InjectAPC全部项目（Win32和Win64位）

 // InjectAPC.cpp : 定义控制台应用程序的入口点。
 //

 #include "stdafx.h"
 #include <Windows.h>
 #include <iostream>
 #include <vector>
 #include <TlHelp32.h>

 using namespace std;
 BOOL GrantPrivileges(WCHAR* PrivilegeName);
 BOOL GetProcessIDByProcessImageName(IN WCHAR* wzProcessImageName, OUT UINT32* TargetProcessID);
 BOOL GetThreadIDByProcessID(UINT32 ProcessID, vector<UINT32>& ThreadIDVector);
 BOOL Inject(UINT32 ProcessID, UINT32 ThreadID);

 WCHAR DllFullPath[MAX_PATH] = {  };
 PVOID DllFullPathBufferData = NULL;

 int main()
 {
     if(GrantPrivileges(SE_DEBUG_NAME)==FALSE)
     {
         printf("GrantPrivilege Error\r\n");
     }
     UINT32 ProcessID = ;
     GetCurrentDirectory(MAX_PATH, DllFullPath);
     wcscat(DllFullPath, L"\\Dll.dll");
     //getchar();
     //printf("%S\r\n", DllFullPath);

 #ifdef _WIN64
     GetProcessIDByProcessImageName(L"Taskmgr.exe", &ProcessID);
 //    GetProcessIDByProcessImageName(L"explorer.exe", &ProcessID);
 #else
     GetProcessIDByProcessImageName(L"Taskmgr.exe", &ProcessID);
 #endif
     vector<UINT32> ThreadIDVector;
     //printf("%d\r\n", ProcessID);
     GetThreadIDByProcessID(ProcessID, ThreadIDVector);

     UINT32 ThreadID = ;
     while (!ThreadIDVector.empty())
     {
         ThreadID = ThreadIDVector.back();
         Inject(ProcessID, ThreadID);
         ThreadIDVector.pop_back();
     }
     /*size_t ThreadCount = ThreadIDVector.size();
     for (INT_PTR i = ThreadCount - 1; i >= 0; i--)
     {
         UINT32 ThreadID = ThreadIDVector[i];
         Inject(ProcessID, ThreadID);
     }*/
     getchar();
     return ;
 }
 //提高的是自己的权限，提成自己想要的。

 BOOL GrantPrivileges(WCHAR* PrivilegeName)
 {
     HANDLE TokenHandle = NULL;
     TOKEN_PRIVILEGES PrivilegesToken;
     LUID v1;
     //打开权限令牌
     if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &TokenHandle))
     {
         return FALSE;
     }
     if (!LookupPrivilegeValue(NULL, PrivilegeName, &v1))
     {
         CloseHandle(TokenHandle);
         return FALSE;
     }
     PrivilegesToken.PrivilegeCount = ;
     PrivilegesToken.Privileges[].Luid = v1;
     PrivilegesToken.Privileges[].Attributes = SE_PRIVILEGE_ENABLED;
     //调整权限                    //特权启用.    特权被用来访问一个对象或服务
     if (!AdjustTokenPrivileges(TokenHandle, FALSE, &PrivilegesToken, sizeof(PrivilegesToken), NULL, NULL))
     {
         CloseHandle(TokenHandle);
         TokenHandle = NULL;
         return false;
     }
     //启用特权
     CloseHandle(TokenHandle);

     return TRUE;
 }
 //做好放的笔记里
 BOOL GetProcessIDByProcessImageName(IN WCHAR * wzProcessImageName, OUT UINT32 * TargetProcessID)
 {
     HANDLE ProcessSnapshotHandle = NULL;    //1.初始化

     ProcessSnapshotHandle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, );
     //一个班的学生
     if (ProcessSnapshotHandle == INVALID_HANDLE_VALUE)
     {
         return FALSE;
     }

     PROCESSENTRY32 ProcessEntry32 = {  }; //用来存放快照进程信息的一个结构体
     ProcessEntry32.dwSize = sizeof(PROCESSENTRY32);//初始化PROCESSENTRY结构
     Process32First(ProcessSnapshotHandle, &ProcessEntry32);    //把第一个进程 放在结构体中

     do
     {
         if (lstrcmpi(ProcessEntry32.szExeFile, wzProcessImageName)==) //不区分大小写
         {                    //进程的名称
             *TargetProcessID = ProcessEntry32.th32ProcessID;
             break;
         }
     } while (Process32Next(ProcessSnapshotHandle, &ProcessEntry32));
     //printf("%d\r\n", *TargetProcessID);
     CloseHandle(ProcessSnapshotHandle);
     ProcessSnapshotHandle = NULL;
     return TRUE;
     return ;
 }
 //枚举对方的指定进程ID的所有线程，压入vector中，返回线程集合
 BOOL GetThreadIDByProcessID(UINT32 ProcessID, vector<UINT32>& ThreadIDVector)
 {
     HANDLE ThreadSnapshotHandle = NULL;
     THREADENTRY32 ThreadEntry32 = {  };
     ThreadEntry32.dwSize = sizeof(THREADENTRY32);
     ThreadSnapshotHandle = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, );
     if (ThreadSnapshotHandle == INVALID_HANDLE_VALUE)            //指定将要快照的进程ID。如果该参数为0表示快照当前进程。该参数只有在设置了TH32CS_SNAPHEAPLIST或者TH32CS_SNAPMODULE后才有效，
     {                                                            //在其他情况下该参数被忽略，所有的进程都会被快照。所以不用修改0为ProcessID。
         return FALSE;
     }
     BOOL bOk = Thread32First(ThreadSnapshotHandle, &ThreadEntry32);
     if (bOk)
     {
         do
         {
             if (ThreadEntry32.th32OwnerProcessID == ProcessID)
             {
                 ThreadIDVector.emplace_back(ThreadEntry32.th32ThreadID); //怀疑可能push.back枚举可以
             }
         } while (Thread32Next(ThreadSnapshotHandle, &ThreadEntry32));
     }
     CloseHandle(ThreadSnapshotHandle);
     ThreadSnapshotHandle = NULL;
     return TRUE;
 }

 BOOL Inject(UINT32 ProcessID, UINT32 ThreadID)
 {
     HANDLE ProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);
     HANDLE ThreadHandle = INVALID_HANDLE_VALUE;
     //
     SIZE_T ReturnLength = ;

     size_t DllFullPathLength = wcslen(DllFullPath) + ;

     if (DllFullPathBufferData == NULL)
     {
         //在对方进程空间申请内存，存储Dll完整路径。
         DllFullPathBufferData = VirtualAllocEx(ProcessHandle, NULL, DllFullPathLength * , MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
         if (DllFullPathBufferData == NULL)
         {
             CloseHandle(ProcessHandle);
             CloseHandle(ThreadHandle);
             return FALSE;
         }
     //将DllFullPath写进刚刚申请的内存中                                                        size是双字长度
         BOOL bOk = WriteProcessMemory(ProcessHandle, DllFullPathBufferData, DllFullPath, DllFullPathLength*,
             &ReturnLength);

         if (bOk == FALSE)
         {
             VirtualFreeEx(ProcessHandle,DllFullPathBufferData,(DllFullPathLength * ), MEM_RELEASE);
             CloseHandle(ProcessHandle);
             CloseHandle(ThreadHandle);
             return FALSE;
         }
     }

     UINT_PTR LoadLibraryAddress = (UINT_PTR)GetProcAddress(GetModuleHandle(L"Kernel32.dll"),"LoadLibraryW");
     //当前进程中获得导入模块Kernel32基地址
     //Kernel32模块中的导出表中获得函数LoadLibraryW

     /*
     为什么这里用导出表中的地址LoadLibraryW不用导入表中的函数地址？
     LoadLibraryW 当前进程导入表中的地址 比如 LoadLibraryW = 0x1234   0x1234 -->0x7564 相当于 0x1234[0x7564]

     1.防止中一种病毒叫Hook IAT(ImportAddressTable) Hook
     中这种病毒，修改了Kernel 地址 0x7564，这样寻不到址
     2.确保地址OK

     */
     if (LoadLibraryAddress == NULL)
     {
         VirtualFreeEx(ProcessHandle, DllFullPathBufferData, (DllFullPathLength * ), MEM_RELEASE);
         CloseHandle(ProcessHandle);
         return FALSE;
     }
     _try
     {
         ThreadHandle = OpenThread(THREAD_ALL_ACCESS, FALSE, ThreadID);
         QueueUserAPC((PAPCFUNC)LoadLibraryAddress,ThreadHandle,(UINT_PTR)DllFullPathBufferData);
                                 //LoadLibraryAddress(DllFullPathBufferData)
     }
     _except(EXCEPTION_CONTINUE_EXECUTION)
     {

     }
     CloseHandle(ProcessHandle);
     CloseHandle(ThreadHandle);
     return ;
 }

卷珠帘