如何卸载其它进程中加载的指定DLL

如何卸载其它进程中加载的指定DLL

2008-02-17 12:46

#include <tlhelp32.h> void __fastcall UnLoadDll(String str_proce, String str_dllname) { AnsiString tmpstr=""; PROCESSENTRY32 pinfo; pinfo.dwSize = sizeof(pinfo); DWORD dw_pid=0; HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); if(snapshot == NULL) return; bool flag = Process32First(snapshot,&pinfo); while(flag) { tmpstr=AnsiString(pinfo.szExeFile) ; if((ExtractFileName(tmpstr)).UpperCase()==str_proce.UpperCase() ) { dw_pid=pinfo.th32ProcessID ; break; } flag = Process32Next(snapshot,&pinfo); } CloseHandle(snapshot); if (dw_pid == NULL) { ::MessageBox(NULL, "Process not found", "", 0); return; } DWORD dwHandle = 0; HANDLE hProcess1 = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,FALSE, dw_pid) ; if (!hProcess1) return ; // 向目标进程地址空间写入DLL名称 DWORD dwSize, dwWritten; dwSize = str_dllname.Length() + 1; LPVOID lpBuf = VirtualAllocEx( hProcess1, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE ); if ( !WriteProcessMemory( hProcess1, lpBuf, (LPVOID)str_dllname.c_str(), dwSize, &dwWritten ) ) { VirtualFreeEx( hProcess1, lpBuf, dwSize, MEM_DECOMMIT ); CloseHandle( hProcess1 ); return; } LPVOID pFun = GetProcAddress(GetModuleHandle("Kernel32"), "GetModuleHandleA");//GetModuleHandleA; HANDLE hThread = CreateRemoteThread( hProcess1, NULL, 0,(LPTHREAD_START_ROUTINE)pFun, lpBuf , 0, NULL); if (hThread == NULL) { CloseHandle(hProcess1); return ; } // 等待GetModuleHandle运行完毕 WaitForSingleObject( hThread, INFINITE ); // 获得GetModuleHandle的返回值 GetExitCodeThread( hThread, &dwHandle ); // 释放目标进程中申请的空间 VirtualFreeEx( hProcess1, lpBuf, dwSize, MEM_DECOMMIT ); CloseHandle(hThread); // 使目标进程调用FreeLibrary，卸载DLL pFun = GetProcAddress(GetModuleHandle("Kernel32"), "FreeLibrary"); hThread =CreateRemoteThread( hProcess1, NULL, 0, (LPTHREAD_START_ROUTINE)pFun,(LPVOID)dwHandle, 0, NULL); // 等待FreeLibrary卸载完毕 WaitForSingleObject(hThread, INFINITE); CloseHandle(hThread); CloseHandle(hProcess1); } // void __fastcall TForm1::Button1Click(TObject *Sender) { UnLoadDll("iexplore.exe", "C:/SOFTFI~1/IS/BhoPlugin.dll"); }