微软的ImageLoad



PLOADED_IMAGE ImageLoad(
_In_ PSTR DllName,
_In_ PSTR DllPath
);
第一个就是DLL名字第二个是DLL目录

Minimum supported client
Windows XP [desktop apps only]
Minimum supported server
Windows Server 2003 [desktop apps only]
Header
Imagehlp.h
Library
Imagehlp.lib
DLL
Imagehlp.dl

错误返回NULL
正确返回一个结构
结构如下:

typedef struct _LOADED_IMAGE {
PSTR ModuleName;
HANDLE hFile;
PUCHAR MappedAddress;
PIMAGE_NT_HEADERS32 FileHeader;
PIMAGE_SECTION_HEADER LastRvaSection;
ULONG NumberOfSections;
PIMAGE_SECTION_HEADER Sections;
ULONG Characteristics;
BOOLEAN fSystemImage;
BOOLEAN fDOSImage;
BOOLEAN fReadOnly;
UCHAR Version;
LIST_ENTRY Links;
ULONG SizeOfImage;
} LOADED_IMAGE, *PLOADED_IMAGE;
卸载用这个函数。
BOOL ImageUnload(
_In_ PLOADED_IMAGE LoadedImage
);