APC注入C++源码

百鬼夜行天

1. #include "stdafx.h"
   
2. 
   
3. #define _WIN32_WINNT 0x0400
   
4. 
   
5. #include <windows.h>
   
6. #include <TlHelp32.h>
   
7. #include <iostream>
   
8. #include <string>
   
9. using namespace std;
   
10. 
    
11. #define DEF_BUF_SIZE 1024
    
12. 
    
13. // 用于存储注入模块DLL的路径全名
    
14. char szDllPath[DEF_BUF_SIZE] = {0} ;
    
15. 
    
16. // 使用APC机制向指定ID的进程注入模块
    
17. BOOL InjectModuleToProcessById ( DWORD dwProcessId )
    
18. {
    
19. DWORDdwRet = 0 ;
    
20. BOOLbStatus = FALSE ;
    
21. LPVOIDlpData = NULL ;
    
22. UINTuLen = strlen(szDllPath) + 1;
    
23. // 打开目标进程
    
24. HANDLE hProcess = OpenProcess ( PROCESS_ALL_ACCESS, FALSE, dwProcessId ) ;
    
25. if ( hProcess )
    
26. {
    
27. // 分配空间
    
28. lpData = VirtualAllocEx ( hProcess, NULL, uLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE ) ;
    
29. if ( lpData )
    
30. {
    
31. // 写入需要注入的模块路径全名
    
32. bStatus = WriteProcessMemory ( hProcess, lpData, szDllPath, uLen, &dwRet ) ;
    
33. }
    
34. CloseHandle ( hProcess ) ;
    
35. }
    
36. 
    
37. if ( bStatus == FALSE )
    
38. return FALSE ;
    
39. 
    
40. // 创建线程快照
    
41. THREADENTRY32 te32 = { sizeof(THREADENTRY32) } ;
    
42. HANDLE hThreadSnap = CreateToolhelp32Snapshot ( TH32CS_SNAPTHREAD, 0 ) ;
    
43. if ( hThreadSnap == INVALID_HANDLE_VALUE )
    
44. return FALSE ;
    
45. 
    
46. bStatus = FALSE ;
    
47. 
    
48. // 枚举所有线程
    
49. if ( Thread32First ( hThreadSnap, &te32 ) )
    
50. {
    
51. 
    
52. do{
    
53. 
    
54. // 判断是否目标进程中的线程
    
55. if ( te32.th32OwnerProcessID == dwProcessId )
    
56. {
    
57. 
    
58. // 打开线程
    
59. HANDLE hThread = OpenThread ( THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID ) ;
    
60. 
    
61. if ( hThread )
    
62. {
    
63. 
    
64. // 向指定线程添加APC
    
65. DWORD dwRet = QueueUserAPC ( (PAPCFUNC)LoadLibraryA, hThread, (ULONG_PTR)lpData ) ;
    
66. 
    
67. if ( dwRet > 0 )
    
68. bStatus = TRUE ;
    
69. CloseHandle ( hThread ) ;
    
70. }
    
71. 
    
72. }
    
73. 
    
74. }while ( Thread32Next ( hThreadSnap, &te32 ) ) ;
    
75. 
    
76. }
    
77. 
    
78. CloseHandle ( hThreadSnap ) ;
    
79. return bStatus;
    
80. }
    
81. 
    
82. 
    
83. int _tmain(int argc, _TCHAR* argv[])
    
84. {
    
85. 
    
86. // 取得当前工作目录路径
    
87. GetCurrentDirectoryA ( DEF_BUF_SIZE, szDllPath ) ;
    
88. 
    
89. // 生成注入模块DLL的路径全名
    
90. strcat_s ( szDllPath, "\\fddll" ) ;
    
91. 
    
92. DWORD dwProcessId = 0 ;
    
93. 
    
94. // 接收用户输入的目标进程ID
    
95. while ( cout << "请输入目标进程ID：" && cin >> dwProcessId && dwProcessId > 0 )
    
96. {
    
97. BOOL bRet = InjectModuleToProcessById ( dwProcessId ) ;
    
98. cout << (bRet ? "注入成功！":"注入失败！") << endl ;
    
99. }
    
100. 
     
101. return 0;
     
102. 
     
103. }

复制代码