo 0
      Exit Function
  
  InjectByPID_Error:
      '// Free the memory created on the other process
      Call VirtualFreeEx(lProc, lMem, Len(sDllPath), MEM_RELEASE)
      '//Release the handle to the other process
      Call CloseHandle(lProc)
  End Function
  
  Public Function AdjustPrivileges(ByVal lProcessID As Long) As Boolean
      Dim lToken              As Long
      Dim tTOKEN_PRIVILEGES   As TOKEN_PRIVILEGES
  
      On Local Error GoTo AdjustPrivileges_Error
  
      If Not OpenProcessToken(lProcessID, TOKEN_ADJUST_PRIVILEGES Or TOKEN_QUERY, lToken) = 0 Then
          With tTOKEN_PRIVILEGES
              If LookupPrivilegeValue(vbNullString, SE_DEBUG_NAME, .Privileges(0).pLuid) = 0 Then
                  Exit Function
              End If
              .PrivilegeCount = 1
              .Privileges(0).Attributes = SE_PRIVILEGE_ENABLED
          End With
          If Not AdjustTokenPrivileges(lToken, 0, tTOKEN_PRIVILEGES, Len(tTOKEN_PRIVILEGES), 0&amp;, 0&amp;) = 0 Then
              AdjustPrivileges = True
          End If
      End If
  
      On Error GoTo 0
      Exit Function
  
  AdjustPrivileges_Error:
  
  End Function
  
  'Get PID
  Public Function whereISmyFUFUprocess(ByVal ProcessName As String) As Long
      Dim procSnapshot As Long
      Dim uProcess As PROCESSENTRY32
      Dim success As Long
      Dim ProcessId As Long
      Dim ProcessId_found As Boolean
  
      ProcessId_found = False
       
      procSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0&amp;)
  
      If procSnapshot = -1 Then Exit Function
  
      uProcess.dwSize = Len(uProcess)
      success = ProcessFirst(procSnapshot, uProcess)
  
      If success = 1 Then
          Do
              If LCase(VBA.Left$(uProcess.szexeFile, InStr(1, uProcess.szexeFile, Chr(0)) - 1)) = LCase(ProcessName) Then
                  ProcessId = uProcess.th32ProcessID
                  Debug.Print &quot;First process found with PID: &quot; &amp; ProcessId
                      If ProcessId_found = True Then
                          Debug.Print &quot;Second process found with PID: &quot; &amp; ProcessId
                          whereISmyFUFUprocess = ProcessId
                          Exit Do
                      End If
                    ProcessId_found = True
              End If
          Loop While ProcessNext(procSnapshot, uProcess)
  
      End If
       
      If whereISmyFUFUprocess = 0 Then
          whereISmyFUFUprocess = ProcessId
      End If
       
      Call CloseHandle(procSnapshot)
       
  End Function
  </code></pre>
  <p><em><strong>Form 1</strong></em></p>
  <pre><code>Private Declare Sub Sleep Lib &quot;kernel32.dll&quot; (ByVal dwMilliseconds As Long)
  
  
  Private Sub Command1_Click()
  
  Dim PID As Long
  
  
  ' // Run Notepad
      Shell &quot;notepad.exe&quot;, vbNormalFocus
      
      Sleep 1000
      
     PID = whereISmyFUFUprocess(&quot;notepad.exe&quot;)
     
     Sleep 1000
     
     InjectByPID &quot;Project1.dll&quot;, PID
  
  End Sub
  </code></pre>