InjectAPC全部项目（Win32和Win64位）

// InjectAPC.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <Windows.h>
#include <iostream>
#include <vector>
#include <TlHelp32.h>

using namespace std;
BOOL GrantPrivileges(WCHAR* PrivilegeName);
BOOL GetProcessIDByProcessImageName(IN WCHAR* wzProcessImageName, OUT UINT32* TargetProcessID);
BOOL GetThreadIDByProcessID(UINT32 ProcessID, vector<UINT32>& ThreadIDVector); 
BOOL Inject(UINT32 ProcessID, UINT32 ThreadID);

WCHAR DllFullPath[MAX_PATH] = { 0 };
PVOID DllFullPathBufferData = NULL;

int main()
{
    if(GrantPrivileges(SE_DEBUG_NAME)==FALSE)
    {
        printf("GrantPrivilege Error\r\n");
    }
    UINT32 ProcessID = 0;
    GetCurrentDirectory(MAX_PATH, DllFullPath); 
    wcscat(DllFullPath, L"\\Dll.dll");
    //getchar();
    //printf("%S\r\n", DllFullPath);

#ifdef _WIN64
    GetProcessIDByProcessImageName(L"Taskmgr.exe", &ProcessID);
//    GetProcessIDByProcessImageName(L"explorer.exe", &ProcessID);
#else
    GetProcessIDByProcessImageName(L"Taskmgr.exe", &ProcessID);
#endif
    vector<UINT32> ThreadIDVector;
    //printf("%d\r\n", ProcessID);
    GetThreadIDByProcessID(ProcessID, ThreadIDVector);

    UINT32 ThreadID = 0;
    while (!ThreadIDVector.empty())
    {
        ThreadID = ThreadIDVector.back();
        Inject(ProcessID, ThreadID);
        ThreadIDVector.pop_back();
    }
    /*size_t ThreadCount = ThreadIDVector.size();
    for (INT_PTR i = ThreadCount - 1; i >= 0; i--)
    {
        UINT32 ThreadID = ThreadIDVector[i];
        Inject(ProcessID, ThreadID);
    }*/
    getchar();
    return 0;
}
//提高的是自己的权限，提成自己想要的。

BOOL GrantPrivileges(WCHAR* PrivilegeName)
{
    HANDLE TokenHandle = NULL;
    TOKEN_PRIVILEGES PrivilegesToken; 
    LUID v1;
    //打开权限令牌
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &TokenHandle))
    {
        return FALSE;
    }
    if (!LookupPrivilegeValue(NULL, PrivilegeName, &v1))
    {
        CloseHandle(TokenHandle);
        return FALSE;
    }
    PrivilegesToken.PrivilegeCount = 1;
    PrivilegesToken.Privileges[0].Luid = v1;
    PrivilegesToken.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    //调整权限                    //特权启用.    特权被用来访问一个对象或服务
    if (!AdjustTokenPrivileges(TokenHandle, FALSE, &PrivilegesToken, sizeof(PrivilegesToken), NULL, NULL))
    {
        CloseHandle(TokenHandle);
        TokenHandle = NULL;
        return false;
    }
    //启用特权
    CloseHandle(TokenHandle);

    return TRUE;  
}
//做好放的笔记里
BOOL GetProcessIDByProcessImageName(IN WCHAR * wzProcessImageName, OUT UINT32 * TargetProcessID)
{
    HANDLE ProcessSnapshotHandle = NULL;    //1.初始化

    ProcessSnapshotHandle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    //一个班的学生
    if (ProcessSnapshotHandle == INVALID_HANDLE_VALUE)
    {
        return FALSE;
    }

    PROCESSENTRY32 ProcessEntry32 = { 0 }; //用来存放快照进程信息的一个结构体
    ProcessEntry32.dwSize = sizeof(PROCESSENTRY32);//初始化PROCESSENTRY结构
    Process32First(ProcessSnapshotHandle, &ProcessEntry32);    //把第一个进程 放在结构体中

    do
    {
        if (lstrcmpi(ProcessEntry32.szExeFile, wzProcessImageName)==0) //不区分大小写
        {                    //进程的名称
            *TargetProcessID = ProcessEntry32.th32ProcessID;
            break;
        }
    } while (Process32Next(ProcessSnapshotHandle, &ProcessEntry32));
    //printf("%d\r\n", *TargetProcessID);
    CloseHandle(ProcessSnapshotHandle);
    ProcessSnapshotHandle = NULL;
    return TRUE;
    return 0;
}
//枚举对方的指定进程ID的所有线程，压入vector中，返回线程集合
BOOL GetThreadIDByProcessID(UINT32 ProcessID, vector<UINT32>& ThreadIDVector)
{
    HANDLE ThreadSnapshotHandle = NULL;
    THREADENTRY32 ThreadEntry32 = { 0 };
    ThreadEntry32.dwSize = sizeof(THREADENTRY32);
    ThreadSnapshotHandle = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
    if (ThreadSnapshotHandle == INVALID_HANDLE_VALUE)            //指定将要快照的进程ID。如果该参数为0表示快照当前进程。该参数只有在设置了TH32CS_SNAPHEAPLIST或者TH32CS_SNAPMODULE后才有效，
    {                                                            //在其他情况下该参数被忽略，所有的进程都会被快照。所以不用修改0为ProcessID。
        return FALSE;
    }
    BOOL bOk = Thread32First(ThreadSnapshotHandle, &ThreadEntry32);
    if (bOk)
    {
        do
        {
            if (ThreadEntry32.th32OwnerProcessID == ProcessID)
            {
                ThreadIDVector.emplace_back(ThreadEntry32.th32ThreadID); //怀疑可能push.back枚举可以
            }
        } while (Thread32Next(ThreadSnapshotHandle, &ThreadEntry32));
    }
    CloseHandle(ThreadSnapshotHandle);
    ThreadSnapshotHandle = NULL;
    return TRUE;
}

BOOL Inject(UINT32 ProcessID, UINT32 ThreadID)
{
    HANDLE ProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);
    HANDLE ThreadHandle = INVALID_HANDLE_VALUE;
    //220
    SIZE_T ReturnLength = 0;

    
    size_t DllFullPathLength = wcslen(DllFullPath) + 1;

    if (DllFullPathBufferData == NULL)
    {
        //在对方进程空间申请内存，存储Dll完整路径。
        DllFullPathBufferData = VirtualAllocEx(ProcessHandle, NULL, DllFullPathLength * 2, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
        if (DllFullPathBufferData == NULL)
        {
            CloseHandle(ProcessHandle);
            CloseHandle(ThreadHandle);
            return FALSE;
        }
    //将DllFullPath写进刚刚申请的内存中                                                        size是双字长度
        BOOL bOk = WriteProcessMemory(ProcessHandle, DllFullPathBufferData, DllFullPath, DllFullPathLength*2,
            &ReturnLength);

        if (bOk == FALSE)
        {
            VirtualFreeEx(ProcessHandle,DllFullPathBufferData,(DllFullPathLength * 2), MEM_RELEASE);
            CloseHandle(ProcessHandle);
            CloseHandle(ThreadHandle);
            return FALSE;
        }
    }

    UINT_PTR LoadLibraryAddress = (UINT_PTR)GetProcAddress(GetModuleHandle(L"Kernel32.dll"),"LoadLibraryW");
    //当前进程中获得导入模块Kernel32基地址
    //Kernel32模块中的导出表中获得函数LoadLibraryW

    /*
    为什么这里用导出表中的地址LoadLibraryW不用导入表中的函数地址？
    LoadLibraryW 当前进程导入表中的地址 比如 LoadLibraryW = 0x1234   0x1234 -->0x7564 相当于 0x1234[0x7564]


    1.防止中一种病毒叫Hook IAT(ImportAddressTable) Hook
    中这种病毒，修改了Kernel 地址 0x7564，这样寻不到址
    2.确保地址OK

    */
    if (LoadLibraryAddress == NULL)
    {
        VirtualFreeEx(ProcessHandle, DllFullPathBufferData, (DllFullPathLength * 2), MEM_RELEASE);
        CloseHandle(ProcessHandle);
        return FALSE;
    }
    _try
    {
        ThreadHandle = OpenThread(THREAD_ALL_ACCESS, FALSE, ThreadID);
        QueueUserAPC((PAPCFUNC)LoadLibraryAddress,ThreadHandle,(UINT_PTR)DllFullPathBufferData);
                                //LoadLibraryAddress(DllFullPathBufferData)
    }
    _except(EXCEPTION_CONTINUE_EXECUTION)
    {

    }
    CloseHandle(ProcessHandle);
    CloseHandle(ThreadHandle);
    return 0;
}