WriteProcessMemory(hProc, RemoteInjectCode, GetInjectionPtr(), ...)
. The location is "RemoteInjectCode", so find that location within the target process and open the disassembler and add a break point. That code will be executed by a later call to NtCreateThreadEx.
[UnmanagedFunctionPointer(CallingConvention.ThisCall, SetLastError = true, CharSet = CharSet.Unicode)]
[return: MarshalAs(UnmanagedType.Bool)]
delegate bool SmflAudio2_SoundBuffer_loadFromFile(IntPtr self, IntPtr filename);
on the c++ side the code looks like;
sf::SoundBuffer buffer;
buffer.loadFromFile("sound.wav");
// start and inject into a new process
EasyHook.RemoteHooking.CreateAndInject(
targetExe, // executable to run
targetArg, // command line arguments for target
0, // additional process creation flags to pass to CreateProcess
EasyHook.InjectionOptions.DoNotRequireStrongName, // allow injectionLibrary to be unsigned
injectionRegLibrary, // 32-bit library to inject (if target is 32-bit)
injectionRegLibrary, // 64-bit library to inject (if target is 64-bit)
out targetPID, // retrieve the newly created process ID
regChannelName // the parameters to pass into injected library
// ...
);