@cheatron/injector

A DLL injector CLI & library powered by Cheatron Core. Injects DLLs into Windows x64 processes using thread hijacking — no CreateRemoteThread, no shellcode.

⚠️ Windows x64 only. Requires Node.js ≥ 20.

Install

npm install @cheatron/injector

CLI Usage

# By process name
npx cheatron-inject -n notepad.exe C:\path\to\my.dll

# By window title (Attacks the window's main thread)
npx cheatron-inject -w "Untitled - Notepad" C:\path\to\my.dll

# By Process ID
npx cheatron-inject -p 10245 C:\path\to\my.dll

# By Thread ID (Direct hijack)
npx cheatron-inject -t 3350 C:\path\to\my.dll

# Keep the hijacked thread alive after injection
npx cheatron-inject -n notepad.exe C:\path\to\my.dll --keep-alive

Library Usage

import { inject } from '@cheatron/injector';

const result = await inject({
  processName: 'notepad.exe',
  dllPath: 'C:\\path\\to\\my.dll',
});

console.log(`DLL loaded at ${result.hModule} in PID ${result.pid}`);

inject(options)

| Option | Type | Description | | ------------- | ---------- | ---------------------------------------------- | | dllPath | string | Path to the DLL to inject (required) | | processName | string? | Target process name (e.g. "notepad.exe") | | windowTitle | string? | Target window title (partial match) | | keepAlive | boolean? | Keep the hijacked thread alive after injection |

Returns InjectionResult:

| Field | Type | Description | | --------- | --------------- | -------------------------------------- | | hModule | NativePointer | HMODULE base address of the loaded DLL | | pid | number | Target process ID | | name | string | Target process name | | tid | number | Hijacked thread ID |

findTarget(nameOrTitle)

Discovers a target process by process name or window title. Returns a Target instance.

import { findTarget } from '@cheatron/injector';

const target = findTarget('notepad.exe');
console.log(`Found: ${target.name} (PID: ${target.pid})`);

How It Works

1. Target Discovery — Finds the process by name or window title using Target.fromWindowName() / Target.fromName()
2. Thread Hijacking — Hijacks an existing thread via AdvancedNThread.inject() — redirects RIP to a sleep gadget without allocating remote memory or creating new threads
3. LoadLibrary — Calls kernel32!LoadLibraryA/W through the hijacked thread
4. Cleanup — Releases the thread (or keeps it alive with --keep-alive)

License

MIT