远程线程注入和卸载DLL

来源：互联网发布：java判断是不是小数编辑：程序博客网时间：2024/05/22 15:12

########################################################################

/** 在远程进程中搜索模块句柄*/HMODULE FindRemoteMod(HANDLE hProcess, const wchar_t * pszModShortName){     HMODULE _hModules [0x100] = {0};    int _cbNeeded = 0;     if (!EnumProcessModules(hProcess                    , _hModules                    , sizeof(_hModules)                    , (unsigned long *)&_cbNeeded))         return (HMODULE)0;            for (int _i = 0; _i < (_cbNeeded >>2); _i ++)     {         wchar_t _szModuleName [0x200] = {0};         GetModuleBaseNameW(hProcess                    , _hModules[_i]                    , _szModuleName                    , sizeof(_szModuleName)/sizeof(_szModuleName[0]));            if (!wcsicmp(_szModuleName, pszModShortName))             return _hModules[_i];     }     return (HMODULE)0;}

########################################################################

/** 卸载远程dll*/BOOL UnloadDll(unsigned long pid, const wchar_t * dllname){     // 打开进程，具备写入权限和创建线程权限     HANDLE hProcess = OpenProcess(PROCESS_VM_READ                         | PROCESS_VM_WRITE                         | PROCESS_VM_OPERATION                         | PROCESS_SUSPEND_RESUME                         | PROCESS_CREATE_THREAD                         | PROCESS_QUERY_INFORMATION                        , FALSE                        , pid);     if (NULL == hProcess)         return FALSE;     // 检查是否是同一个用户会话中的进程    HANDLE _hToken = INVALID_HANDLE_VALUE;     if (!OpenProcessToken(hProcess, TOKEN_READ, &_hToken))     {        CloseHandle(hProcess);        return FALSE;     }     CloseHandle(_hToken);         HMODULE _hDllModule = CheckDllLoaded(hProcess, dllname);         if (_hDllModule != 0)     {         // 以FreeLibrary为线程体创建线程，卸载目标进程中的特定DLL.         unsigned long _tid = 0;         CreateRemoteThread(hProcess        , 0, 0        , (LPTHREAD_START_ROUTINE)FreeLibrary        , _hDllModule        , 0        , &_tid);     }     CloseHandle(hProcess); hProcess=0;    return TRUE;}

########################################################################

/** 加载dll到远程进程*/BOOL LoadDll(HANDLE hProcess, const wchar_t * dllpath){     // 计算路径长度，分配远程进程空间内虚拟内存    DWORD dwRemoteBufLength = (wcslen(dllpath)+1)*sizeof(wchar_t);         // 在目标进程中分配一点空间来存放LoadLibraryW的参数         wchar_t * _pBuf =(wchar_t * )VirtualAllocEx(hProcess                                            , NULL                                            , dwRemoteBufLength                                            , MEM_COMMIT                                            , PAGE_READWRITE);     if(!_pBuf)         return FALSE;         // 把dll的全路径写入到远程进程地址空间    if(!(WriteProcessMemory(hProcess                        ,_pBuf                        ,(PVOID)dllpath                        ,dwRemoteBufLength                        ,NULL)))        return FALSE;            // 以LoadLibraryW为线程体来创建远程线程    HANDLE _hThread = CreateRemoteThread(hProcess                            , NULL                            , 0                            , (PTHREAD_START_ROUTINE)(LoadLibraryW)                            , (PVOID)_pBuf                            , 0                            , NULL);     // 内存泄漏?!     return (_hThread != INVALID_HANDLE_VALUE);}