void DLLinjector::DllOnLoad() {
	if (!this->Check()){
		wcout << "The Process or DLL file not found\n";
		return;
	}
    //向目标进程写入DLL的路径
	SIZE_T dwWriteSize = 0;
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, this->dwPid);
	LPVOID pAddress = VirtualAllocEx(hProcess, NULL, 0x100, MEM_COMMIT, PAGE_READWRITE);
	WriteProcessMemory(hProcess, pAddress, this->szPath, wcslen(this->szPath)*2+2, &dwWriteSize);
	
    //从ntdll导出 LoadLibraryA 函数
	HMODULE Ntdll = LoadLibraryA("ntdll.dll");
	LPVOID LoadLibraryBase = GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");
    
	HANDLE hRemoteProcess = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibraryW,pAddress,NULL,NULL);
	WaitForSingleObject(hRemoteProcess, -1);

	//释放资源
	VirtualFreeEx(hProcess, pAddress, 0x300, MEM_COMMIT);
	CloseHandle(hProcess);
	FreeModule(Ntdll);

	wcout << "injection complete\n";
}

do
{
	if( !hProcess  || !lpBuffer || !dwLength )
		break;

	// check if the library has a ReflectiveLoader...
	dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer );
	if( !dwReflectiveLoaderOffset )
		break;

	// alloc memory (RWX) in the host process for the image...
	lpRemoteLibraryBuffer = VirtualAllocEx( hProcess, NULL, dwLength, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); 
	if( !lpRemoteLibraryBuffer )
		break;

	// write the image into the host process...
	if( !WriteProcessMemory( hProcess, lpRemoteLibraryBuffer, lpBuffer, dwLength, NULL ) )
		break;
	
	// add the offset to ReflectiveLoader() to the remote library address...
	lpReflectiveLoader = (LPTHREAD_START_ROUTINE)( (ULONG_PTR)lpRemoteLibraryBuffer + dwReflectiveLoaderOffset );

	// create a remote thread in the host process to call the ReflectiveLoader!
	hThread = CreateRemoteThread( hProcess, NULL, 1024*1024, lpReflectiveLoader, lpParameter, (DWORD)NULL, &dwThreadId );

} while( 0 );

// uiNameArray = the address of the modules export directory entry
uiNameArray = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

// get the File Offset of the export directory
uiExportDir = uiBaseAddress + Rva2Offset( ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress );

// get the File Offset for the array of name pointers
uiNameArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames, uiBaseAddress );

// get the File Offset for the array of addresses
uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress );

// get the File Offset for the array of name ordinals
uiNameOrdinals = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals, uiBaseAddress );	

// get a counter for the number of exported functions...
dwCounter = ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->NumberOfNames;

// loop through all the exported functions to find the ReflectiveLoader
while( dwCounter-- )
{
	char * cpExportedFunctionName = (char *)(uiBaseAddress + Rva2Offset( DEREF_32( uiNameArray ), uiBaseAddress ));

	if( strstr( cpExportedFunctionName, "ReflectiveLoader" ) != NULL )
	{
		// get the File Offset for the array of addresses
		uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress );	

		// use the functions name ordinal as an index into the array of name pointers
		uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );

		// return the File Offset to the ReflectiveLoader() functions code...
		return Rva2Offset( DEREF_32( uiAddressArray ), uiBaseAddress );
	}
	// get the next exported function name
	uiNameArray += sizeof(DWORD);

	// get the next exported function name ordinal
	uiNameOrdinals += sizeof(WORD);
}

return 0;

THREADENTRY32 te = { sizeof(THREADENTRY32) };
HANDLE hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (INVALID_HANDLE_VALUE == hThreadSnap) {
	std::cout << "Error In APC Injection\n";
}
BOOL bStat = FALSE;
//得到第一个线程
if (Thread32First(hThreadSnap, &te)) {
	do
	{
		if (te.th32OwnerProcessID == this->dwPid) {
			HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te.th32ThreadID);
			if (hThread) {
				DWORD dwRet = QueueUserAPC((PAPCFUNC)LoadLibraryW, hThread, (ULONG_PTR)pAddress);
				if (dwRet > 0)	bStat = TRUE;
			}
			CloseHandle(hThread);
		}
	} while (Thread32Next(hThreadSnap, &te));
}
CloseHandle(hThreadSnap);