远程加载与卸载DLL

DWORD GetProcessIdByName(LPCTSTR szProcess)//注意要加exe后缀 { DWORD dwRet=0; HANDLE hSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); PROCESSENTRY32 pe32; pe32.dwSize=sizeof(PROCESSENTRY32); Process32First(hSnapshot,&pe32); do { if (_tcscmp(pe32.szExeFile,szProcess)==0) { dwRet=pe32.th32ProcessID; break; } } while (Process32Next(hSnapshot,&pe32)); CloseHandle(hSnapshot); return dwRet; }BOOL Inject(LPCTSTR szModule, DWORD dwID) { HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwID); if ( !hProcess ) { return FALSE; } int cByte = (_tcslen(szModule)+1) * sizeof(TCHAR); LPVOID pAddr = VirtualAllocEx(hProcess, NULL, cByte, MEM_COMMIT, PAGE_READWRITE); if ( !pAddr || !WriteProcessMemory(hProcess, pAddr, szModule, cByte, NULL)) { return FALSE; } #ifdef _UNICODE PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(_T("Kernel32")), "LoadLibraryW"); #else PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(_T("Kernel32")), "LoadLibraryA"); #endif //Kernel32.dll总是被映射到相同的地址 if ( !pfnStartAddr ) { return FALSE; } DWORD dwThreadID = 0; HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, pfnStartAddr, pAddr, 0, &dwThreadID); if ( !hRemoteThread ) { return FALSE; } WaitForSingleObject(hRemoteThread,INFINITE); VirtualFreeEx(hProcess,pAddr,cByte,MEM_COMMIT); CloseHandle(hRemoteThread); CloseHandle(hProcess); return TRUE; }

简单提权函数

BOOL EnablePrivilege(LPCTSTR lpszPrivilegeName, BOOL bEnable) { HANDLE hToken = NULL; TOKEN_PRIVILEGES tp; LUID luid; if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY | TOKEN_READ, &hToken)) return FALSE; if(!LookupPrivilegeValue(NULL, lpszPrivilegeName, &luid)) return TRUE; tp.PrivilegeCount = 1; tp.Privileges[0].Luid = luid; tp.Privileges[0].Attributes = (bEnable) ? SE_PRIVILEGE_ENABLED : 0; AdjustTokenPrivileges(hToken, FALSE, &tp, NULL, NULL, NULL); CloseHandle(hToken); return (GetLastError() == ERROR_SUCCESS); }

BOOL UnLoadDll(LPCTSTR szDllName, DWORD dwID)//要卸载的DLL名，进程PID { HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwID); if ( !hProcess ) { return FALSE; } int cByte = (_tcslen(szDllName)+1) * sizeof(TCHAR); LPVOID pAddr = VirtualAllocEx(hProcess, NULL, cByte, MEM_COMMIT, PAGE_READWRITE); if ( !pAddr || !WriteProcessMemory(hProcess, pAddr, szDllName, cByte, NULL)) { return FALSE; } #ifdef _UNICODE PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)GetModuleHandleW; #else PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)GetModuleHandleA; #endif //Kernel32.dll总是被映射到相同的地址 if ( !pfnStartAddr ) { return FALSE; } DWORD dwThreadID = 0,dwFreeId=0,dwHandle; HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, pfnStartAddr, pAddr, 0, &dwThreadID); if ( !hRemoteThread ) { return FALSE; } WaitForSingleObject(hRemoteThread,INFINITE); // 获得GetModuleHandle的返回值 GetExitCodeThread(hRemoteThread,&dwHandle); CloseHandle(hRemoteThread); // 使目标进程调用FreeLibrary，卸载DLL #ifdef _UNICODE PTHREAD_START_ROUTINE pfnFreeAddr = (PTHREAD_START_ROUTINE)FreeLibrary; #else PTHREAD_START_ROUTINE pfnFreeAddr = (PTHREAD_START_ROUTINE)FreeLibrary; #endif HANDLE hFreeThread = CreateRemoteThread(hProcess, NULL, 0, pfnFreeAddr,(LPVOID)dwHandle,0,&dwFreeId); if ( !hFreeThread ) { return FALSE; } WaitForSingleObject(hFreeThread,INFINITE); VirtualFreeEx(hProcess,pAddr,cByte,MEM_COMMIT); CloseHandle(hFreeThread); CloseHandle(hProcess); return TRUE; }