C++ APC注入源码

lizhen

1. 
   
2. #include "stdafx.h"
   
3. 
   
4. #define _WIN32_WINNT 0x0400
   
5. 
   
6. #include <windows.h>
   
7. 
   
8. #include <TlHelp32.h>
   
9. 
   
10. #include <iostream>
    
11. 
    
12. #include <string>
    
13. 
    
14. using namespace std;
    
15. 
    
16. 
    
17. #define DEF_BUF_SIZE 1024
    
18. 
    
19. 
    
20. // 用于存储注入模块DLL的路径全名
    
21. 
    
22. char szDllPath[DEF_BUF_SIZE] = {0} ;
    
23. 
    
24. 
    
25. // 使用APC机制向指定ID的进程注入模块
    
26. 
    
27. BOOL InjectModuleToProcessById ( DWORD dwProcessId )
    
28. 
    
29. {
    
30. 
    
31. DWORDdwRet = 0 ;
    
32. 
    
33. BOOLbStatus = FALSE ;
    
34. 
    
35. LPVOIDlpData = NULL ;
    
36. 
    
37. UINTuLen = strlen(szDllPath) + 1;
    
38. 
    
39. // 打开目标进程
    
40. 
    
41. HANDLE hProcess = OpenProcess ( PROCESS_ALL_ACCESS, FALSE, dwProcessId ) ;
    
42. 
    
43. if ( hProcess )
    
44. 
    
45. {
    
46. 
    
47. // 分配空间
    
48. 
    
49. lpData = VirtualAllocEx ( hProcess, NULL, uLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE ) ;
    
50. 
    
51. if ( lpData )
    
52. 
    
53. {
    
54. 
    
55. // 写入需要注入的模块路径全名
    
56. 
    
57. bStatus = WriteProcessMemory ( hProcess, lpData, szDllPath, uLen, &dwRet ) ;
    
58. 
    
59. }
    
60. 
    
61. CloseHandle ( hProcess ) ;
    
62. 
    
63. }
    
64. 
    
65. 
    
66. if ( bStatus == FALSE )
    
67. 
    
68. return FALSE ;
    
69. 
    
70. 
    
71. // 创建线程快照
    
72. 
    
73. THREADENTRY32 te32 = { sizeof(THREADENTRY32) } ;
    
74. 
    
75. HANDLE hThreadSnap = CreateToolhelp32Snapshot ( TH32CS_SNAPTHREAD, 0 ) ;
    
76. 
    
77. if ( hThreadSnap == INVALID_HANDLE_VALUE )
    
78. 
    
79. return FALSE ;
    
80. 
    
81. 
    
82. bStatus = FALSE ;
    
83. 
    
84. // 枚举所有线程
    
85. 
    
86. if ( Thread32First ( hThreadSnap, &te32 ) )
    
87. 
    
88. {
    
89. 
    
90. do{
    
91. 
    
92. // 判断是否目标进程中的线程
    
93. 
    
94. if ( te32.th32OwnerProcessID == dwProcessId )
    
95. 
    
96. {
    
97. 
    
98. // 打开线程
    
99. 
    
100. HANDLE hThread = OpenThread ( THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID ) ;
     
101. 
     
102. if ( hThread )
     
103. 
     
104. {
     
105. 
     
106. // 向指定线程添加APC
     
107. 
     
108. DWORD dwRet = QueueUserAPC ( (PAPCFUNC)LoadLibraryA, hThread, (ULONG_PTR)lpData ) ;
     
109. 
     
110. if ( dwRet > 0 )
     
111. 
     
112. bStatus = TRUE ;
     
113. 
     
114. CloseHandle ( hThread ) ;
     
115. 
     
116. }
     
117. 
     
118. }
     
119. 
     
120. 
     
121. }while ( Thread32Next ( hThreadSnap, &te32 ) ) ;
     
122. 
     
123. }
     
124. 
     
125. 
     
126. CloseHandle ( hThreadSnap ) ;
     
127. 
     
128. return bStatus;
     
129. 
     
130. }
     
131. 
     
132. 
     
133. int _tmain(int argc, _TCHAR* argv[])
     
134. 
     
135. {
     
136. 
     
137. // 取得当前工作目录路径
     
138. 
     
139. GetCurrentDirectoryA ( DEF_BUF_SIZE, szDllPath ) ;
     
140. 
     
141. 
     
142. // 生成注入模块DLL的路径全名
     
143. 
     
144. strcat_s ( szDllPath, "\\fddll" ) ;
     
145. 
     
146. 
     
147. DWORD dwProcessId = 0 ;
     
148. 
     
149. // 接收用户输入的目标进程ID
     
150. 
     
151. while ( cout << "请输入目标进程ID：" && cin >> dwProcessId && dwProcessId > 0 )
     
152. 
     
153. {
     
154. 
     
155. BOOL bRet = InjectModuleToProcessById ( dwProcessId ) ;
     
156. 
     
157. cout << (bRet ? "注入成功！":"注入失败！") << endl ;
     
158. 
     
159. }
     
160. 
     
161. return 0;
     
162. 
     
163. }
     

复制代码

1423146896

过来转转,我只是路过打酱油的。