APCInject

 1 #include <iostream>
 2 #include <Windows.h>
 3 #include <TlHelp32.h>
 4 
 5 using namespace std;
 6 
 7 /*
 8     APC注入条件：
 9         目标线程处于可唤醒状态
10         如使用以下API时就处于可唤醒状态
11         SleepEx, SignalObjectAndWait, WaitForSingleObjectEx, WaitForMultipleObjectsEx,MsgWaitForMultipleObjectsEx
12     参数dwPid默认为0，表示自动创建目标进程并立刻生效注入，否则，注入现有目标，等待目标唤醒时执行APC回调
13 */
14 BOOL APCInject(char *dllUrl,DWORD dwPid=0,char *exeUrl=NULL);
15 
16 int main(void)
17 {
18     
19     cout << APCInject("c:\desktop\test.dll",3980) << endl;
20     return 0;
21 }
22 
23 BOOL APCInject(char *dllUrl,DWORD dwPid,char *exeUrl)
24 {
25     HANDLE hSnap=NULL,hPro=NULL,hThr=NULL;
26     BOOL bOk = FALSE;
27     LPVOID hVir = NULL;
28     THREADENTRY32 te = {0};
29 
30     if (!dwPid)
31     {
32         STARTUPINFO wi = {0};
33         PROCESS_INFORMATION pi = {0};
34 
35         wi.cb = sizeof(wi);
36         CreateProcessA("c:\desktop\123.exe",NULL,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&wi,&pi);
37         hPro = pi.hProcess;
38         hThr = pi.hThread;
39     } else {
40         te.dwSize = sizeof(te);
41         hPro = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPid);
42         if (!hPro)
43             return FALSE;
44         hSnap = CreateToolhelp32Snapshot(4,dwPid);
45         bOk = Thread32First(hSnap,&te);
46         while (bOk)
47         {
48             if (te.th32OwnerProcessID == dwPid)
49             {
50                 hThr = OpenThread(THREAD_ALL_ACCESS,FALSE,te.th32ThreadID);
51                 break;
52             }
53         
54             bOk = Thread32Next(hSnap,&te);
55         }
56         CloseHandle(hSnap);
57     }
58     
59     if (!hThr)
60         return FALSE;
61     hVir = VirtualAllocEx(hPro,NULL,strlen(dllUrl)+1,MEM_COMMIT,PAGE_READWRITE);
62     if (!hVir)
63         return FALSE;
64     if (!WriteProcessMemory(hPro,hVir,dllUrl,strlen(dllUrl)+1,NULL))
65         return FALSE;
66     CloseHandle(hPro);
67     if (QueueUserAPC((PAPCFUNC)GetProcAddress(GetModuleHandle("kernel32.dll"),"LoadLibraryA"),hThr,(DWORD)hVir))
68     {
69         if (!dwPid)
70         {
71             ResumeThread(hThr);
72             CloseHandle(hThr);
73         }
74         return TRUE;
75     }
76     CloseHandle(hThr);
77     return FALSE;
78 }