#define  NtCurrentThread()		           ((HANDLE) -2)
#define  NtCurrentProcess()		           ((HANDLE) -1)
 
typedef DWORD (WINAPI *Rm_MessageBoxA)(HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption, UINT uType);
#pragma warning( disable : 4996 )
 
typedef struct _Structure {
PVOID RmMessageBoxA;
char Message[MAX_PATH];
char Title[MAX_PATH];
} Structure;
 
Structure my_Structure,*pmy_Structure;
 
DWORD __stdcall ReThread(Structure *Parameter){
Rm_MessageBoxA myMessageBoxA = (Rm_MessageBoxA)Parameter->RmMessageBoxA;
myMessageBoxA(0, Parameter->Message, Parameter->Title,0);
return 0;
}
 
/* whole below function replacemenet with 1 line of code
RtlAdjustPrivilege(20, TRUE, AdjustCurrentProcess, &en);
*/
static BOOL SetPrivilege(char* SeNamePriv, BOOL EnableTF){
   HANDLE hToken;
   LUID SeValue;
   TOKEN_PRIVILEGES tp;
 
   if (!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&hToken))return FALSE;
 
   if (!LookupPrivilegeValue(NULL, SeNamePriv, &SeValue)){
      CloseHandle(hToken);
      return FALSE;
   }
 
   tp.PrivilegeCount = 1;
   tp.Privileges[0].Luid = SeValue;
   tp.Privileges[0].Attributes = EnableTF ? SE_PRIVILEGE_ENABLED : 0;
   AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
   CloseHandle(hToken);
   return TRUE;
}
 
static DWORD GetPIDbyName(LPTSTR p_Name){
	HANDLE m_Snap;
	PROCESSENTRY32 pe = { sizeof(pe) };
	m_Snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
	if (m_Snap == INVALID_HANDLE_VALUE) return 0; 
	if (!Process32First(m_Snap, &pe)) return 0;
 
	do{
		if( !lstrcmpi(pe.szExeFile, p_Name)){		
			return pe.th32ProcessID;
		}
	} while (Process32Next(m_Snap, &pe));
 
	CloseHandle(m_Snap);
	return 0;
}
 
bool Load(){
 
    void *pThread; SIZE_T dwThreadSize=4000;
    SetPrivilege("SeDebugPrivilege", TRUE);
	HANDLE RemoProc;
    DWORD dwPid = GetPIDbyName("notepad.exe");
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
    pThread = VirtualAllocEx(hProcess, 0, dwThreadSize, MEM_COMMIT | MEM_RESERVE,PAGE_EXECUTE_READWRITE);
	if(pThread == NULL){MessageBoxA(0,"pThread == NULL","error",0); return false;}
	if(WriteProcessMemory(hProcess, pThread, (void *)ReThread, dwThreadSize,0) == 0){
	MessageBoxA(0,"WriteProcessMemory failed!","error",0);
	return false;
	}
    RtlZeroMemory(&my_Structure,sizeof(Structure));
    HINSTANCE hUser;
    hUser = LoadLibraryExA("user32.dll", NULL, 0);
	if(hUser == NULL){
	MessageBoxA(0,"hUser == NULL","error",0);
	return false;
	}
    my_Structure.RmMessageBoxA = (void *) GetProcAddress(hUser, "MessageBoxA");
	if(my_Structure.RmMessageBoxA == NULL){
	MessageBoxA(0,"my_Structure.RmMessageBoxW == NULL","error",0);
	return false;
	}
    strcpy(my_Structure.Message, "message");
    strcpy(my_Structure.Title, "title");
    DWORD dwSize = sizeof(Structure);
    pmy_Structure =(Structure *)VirtualAllocEx (hProcess ,0,sizeof(Structure),MEM_COMMIT,PAGE_READWRITE);
	if(pmy_Structure == NULL){
	MessageBoxA(0,"pmy_Structure == NULL","error",0);
	return false;
	}
	if(WriteProcessMemory(hProcess ,pmy_Structure,&my_Structure,sizeof(my_Structure),0) == 0){
	MessageBoxA(0,"WriteProcessMemory failed!","error",0);
	return false;
	}
    RemoProc = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)pThread, (PVOID)pmy_Structure, 0, NULL);
	if(RemoProc == NULL){
	MessageBoxA(0,"CreateRemoteThread failed!","error",0);
	return false;
	}
	return true;    
}

private: void button1_Click( Object^ /*sender*/, System::EventArgs^ /*e*/ )
	{
		if(Load() == false){
		MessageBoxA(0,"Load function failed!","error",0);
		} else {
		MessageBoxA(0,"Load function succeed!","success",0);
		}
	}