| 357 | // ============================================================================= |
| 358 | |
| 359 | void TestProcessSpawnWithAPCInjection() { |
| 360 | printf("\n=== TEST 3: Process Spawn with APC Injection ===\n\n"); |
| 361 | |
| 362 | STARTUPINFOA si = { 0 }; |
| 363 | PROCESS_INFORMATION pi = { 0 }; |
| 364 | si.cb = sizeof(si); |
| 365 | |
| 366 | printf("[Main] Spawning child process (notepad.exe) in suspended state...\n"); |
| 367 | if (!CreateProcessA( |
| 368 | "C:\\Windows\\System32\\notepad.exe", |
| 369 | NULL, |
| 370 | NULL, |
| 371 | NULL, |
| 372 | FALSE, |
| 373 | CREATE_SUSPENDED, |
| 374 | NULL, |
| 375 | NULL, |
| 376 | &si, |
| 377 | &pi)) { |
| 378 | printf("[!] CreateProcess failed: %lu\n", GetLastError()); |
| 379 | return; |
| 380 | } |
| 381 | |
| 382 | printf("[Main] Process created - PID: %lu, TID: %lu\n", pi.dwProcessId, pi.dwThreadId); |
| 383 | |
| 384 | // Allocate memory in the target process |
| 385 | SIZE_T shellcodeSize = sizeof(g_dummyShellcode); |
| 386 | LPVOID pRemoteMemory = VirtualAllocEx( |
| 387 | pi.hProcess, |
| 388 | NULL, |
| 389 | shellcodeSize, |
| 390 | MEM_COMMIT | MEM_RESERVE, |
| 391 | PAGE_READWRITE); |
| 392 | |
| 393 | if (!pRemoteMemory) { |
| 394 | printf("[!] VirtualAllocEx failed: %lu\n", GetLastError()); |
| 395 | TerminateProcess(pi.hProcess, 1); |
| 396 | CloseHandle(pi.hProcess); |
| 397 | CloseHandle(pi.hThread); |
| 398 | return; |
| 399 | } |
| 400 | |
| 401 | printf("[Main] Allocated %zu bytes at 0x%p in target process\n", |
| 402 | shellcodeSize, pRemoteMemory); |
| 403 | |
| 404 | // Write shellcode to the allocated memory |
| 405 | SIZE_T bytesWritten = 0; |
| 406 | if (!WriteProcessMemory( |
| 407 | pi.hProcess, |
| 408 | pRemoteMemory, |
| 409 | g_dummyShellcode, |
| 410 | shellcodeSize, |
| 411 | &bytesWritten)) { |
| 412 | printf("[!] WriteProcessMemory failed: %lu\n", GetLastError()); |
| 413 | VirtualFreeEx(pi.hProcess, pRemoteMemory, 0, MEM_RELEASE); |
| 414 | TerminateProcess(pi.hProcess, 1); |
| 415 | CloseHandle(pi.hProcess); |
| 416 | CloseHandle(pi.hThread); |