在进程空间释放注入的DLL

// 在进程空间释放注入的DLL.
BOOL WINAPI FreeLib(DWORD dwProcessId, LPTSTR lpszLibName)
{
BOOL    bResult      = FALSE;
HANDLE hProcess     = NULL;
HANDLE hThread      = NULL;
HANDLE hthSnapshot = NULL;
MODULEENTRY32 hMod = {sizeof(hMod)};

__try
{
   // 打开进程.
   hProcess = OpenProcess(
    PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION,
    FALSE,
    dwProcessId
    );
 
   if (hProcess == NULL)
    __leave;

   // 取得FreeLibrary函数在Kernel32.dll中的地址.
   PTHREAD_START_ROUTINE pfnThreadRtn =
    (PTHREAD_START_ROUTINE)GetProcAddress(
    GetModuleHandle("Kernel32.dll"), "FreeLibrary");

   if (pfnThreadRtn == NULL)
    __leave;

   // 取得指定进程的所有模块映象.
   hthSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
   if (hthSnapshot == NULL)
    __leave;
 
   // 取得所有模块列表中的指定的模块.
   BOOL bMoreMods = Module32First(hthSnapshot, &hMod);
   if (bMoreMods == FALSE)
    __leave;
 
   // 循环取得想要的模块.
   for (;bMoreMods; bMoreMods = Module32Next(hthSnapshot, &hMod))
   {
    if ((strcmp(hMod.szExePath, lpszLibName) == 0) ||
     (strcmp(hMod.szModule, lpszLibName) == 0)){
     break;
    }
   }
 
   // 创建远程线程来执行FreeLibrary函数.
   hThread = CreateRemoteThread(hProcess,
    NULL,
    0,
    pfnThreadRtn,
    hMod.modBaseAddr,
    0,
    NULL);
   if (hThread == NULL)
    __leave;
 
   // 等待远程线程终止.
   WaitForSingleObject(hThread, INFINITE);
 
   bResult=TRUE;
 
}
__finally
{
   // 关闭句柄.
   if (hThread != NULL)
    CloseHandle(hThread);

   if (hthSnapshot   != NULL)
    CloseHandle(hthSnapshot);
 
   if (hProcess   != NULL)
    CloseHandle(hProcess);
}

return bResult;
}