插APC实现DLL注入

关注

原创最新推荐文章于 2026-08-09 12:51:27 发布 2.6k 阅读 AI 写同款· GEO 优化 ›

把dll模块注入到游戏进程的方法_插APC注入 APC是异步过程调用，系统创建线程的时候会为线程创建一个APC队列，当线程调用SleepEx，WaitSingleObjectEx等函数时，并把线程状态被设置为可提醒状态时，线程并不会睡眠，而是检查APC队列是否为空，如果不为空，转去执行APC队列中的每一项，因此给目标进程中的线程插入APC，就可以实现进程注入。阅读详情

#include <Windows.h>
#include <TlHelp32.h>

int InjectDllWithApc(char DllFullPath[MAX_PATH], ULONG pid )
{
	HANDLE hProcess,hThread,hThreadSnap = INVALID_HANDLE_VALUE;
	THREADENTRY32 te32 = {0} ;
	HMODULE hDll = GetModuleHandle("Kernel32.dll"); 
	int len = strlen(DllFullPath) + 1;
	hProcess = OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_WRITE,TRUE,pid);
	//打开目标进程，向目标进程写入DLL
	if(hProcess==NULL)
	{
		printf("failed to open process!!\n");
		return 0;
	}
	//申请内存
	PVOID pszLibFileRemote = (char *)VirtualAllocEx(hProcess, NULL, lstrlen(DllFullPath)+1, MEM_COMMIT, PAGE_READWRITE); 
	if (pszLibFileRemote != NULL)
	{//写入DLL
		if(WriteProcessMemory(hProcess,pszLibFileRemote,(void *)DllFullPath, lstrlen(DllFullPath)+1, NULL))
		{
			HANDLE hThreadSnap = INVALID_HANDLE_VALUE; 
			THREADENTRY32 te32;
			hThreadSnap = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 );
			if( hThreadSnap == INVALID_HANDLE_VALUE ) 
				return 1; 
			te32.dwSize = sizeof(THREADENTRY32 ); 
			if( !Thread32First( hThreadSnap, &te32 ) ) 
			{
				CloseHandle( hThreadSnap );
				return 1;
			}
			do 
			{//遍历进程线程
				if( te32.th32OwnerProcessID == pid )
				{ printf("TID:%d\n", te32.th32ThreadID) ;
			
				hThread = OpenThread(THREAD_SET_CONTEXT ,FALSE,te32.th32ThreadID);
				if (hThread != 0)
				{//目标线程插入APC
					if(QueueUserAPC((PAPCFUNC)LoadLibraryA, hThread, (DWORD)pszLibFileRemote))
					{
						printf("插入APC成功\n") ;
					}
					else
					{  
						printf("插入APC失败\n");
						return 1;
					}
					CloseHandle(hThread);
				}
				}
			}while( Thread32Next(hThreadSnap, &te32 ) ); 
			CloseHandle( hThreadSnap );
		}
	}
	CloseHandle(hProcess);
	return 0;
}


int _tmain(int argc, _TCHAR* argv[])
{
	InjectDllWithApc("C:\\DllTest.dll",1496);
	return 0;
}

收录于