卸载其他进程中的dll模块

啥也不说了，贴代码：

[cpp]  view plain copy print ?

1. #include "stdafx.h"  
2. #define MAX_MODULE_NAME_LEN 16  
3. // 传入到远程线程中的参数结构定义  
4. typedef struct tagThreadParam   
5. {  
6.     DWORD dwFreeLibrary;                    // FreeLibrary 地址  
7.     DWORD dwGetModuleHandle;                // GetModuleHandle 地址  
8.     TCHAR szModuleName[MAX_MODULE_NAME_LEN];// 需要卸载的模块的名称  
9. }ThreadParam,*PThreadParam;  
10. /* 
11.     远程线程函数 
12. */  
13. void RemoteThreadFun(PThreadParam PParam)  
14. {  
15.     DWORD dwFreeLibrary;  
16.     DWORD dwGetModuleHandle;  
17.     DWORD dwModuleName;  
18.       
19.     dwFreeLibrary = PParam->dwFreeLibrary;  
20.     dwGetModuleHandle = PParam->dwGetModuleHandle;  
21.     dwModuleName = (DWORD)PParam->szModuleName;  
22.       
23.     // 释放的最高次数  
24.     DWORD dwCount = 100;  
25.       
26.     // 循环寻找指定模块的句柄,如果找到,那么调用FreeLibrary释放,  
27.     // 直到该模块被释放  
28.     __asm  
29.     {          
30. START:  
31.     push dwModuleName;            // 模块名称压栈  
32.     call dwGetModuleHandle;        // 调用GetModuleHandle  
33.     test eax,eax;                //   
34.     jz OVER;                    // 没有找到模块返回  
35.     dec dwCount;  
36.     jz OVER;                    // 达到最高次数  
37.     push eax;                    // 模块句柄压栈  
38.     call dwFreeLibrary;            // 调用FreeLibrary  
39.     test eax,eax;  
40.     jnz START;  
41. OVER:          
42.     }  
43.     return;  
44. }  
45. /* 
46.     调整权限 
47. */  
48. bool AdjustPurview()  
49. {  
50.     TOKEN_PRIVILEGES TokenPrivileges;  
51.     bool bRet;  
52.     HANDLE hToken;  
53.       
54.     LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &TokenPrivileges.Privileges[0].Luid);     
55.     OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken);  
56.       
57.     TokenPrivileges.PrivilegeCount = 1;     
58.     TokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;  
59.       
60.     bRet = !!AdjustTokenPrivileges(hToken, FALSE, &TokenPrivileges, 0, NULL, NULL);  
61.       
62.     CloseHandle(hToken);  
63.     return bRet ;  
64. }  
65. BOOL FreeModuleByPid(TCHAR * szModuleName,DWORD dwPid)  
66. {  
67.     // 参数构造  
68.     ThreadParam Param = ...{0};  
69.     Param.dwFreeLibrary = (DWORD)FreeLibrary;  
70.     Param.dwGetModuleHandle = (DWORD)GetModuleHandleA;  
71.     MoveMemory(Param.szModuleName,szModuleName,MAX_MODULE_NAME_LEN);  
72.       
73.     // 打开指定的进程  
74.     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPid);  
75.     if(hProcess==NULL)  
76.     {   
77.         OutputDebugString(_T("OpenProcess failed!!"));  
78.         return FALSE;  
79.     }  
80.       
81.     // 参数写入  
82.     LPVOID lpParam = NULL;  
83.     lpParam = VirtualAllocEx(hProcess,NULL,sizeof(Param),MEM_COMMIT,PAGE_READWRITE);  
84.     if (lpParam == NULL)  
85.     {  
86.         return FALSE;  
87.     }  
88.       
89.     if (!WriteProcessMemory(hProcess,lpParam,&Param,sizeof(Param),0))  
90.     {  
91.         VirtualFreeEx(hProcess,lpParam,0,MEM_RELEASE);  
92.         return FALSE;  
93.     }  
94.       
95.     // 函数写入  
96.     LPVOID lpThread = NULL;  
97.     lpThread = VirtualAllocEx(hProcess,NULL,0x100,MEM_COMMIT,PAGE_EXECUTE_READWRITE);  
98.     if (lpThread == NULL)  
99.     {  
100.         return FALSE;  
101.     }  
102.       
103.     if (!WriteProcessMemory(hProcess,lpThread,RemoteThreadFun,0x100,0))  
104.     {  
105.         VirtualFreeEx(hProcess,lpThread,0,MEM_RELEASE);  
106.         return FALSE;  
107.     }  
108.       
109.     // 创建线程  
110.     HANDLE hThread = NULL;  
111.     hThread = CreateRemoteThread(hProcess,0,0,(LPTHREAD_START_ROUTINE)lpThread,lpParam,0,NULL);  
112.     if(hThread == NULL)  
113.     {  
114.         return FALSE;  
115.     }  
116.       
117.     // 等待线程结束  
118.     WaitForSingleObject(hThread,INFINITE);  
119.       
120.     // 清理工作  
121.     VirtualFreeEx(hProcess,lpThread,0,MEM_RELEASE);  
122.     VirtualFreeEx(hProcess,lpParam,0,MEM_RELEASE);  
123.     CloseHandle(hProcess);  
124.       
125.     return TRUE;  
126. }  
127. int APIENTRY WinMain(HINSTANCE hInstance,  
128.                      HINSTANCE hPrevInstance,  
129.                      LPSTR     lpCmdLine,  
130.                      int       nCmdShow)  
131. {  
132.     AdjustPurview();  
133.     TCHAR * szModuleName = _T("AcroIEHelper.dll");  
134.     DWORD dwPid = 1128;  
135.     FreeModuleByPid(szModuleName,dwPid);  
136.     return 0;  
137. }