1 // APCInject.cpp : 定义控制台应用程序的入口点。
2 //
3
4 #include "stdafx.h"
5 #include "APCInject.h"
6
7 #include <windows.h>
8 #include <TlHelp32.h>
9
10 #include <iostream>
11 #include <string>
12
13
14
15 #define _WIN32_WINNT 0x0400
16
17 #define DEF_BUF_SIZE 1024
18
19
20 #ifdef _DEBUG
21 #define new DEBUG_NEW
22 #endif
23
24
25 // 唯一的应用程序对象
26
27 CWinApp theApp;
28
29 using namespace std;
30
31
32 typedef long(__fastcall *pfnRtlAdjustPrivilege64)(ULONG, ULONG, ULONG, PVOID);
33 pfnRtlAdjustPrivilege64 RtlAdjustPrivilege;
34 BOOL InjectModuleToProcessById(DWORD dwProcessId);
35 // 用于存储注入模块DLL的路径全名
36 char szDllPath[DEF_BUF_SIZE] = { 0 };
37 int main()
38 {
39 int nRetCode = 0;
40 // 取得当前工作目录路径
41 GetCurrentDirectoryA(DEF_BUF_SIZE, szDllPath);
42
43 // 生成注入模块DLL的路径全名
44 strcat(szDllPath, "\\MessageBox32.dll");
45
46 DWORD dwProcessId = 0;
47 // 接收用户输入的目标进程ID
48 while (cout << "请输入目标进程ID：" && cin >> dwProcessId && dwProcessId > 0)
49 {
50 BOOL bRet = InjectModuleToProcessById(dwProcessId);
51 cout << (bRet ? "注入成功！" : "注入失败！") << endl;
52 }
53
54 return nRetCode;
55 }
56
57
58
59 // 使用APC机制向指定ID的进程注入模块
60 BOOL InjectModuleToProcessById(DWORD dwProcessId)
61 {
62 DWORD dwRet = 0;
63 BOOL bStatus = FALSE;
64 LPVOID lpData = NULL;
65 UINT uLen = strlen(szDllPath) + 1;
66 LPTHREAD_START_ROUTINE FuncAddress = NULL;
67 DWORD dwRetVal = 0;
68 #ifdef _WIN64 // x64 OpenProcess提权操作
69 //RtlAdjustPrivilege = (pfnRtlAdjustPrivilege64)GetProcAddress((HMODULE)(FuncAddress(L"ntdll.dll")), "RtlAdjustPrivilege");
70
71 //if (RtlAdjustPrivilege == NULL)
72 //{
73 // return FALSE;
74 //}
75 ///*
76 //.常量 SE_BACKUP_PRIVILEGE, "17", 公开
77 //.常量 SE_RESTORE_PRIVILEGE, "18", 公开
78 //.常量 SE_SHUTDOWN_PRIVILEGE, "19", 公开
79 //.常量 SE_DEBUG_PRIVILEGE, "20", 公开
80 //*/
81 //RtlAdjustPrivilege(20, 1, 0, &dwRetVal); //19
82 #endif
83 // 打开目标进程
84 HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
85 if (hProcess)
86 {
87 // 分配空间
88 lpData = VirtualAllocEx(hProcess, NULL, uLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
89 if (lpData)
90 {
91 // 写入需要注入的模块路径全名
92 bStatus = WriteProcessMemory(hProcess, lpData, szDllPath, uLen, NULL);
93 }
94 CloseHandle(hProcess);
95 }
96
97 if (bStatus == FALSE)
98 return FALSE;
99
100 // 创建线程快照
101 THREADENTRY32 te32 = { sizeof(THREADENTRY32) };
102 HANDLE hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
103 if (hThreadSnap == INVALID_HANDLE_VALUE)
104 return FALSE;
105
106 bStatus = FALSE;
107 // 枚举所线程
108 if (Thread32First(hThreadSnap, &te32))
109 {
110 do {
111 // 判断是否目标进程中的线程
112 if (te32.th32OwnerProcessID == dwProcessId)
113 {
114 // 打开线程
115 HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID);
116 if (hThread)
117 {
118 // 向指定线程添加APC
119 DWORD dwRet = QueueUserAPC((PAPCFUNC)LoadLibraryA, hThread, (ULONG_PTR)lpData);
120 if (dwRet > 0)
121 bStatus = TRUE;
122 CloseHandle(hThread);
123 }
124 }
125
126 } while (Thread32Next(hThreadSnap, &te32));
127 }
128
129 CloseHandle(hThreadSnap);
130 return bStatus;
131 }
