APC注入DLL(win7下有问题)

1. void APCKernelRoutine(PKAPC pKAPC,
2. PKNORMAL_ROUTINE pUserAPC,
3. PVOID pContext,
4. PVOID pSysArg1,
5. PVOID pSysArg2)
6. {
7. DbgPrint("APCKernelRoutine Entered\n");
8. ExFreePool(pKAPC);
9. }
10. NTSTATUS InjectDllByAPC(ULONG TargetPid, ULONG TargetTid, PUNICODE_STRING usDllPath, ULONG LdrMethodAddress)
11. {
12. ULONG size;
13. PKTHREAD TargetThread;
14. PEPROCESS TargetProcess;
15. KAPC_STATE ApcState; ULONG arg1 = 0;
16. ULONG arg2 = 0;
17. ULONG arg3 = 0;
18. DbgPrint("Inside InjectDllByAPC...\n");  size = (unsigned char*)APCMdlCodeEnd - (unsigned char*)APCMdlCode;
19. DbgPrint("Allocating MDL (1)...\n"); pMDLApcCode = IoAllocateMdl(APCMdlCode, size, FALSE, FALSE, NULL);
20. if (!pMDLApcCode)
21. {
22. return(STATUS_UNSUCCESSFUL);
23. }
24. MmProbeAndLockPages(pMDLApcCode, KernelMode, IoWriteAccess);
25. RtlZeroMemory(pAPCData, sizeof( pAPCData));
26. memcpy( (char*) pAPCData, usDllPath->Buffer, usDllPath->Length);
27. unicodeLengthInfo = *(ULONG*) usDllPath;
28. pMDLApcData = IoAllocateMdl (pAPCData, sizeof(pAPCData), FALSE,FALSE,NULL);
29. if (!pMDLApcData)
30. {
31. return STATUS_UNSUCCESSFUL;
32. }
33. MmProbeAndLockPages(pMDLApcData, KernelMode, IoWriteAccess);    PsLookupProcessByProcessId((HANDLE)TargetPid, &TargetProcess);
34. DbgPrint("Pid: %d, PEPROCESS: 0X%X\n", TargetPid, TargetProcess);
35. PsLookupThreadByThreadId ((PVOID) TargetTid, &TargetThread);
36. DbgPrint("Tid: %d, PKTHREAD: 0X%X\n", TargetTid, TargetThread);  KeStackAttachProcess((PKPROCESS) TargetProcess, &ApcState);
37. pMappedCode = (PVOID*) MmMapLockedPagesSpecifyCache(pMDLApcCode, UserMode, MmCached, NULL, FALSE, NormalPagePriority);
38. pMappedData = (PVOID*) MmMapLockedPagesSpecifyCache(pMDLApcData, UserMode, MmCached, NULL, FALSE, NormalPagePriority);  KeUnstackDetachProcess (&ApcState);
39. arg1 = (ULONG) LdrMethodAddress;
40. arg2 = (ULONG) pMappedData;
41. arg3 = (ULONG) unicodeLengthInfo;
42. pKAPC = (PKAPC) ExAllocatePool( NonPagedPool, sizeof(KAPC) );
43. RtlZeroMemory(pKAPC, sizeof(KAPC));
44. KeInitializeApc(pKAPC, TargetThread, OriginalApcEnvironment,
45. (PKKERNEL_ROUTINE)APCKernelRoutine, NULL,
46. (PKNORMAL_ROUTINE) pMappedCode,
47. UserMode, (PVOID)arg1);  KeInsertQueueApc(pKAPC, (PVOID)arg2, (PVOID)arg3, 0);
48. //KETHREAD.ApcState.UserApcPending = 1
49. //*((unsigned char *)TargetThread + 0x4a) = 1; //XP, 2K3 RTM
50. //*((unsigned char *)TargetThread + 0x3e) = 1; //2K3 SP1, SP2
51. //*((unsigned char *)TargetThread + 0x4e) = 1; //Vista
52. *((unsigned char *)TargetThread + 0x56) = 1; //Win 7
53. if (pMDLApcCode)
54. {
55. MmUnlockPages(pMDLApcCode);
56. IoFreeMdl(pMDLApcCode);
57. }   if (pMDLApcData)
58. {
59. MmUnlockPages(pMDLApcData);
60. IoFreeMdl(pMDLApcData);
61. }
62. ObDereferenceObject(TargetProcess);
63. ObDereferenceObject(TargetThread);  return STATUS_SUCCESS;
64. }
65. void APCMdlCode(PVOID lpLdrLoadDll, PVOID pwsDllPath, PVOID pwsDllPathLength)
66. {
67. UNICODE_STRING usDllName;
68. ULONG DllCharacteristics = 0;
69. PVOID DllHandle = 0;
70. usDllName.Length = (USHORT) pwsDllPathLength;
71. usDllName.MaximumLength = usDllName.Length + 2;
72. usDllName.Buffer = (WCHAR*) pwsDllPath;
73. __asm
74. {
75. pushad      lea eax, DllHandle
76. push eax
77. lea eax, usDllName
78. push eax
79. lea eax, DllCharacteristics
80. push eax
81. push 0
82. call [lpLdrLoadDll]   nop
83. nop
84. popad   }
85. }
86. void APCMdlCodeEnd()
87. {
88. }