卸载远线程中被注入的dll

最新推荐文章于 2018-01-22 02:33:54 发布

原创最新推荐文章于 2018-01-22 02:33:54 发布 · 2.6k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#dll #null #thread #module

进程线程专栏收录该内容

6 篇文章

订阅专栏

本文介绍了一个用于从远程进程中卸载DLL的C语言函数intUninject，并展示了如何使用该函数来实现DLL的卸载。此外，还提供了一个DLLMain函数的例子，用于处理DLL加载过程中的不同阶段。

int Uninject(DWORD pid, char *dll)
{
    HANDLE hProcess = NULL, hThread = NULL, hthSnapshot = NULL;
    MODULEENTRY32 hMod = {sizeof(hMod)};

    hthSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pid);
    if (hthSnapshot == NULL)
    {
        return 0;
    }

    BOOL bMoreMods = Module32First(hthSnapshot, &hMod);
    if (bMoreMods == FALSE)
    {
        return FALSE;
    }

    for (;bMoreMods; bMoreMods = Module32Next(hthSnapshot, &hMod))
    {
        if ((!stricmp(hMod.szExePath, dll))||(!stricmp(hMod.szModule,dll)))
        {
            hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION, FALSE, pid);
            if (hProcess == NULL)
            {
                return 0;
            }


            PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("Kernel32.dll"), "FreeLibrary");

            if (pfnThreadRtn == NULL)
            {
                return 0;
            }


            hThread = CreateRemoteThread(hProcess,NULL,0,pfnThreadRtn,hMod.modBaseAddr,0,NULL);

            if (hThread == NULL)
            {
                return 0;
            }

            WaitForSingleObject(hThread, INFINITE);
            CloseHandle(hThread);
            CloseHandle(hthSnapshot);
            CloseHandle(hProcess);
        }
    }
    return 1;
}

结果就是，应用程序出错，呵呵，变相卸载。：（

再贴出我的DLLMAIN，

BOOL APIENTRY DllMain( HANDLE hModule,
                      DWORD  ul_reason_for_call,
                      LPVOID lpReserved
                      )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        hXDll = hModule;
        CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)GetControlHostandPort,NULL,0,NULL);
        CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)StartXBShell_Main,(LPVOID)0,0,NULL);
        CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)StartXBShell_Main,(LPVOID)1,0,NULL);
        break;

    case DLL_THREAD_ATTACH:
        break;
    case DLL_THREAD_DETACH:
        break;
    case DLL_PROCESS_DETACH:
        //FreeLibraryAndExitThread((HINSTANCE)hXDll,0);
        //FreeLibrary((HINSTANCE)hXDll);
#endif
        break;
    }

    return TRUE;
}