### Enumerate Processes with CreateToolhelp32Snapshot

Source: https://context7.com/gamehackingacademy/dll_injector/llms.txt

Enumerates running processes to find a target by executable name. Requires including `<windows.h>` and `<tlhelp32.h>`. Ensure to close the snapshot handle after use.

```cpp
#include <windows.h>
#include <tlhelp32.h>

// Take a snapshot of all processes
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

PROCESSENTRY32 pe32 = { 0 };
pe32.dwSize = sizeof(PROCESSENTRY32);

// Get the first process
Process32First(snapshot, &pe32);

do {
    // Check if this is the target process
    if (wcscmp(pe32.szExeFile, L"Quake3-UrT.exe") == 0) {
        // Found target process, pe32.th32ProcessID contains the PID
        printf("Found target process with PID: %d\n", pe32.th32ProcessID);
        break;
    }
} while (Process32Next(snapshot, &pe32));

CloseHandle(snapshot);
```

--------------------------------

### Write DLL Path to Target Process Memory with WriteProcessMemory

Source: https://context7.com/gamehackingacademy/dll_injector/llms.txt

Writes data, such as a DLL path, into memory previously allocated in a target process. Requires a handle to the target process and the address obtained from VirtualAllocEx. Check the return value for success.

```cpp
const char *dll_path = "C:\\path\\to\\your.dll";

// Write the DLL path into the allocated memory in the target process
BOOL success = WriteProcessMemory(
    process,                    // Target process handle
    lpBaseAddress,              // Destination address (from VirtualAllocEx)
    dll_path,                   // Source data (DLL path string)
    strlen(dll_path) + 1,       // Number of bytes to write
    NULL                        // Optional: bytes written output
);

if (!success) {
    printf("Write failed: %d\n", GetLastError());
}
```

--------------------------------

### Allocate Memory in Target Process with VirtualAllocEx

Source: https://context7.com/gamehackingacademy/dll_injector/llms.txt

Allocates memory within a target process's address space to store data, such as a DLL path. Requires an open handle to the target process. Returns NULL on failure.

```cpp
// Open handle to the target process with full access
HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, TRUE, pe32.th32ProcessID);

const char *dll_path = "C:\\path\\to\\your.dll";

// Allocate memory in the target process for the DLL path
void *lpBaseAddress = VirtualAllocEx(
    process,                    // Target process handle
    NULL,                       // Let system choose address
    strlen(dll_path) + 1,       // Size needed for path + null terminator
    MEM_COMMIT,                 // Commit the memory
    PAGE_READWRITE              // Read/write permissions
);

// lpBaseAddress now points to allocated memory in target process
// Returns NULL on failure
if (lpBaseAddress == NULL) {
    printf("Memory allocation failed: %d\n", GetLastError());
}
```

--------------------------------

### Create Remote Thread for DLL Injection

Source: https://context7.com/gamehackingacademy/dll_injector/llms.txt

Executes LoadLibraryA in a target process to load a DLL. Requires a valid process handle and the address of the DLL path in the target's memory.

```cpp
// Get the address of LoadLibraryA from kernel32.dll
HMODULE kernel32base = GetModuleHandle(L"kernel32.dll");
FARPROC loadLibraryAddr = GetProcAddress(kernel32base, "LoadLibraryA");

// Create a remote thread in the target process
// The thread will execute LoadLibraryA(lpBaseAddress)
HANDLE thread = CreateRemoteThread(
    process,                                    // Target process
    NULL,                                       // Default security
    0,                                          // Default stack size
    (LPTHREAD_START_ROUTINE)loadLibraryAddr,   // Start address (LoadLibraryA)
    lpBaseAddress,                              // Argument (DLL path in target memory)
    0,                                          // Run immediately
    NULL                                        // Optional: thread ID output
);

// Wait for injection to complete
DWORD exitCode = 0;
WaitForSingleObject(thread, INFINITE);
GetExitCodeThread(thread, &exitCode);

// exitCode contains the return value of LoadLibraryA (HMODULE of loaded DLL)
// exitCode == 0 means the DLL failed to load
printf("LoadLibraryA returned: 0x%X\n", exitCode);
```

--------------------------------

### LoadLibraryA Function Signature

Source: https://github.com/gamehackingacademy/dll_injector/blob/master/README.md

This is the Windows API function used to load a dynamic-link library (DLL) into the address space of the calling process. It takes the full path to the DLL as an argument.

```c
HMODULE LoadLibraryA(
    LPCSTR lpLibFileName
);
```

--------------------------------

### Cleanup Allocated Resources

Source: https://context7.com/gamehackingacademy/dll_injector/llms.txt

Releases memory allocated in the target process and closes handles to prevent leaks.

```cpp
// Free the memory allocated in the target process
VirtualFreeEx(
    process,            // Target process handle
    lpBaseAddress,      // Address to free
    0,                  // Size (0 when using MEM_RELEASE)
    MEM_RELEASE         // Release the entire region
);

// Close handles
CloseHandle(thread);    // Remote thread handle
CloseHandle(process);   // Process handle
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.