插入apc的方式 实现dll注入

测试了一下 插入Explorer是可以的    但是不保证插入每一个进程都会成功。

BOOL UseApcInsertDll(DWORD dwProcessID, char *strDllName)
{
//打开进程
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessID);
if (hProcess == 0)
{
return FALSE;
}

DWORD dwDllLength = lstrlen(strDllName);
if (dwDllLength == 0)
{
CloseHandle(hProcess);
return FALSE;
}

PVOID pVirtualDllName = VirtualAllocEx( hProcess,
NULL,
dwDllLength ,
MEM_COMMIT | MEM_TOP_DOWN,
PAGE_EXECUTE_READWRITE);
if (pVirtualDllName == NULL)
{
CloseHandle(hProcess);
return FALSE;
}

DWORD dwRet = 0;
if (!WriteProcessMemory(hProcess, pVirtualDllName, (LPVOID)strDllName, dwDllLength, &dwRet))
{
CloseHandle(hProcess);
return FALSE;
}
CloseHandle(hProcess);

//枚举所有线程
THREADENTRY32 te32 = {0} ;
te32.dwSize= sizeof(THREADENTRY32) ;
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, dwProcessID) ;
if(hSnapshot == INVALID_HANDLE_VALUE)
return FALSE;
if(Thread32First(hSnapshot,&te32) == FALSE)
return FALSE;
do
{
if(te32.th32OwnerProcessID==dwProcessID)
{
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID) ;
if (0 == QueueUserAPC((PAPCFUNC)LoadLibraryA, hThread, (ULONG_PTR)pVirtualDllName))
{
CloseHandle(hSnapshot);
return FALSE;
}
}
}while(Thread32Next(hSnapshot,&te32));
CloseHandle(hSnapshot);
return TRUE;
}