如何卸载其它进程中加载的指定DLL

如何卸载其它进程中加载的指定DLL

2008-02-17 12:46

#include <tlhelp32.h>
void __fastcall UnLoadDll(String str_proce, String str_dllname)
{

AnsiString tmpstr="";
PROCESSENTRY32 pinfo;
pinfo.dwSize = sizeof(pinfo);
DWORD dw_pid=0;
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if(snapshot == NULL)
return;
bool flag = Process32First(snapshot,&pinfo);
while(flag)
{

tmpstr=AnsiString(pinfo.szExeFile) ;
if((ExtractFileName(tmpstr)).UpperCase()==str_proce.UpperCase() )
{
dw_pid=pinfo.th32ProcessID ;
break;
}
flag = Process32Next(snapshot,&pinfo);
}
CloseHandle(snapshot);

if (dw_pid == NULL)
{
::MessageBox(NULL, "Process not found", "", 0);
return;
}

DWORD dwHandle = 0;
HANDLE hProcess1 = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,FALSE, dw_pid) ;
if (!hProcess1)
return ;

// 向目标进程地址空间写入DLL名称
DWORD dwSize, dwWritten;
dwSize = str_dllname.Length() + 1;
LPVOID lpBuf = VirtualAllocEx( hProcess1, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE );

if ( !WriteProcessMemory( hProcess1, lpBuf, (LPVOID)str_dllname.c_str(), dwSize, &dwWritten ) )
{
VirtualFreeEx( hProcess1, lpBuf, dwSize, MEM_DECOMMIT );
CloseHandle( hProcess1 );
return;
}

LPVOID pFun = GetProcAddress(GetModuleHandle("Kernel32"), "GetModuleHandleA");//GetModuleHandleA;
HANDLE hThread = CreateRemoteThread( hProcess1, NULL, 0,(LPTHREAD_START_ROUTINE)pFun,
lpBuf , 0, NULL);
if (hThread == NULL)
{
CloseHandle(hProcess1);
return ;
}
// 等待GetModuleHandle运行完毕
WaitForSingleObject( hThread, INFINITE );
// 获得GetModuleHandle的返回值
GetExitCodeThread( hThread, &dwHandle );

// 释放目标进程中申请的空间
VirtualFreeEx( hProcess1, lpBuf, dwSize, MEM_DECOMMIT );
CloseHandle(hThread);
// 使目标进程调用FreeLibrary，卸载DLL
pFun = GetProcAddress(GetModuleHandle("Kernel32"), "FreeLibrary");
hThread =CreateRemoteThread( hProcess1, NULL, 0, (LPTHREAD_START_ROUTINE)pFun,(LPVOID)dwHandle, 0, NULL);
// 等待FreeLibrary卸载完毕
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
CloseHandle(hProcess1);
}
//
void __fastcall TForm1::Button1Click(TObject *Sender)
{
UnLoadDll("iexplore.exe", "C:/SOFTFI~1/IS/BhoPlugin.dll");
}