| 插入代码
```/*
*?函数原型：
NTSTATUS NtQueueTHreadApcEx(
_in HANDLE thread,
_in UCHAR flags,0:常规用户APC，1：特殊用户APC
_in PAPCFUNC apcRoutine,
_in PVOID context1,
_in PVOID arg1,
_in PVOID arg2
);
需要从Ntdll.dll模块显式导出（GetProcAddress）
*/
#define _CRT_SECURE_NO_WARNINGS
#include<stdio.h>
#include<Windows.h>
#include<Tlhelp32.h>
#include"fun.h"
HWND hwndG?=?0;
BOOL?CALLBACK EnumWindowsProc(
????HWND hwnd,
????LPARAM lParam)
{
????WCHAR path[MAX_PATH]?=?{?0?};
????WCHAR*?text?=?(WCHAR*)lParam;
????GetWindowText(hwnd, path, MAX_PATH);
????if?(lstrcmpW(text, path)?==?0)
????{
????????hwndG?=?hwnd;
????????return?FALSE;
????}
????else
????{
????????hwndG?=?0;
????????return?TRUE;
????}
}
DWORD WINAPI GetThreadIdByProcessId(DWORD dwProcessId)
{
????THREADENTRY32 th32;
????th32.dwSize?=?sizeof(THREADENTRY32);
????DWORD dwThreadId?=?0;
????HANDLE hdTool?=?CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, dwProcessId);
????if?(Thread32First(hdTool, &th32))
????{
????????do
????????{
????????????if?(th32.th32OwnerProcessID?==?dwProcessId)
????????????{
????????????????dwThreadId?=?th32.th32ThreadID;
????????????????//printf("%d\n", dwThreadId);
????????????????break;
????????????}
????????}?while?(Thread32Next(hdTool, &th32));
????}
????else
????{
????????DWORD dwErro?=?GetLastError();
????????//printf("遍历进程失败!——%d", dwErro);
????????return?dwErro;
????}
?????
????return?dwThreadId;
}
BOOL?WINAPI PrivilegeAdjust()
{
????BOOL?flag;
????HANDLE token;
????if?(!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token))
????{
????????//printf("打开令牌失败!\n");
????????flag?=?FALSE;
????}
????LUID pid;
????if?(!LookupPrivilegeValueA(NULL,?"SeDebugPrivilege", &pid))
????{
????????//printf("查看特权ID失败\n");
????????flag?=?FALSE;
????}
????TOKEN_PRIVILEGES tp;
????tp.PrivilegeCount?=?1;
????tp.Privileges[0].Luid?=?pid;
????tp.Privileges[0].Attributes?=?SE_PRIVILEGE_ENABLED;
????if?(!AdjustTokenPrivileges(token, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL))
????{
????????//printf("提升特权失败！\n");
????????flag?=?FALSE;
????}
????return?TRUE;
}
typedef?BOOL(*MYTYPE)(HANDLE, LPVOID, LPVOID, SIZE_T, SIZE_T*);
typedef HANDLE(*OPPS)(DWORD,?BOOL, DWORD);
typedef?BOOL(*WRMEMEX)(HANDLE, LPVOID, LPVOID, SIZE_T, SIZE_T*);
typedef HANDLE(*OPTS)();
typedef ULONG64(*GETPEB)(DWORD);
typedef NTSTATUS(*NTQUEAPC)(HANDLE, UCHAR, PVOID, PVOID, PVOID, PVOID);
WRMEMEX Read;
WRMEMEX Write;
OPPS OpenPro;
OPTS OpenThr;
NTQUEAPC NtQueueUserApcEx;
VOID InitFrmak()
{
????printf("内核\n");
????NtQueueUserApcEx?=?NULL;
????HMODULE mod?=?LoadLibraryA("ApiSystemCall.dll");
????Read?=?(WRMEMEX)GetProcAddress(mod,?"YhReadProcessMemory");
????Write?=?(WRMEMEX)GetProcAddress(mod,?"YhWriteProcessMemory");
????OpenPro?=?(OPPS)GetProcAddress(mod,?"YhOpenProcess");
????OpenThr?=?(OPTS)GetProcAddress(mod,?"YhOpenThread");
????NtQueueUserApcEx?=?(NTQUEAPC)GetProcAddress(GetModuleHandleA("ntdll.dll"),?"NtQueueApcThreadEx");
????if?(NtQueueUserApcEx?==?NULL)
????{
????????MessageBoxA(NULL,?"获取函数失败",?0,?0);
????}
}
VOID InitFrmakEx()
{
????NtQueueUserApcEx?=?NULL;
?????
????printf("普通\n");
????Read?=?ReadProcessMemory;
????Write?=?WriteProcessMemory;
????OpenPro?=?OpenProcess;
????OpenThr?=?OpenThread;
????NtQueueUserApcEx?=?(NTQUEAPC)GetProcAddress(GetModuleHandleA("ntdll.dll"),?"NtQueueApcThreadEx");
????if?(NtQueueUserApcEx?==?NULL)
????{
????????MessageBoxA(NULL,?"获取函数失败",?0,?0);
????}
}
typedef VOID(*FUN)();
int?main()
{
????DWORD pid;
????SIZE_T size=0;
????CONTEXT text;
????VirtualProtect(fun,?0x60, PAGE_EXECUTE_READWRITE, &pid);
????*(ULONG64*)(&(((UCHAR*)fun2)[0x34]))?=?MessageBoxA;
????*(ULONG64*)(&(((UCHAR*)fun2)[0x9f]))?=?SetWindowsHookExA;
????//fun(NULL,NULL,NULL);
????printf("请输入模式：\n1.普通模式\n2.内核模式\n");
????scanf("%d", &size);
????(size==1)? InitFrmakEx(): InitFrmak();
????printf("请输入进程PID：\n");
????scanf("%d", &pid);
????PrivilegeAdjust();
?????
????HANDLE hd?=?OpenPro(PROCESS_ALL_ACCESS, FALSE, pid);
????PVOID mem?=?VirtualAllocEx(hd, NULL,?0X1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
????DWORD tid?=?GetThreadIdByProcessId(pid);
????HANDLE td;
????if?(size?==?1)
????{
????????td?=?OpenThr(THREAD_ALL_ACCESS,FALSE,tid);
????}
????else
????{
????????td?=?OpenThr(tid, hd, THREAD_ALL_ACCESS, FALSE);
????}
????if?(!Write(hd, mem, fun2,?0x100, &size))
????{
????????MessageBoxA(0,?"写入失败",?0,?0);
????}
????SuspendThread(td);
????NTSTATUS code?=?NtQueueUserApcEx(td,?1, (PVOID)(((ULONG64)mem)+0x53), tid,?0,?0);
????if(code!=0)
????{
?????????
????????printf("%x\n", code);
????????MessageBox(0,?0,?0,?0);
????}
????ResumeThread(td);
????system("pause");
????return?0;
}
| 
