DWORD GetProcessIdByName(LPCTSTR lpszProcessName)
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnapshot == INVALID_HANDLE_VALUE)
if (Process32First(hSnapshot, &pe))
if (lstrcmpi(lpszProcessName, pe.szExeFile) == 0)
} while (Process32Next(hSnapshot, &pe));
BOOL GetAllThreadIdByProcessId(DWORD dwProcessId)
DWORD dwBufferLength = 1000;
THREADENTRY32 te32 = { 0 };
::RtlZeroMemory(&te32, sizeof(te32));
te32.dwSize = sizeof(te32);
hSnapshot = ::CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
bRet = ::Thread32First(hSnapshot, &te32);
if (te32.th32OwnerProcessID == dwProcessId)
return te32.th32ThreadID;
bRet = ::Thread32Next(hSnapshot, &te32);
FARPROC pLoadLibrary = NULL;
BYTE DllName[] = "C:\\Users\\Black Sheep\\source\\repos\\ApcInject\\x64\\Debug\\TestDll.dll";
ProcessId = GetProcessIdByName(L"explorer.exe");
hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, ProcessId);
pLoadLibrary = GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");
AllocAddr = VirtualAllocEx(hProcess, 0, sizeof(DllName) + 1, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProcess, AllocAddr, DllName, sizeof(DllName) + 1, 0);
Threadid = GetAllThreadIdByProcessId(ProcessId);
hThread = OpenThread(THREAD_ALL_ACCESS, 0, Threadid);
QueueUserAPC((PAPCFUNC)pLoadLibrary, hThread, (ULONG_PTR)AllocAddr);