########################################################################
########################################################################
/*
* 在远程进程中搜索模块句柄
*/
HMODULE FindRemoteMod(HANDLE hProcess, const wchar_t * pszModShortName)
{
HMODULE _hModules [0x100] = {0};
int _cbNeeded = 0;
if (!EnumProcessModules(hProcess
, _hModules
, sizeof(_hModules)
, (unsigned long *)&_cbNeeded))
return (HMODULE)0;
for (int _i = 0; _i < (_cbNeeded >>2); _i ++)
{
wchar_t _szModuleName [0x200] = {0};
GetModuleBaseNameW(hProcess
, _hModules[_i]
, _szModuleName
, sizeof(_szModuleName)/sizeof(_szModuleName[0]));
if (!wcsicmp(_szModuleName, pszModShortName))
return _hModules[_i];
}
return (HMODULE)0;
}
########################################################################
/*
* 卸载远程dll
*/
BOOL UnloadDll(unsigned long pid, const wchar_t * dllname)
{
// 打开进程,具备写入权限和创建线程权限
HANDLE hProcess = OpenProcess(PROCESS_VM_READ
| PROCESS_VM_WRITE
| PROCESS_VM_OPERATION
| PROCESS_SUSPEND_RESUME
| PROCESS_CREATE_THREAD
| PROCESS_QUERY_INFORMATION
, FALSE
, pid);
if (NULL == hProcess)
return FALSE;
// 检查是否是同一个用户会话中的进程
HANDLE _hToken = INVALID_HANDLE_VALUE;
if (!OpenProcessToken(hProcess, TOKEN_READ, &_hToken))
{
CloseHandle(hProcess);
return FALSE;
}
CloseHandle(_hToken);
HMODULE _hDllModule = CheckDllLoaded(hProcess, dllname);
if (_hDllModule != 0)
{
// 以FreeLibrary为线程体创建线程,卸载目标进程中的特定DLL.
unsigned long _tid = 0;
CreateRemoteThread(hProcess
, 0, 0
, (LPTHREAD_START_ROUTINE)FreeLibrary
, _hDllModule
, 0
, &_tid);
}
CloseHandle(hProcess); hProcess=0;
return TRUE;
}
########################################################################
/*
* 加载dll到远程进程
*/
BOOL LoadDll(HANDLE hProcess, const wchar_t * dllpath)
{
// 计算路径长度,分配远程进程空间内虚拟内存
DWORD dwRemoteBufLength = (wcslen(dllpath)+1)*sizeof(wchar_t);
// 在目标进程中分配一点空间来存放LoadLibraryW的参数
wchar_t * _pBuf =(wchar_t * )VirtualAllocEx(hProcess
, NULL
, dwRemoteBufLength
, MEM_COMMIT
, PAGE_READWRITE);
if(!_pBuf)
return FALSE;
// 把dll的全路径写入到远程进程地址空间
if(!(WriteProcessMemory(hProcess
,_pBuf
,(PVOID)dllpath
,dwRemoteBufLength
,NULL)))
return FALSE;
// 以LoadLibraryW为线程体来创建远程线程
HANDLE _hThread = CreateRemoteThread(hProcess
, NULL
, 0
, (PTHREAD_START_ROUTINE)(LoadLibraryW)
, (PVOID)_pBuf
, 0
, NULL);
// 内存泄漏?!
return (_hThread != INVALID_HANDLE_VALUE);
}