DLL遠程注入與卸載(C++)

以下提供兩個函數，分別用於向其它進程注入和卸載指定DLL模塊。支持Unicode編碼。

//----------------------------------------------------------------------------------------------------------- // 函數: InjectDll // 功能: 向目標進程中注入一個指定 Dll 模塊文件. // 參數: [in] const TCHAR* ptszDllFile - Dll 文件名及路徑 // [in] DWORD dwProcessId - 目標進程 ID // 返回: bool - 注入成功返回 true, 注入失敗則返回 false. // 說明: 採用遠程線程注入技術實現 //----------------------------------------------------------------------------------------------------------- bool InjectDll(const TCHAR* ptszDllFile, DWORD dwProcessId) { // 參數無效 if (NULL == ptszDllFile || 0 == ::_tcslen(ptszDllFile)) { return false; } // 指定 Dll 文件不存在 if (-1 == _taccess(ptszDllFile, 0)) { return false; } HANDLE hProcess = NULL; HANDLE hThread = NULL; DWORD dwSize = 0; TCHAR* ptszRemoteBuf = NULL; LPTHREAD_START_ROUTINE lpThreadFun = NULL; // 獲取目標進程句柄 hProcess = ::OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, dwProcessId); if (NULL == hProcess) { return false; } // 在目標進程中分配內存空間 dwSize = (DWORD)::_tcslen(ptszDllFile) + 1; ptszRemoteBuf = (TCHAR*)::VirtualAllocEx(hProcess, NULL, dwSize * sizeof(TCHAR), MEM_COMMIT, PAGE_READWRITE); if (NULL == ptszRemoteBuf) { ::CloseHandle(hProcess); return false; } // 在目標進程的內存空間中寫入所需參數(模塊名) if (FALSE == ::WriteProcessMemory(hProcess, ptszRemoteBuf, (LPVOID)ptszDllFile, dwSize * sizeof(TCHAR), NULL)) { ::VirtualFreeEx(hProcess, ptszRemoteBuf, dwSize, MEM_DECOMMIT); ::CloseHandle(hProcess); return false; } // 從 Kernel32.dll 中獲取 LoadLibrary 函數地址 #ifdef _UNICODE lpThreadFun = (PTHREAD_START_ROUTINE)::GetProcAddress(::GetModuleHandle(_T("Kernel32")), "LoadLibraryW"); #else lpThreadFun = (PTHREAD_START_ROUTINE)::GetProcAddress(::GetModuleHandle(_T("Kernel32")), "LoadLibraryA"); #endif if (NULL == lpThreadFun) { ::VirtualFreeEx(hProcess, ptszRemoteBuf, dwSize, MEM_DECOMMIT); ::CloseHandle(hProcess); return false; } // 創建遠程線程調用 LoadLibrary hThread = ::CreateRemoteThread(hProcess, NULL, 0, lpThreadFun, ptszRemoteBuf, 0, NULL); if (NULL == hThread) { ::VirtualFreeEx(hProcess, ptszRemoteBuf, dwSize, MEM_DECOMMIT); ::CloseHandle(hProcess); return false; } // 等待遠程線程結束 ::WaitForSingleObject(hThread, INFINITE); // 清理 ::VirtualFreeEx(hProcess, ptszRemoteBuf, dwSize, MEM_DECOMMIT); ::CloseHandle(hThread); ::CloseHandle(hProcess); return true; } //----------------------------------------------------------------------------------------------------------- // 函數: UnInjectDll // 功能: 從目標進程中卸載一個指定 Dll 模塊文件. // 參數: [in] const TCHAR* ptszDllFile - Dll 文件名及路徑 // [in] DWORD dwProcessId - 目標進程 ID // 返回: bool - 卸載成功返回 true, 卸載失敗則返回 false. // 說明: 採用遠程線程注入技術實現 //----------------------------------------------------------------------------------------------------------- bool UnInjectDll(const TCHAR* ptszDllFile, DWORD dwProcessId) { // 參數無效 if (NULL == ptszDllFile || 0 == ::_tcslen(ptszDllFile)) { return false; } HANDLE hModuleSnap = INVALID_HANDLE_VALUE; HANDLE hProcess = NULL; HANDLE hThread = NULL; // 獲取模塊快照 hModuleSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId); if (INVALID_HANDLE_VALUE == hModuleSnap) { return false; } MODULEENTRY32 me32; memset(&me32, 0, sizeof(MODULEENTRY32)); me32.dwSize = sizeof(MODULEENTRY32); // 開始遍歷 if(FALSE == ::Module32First(hModuleSnap, &me32)) { ::CloseHandle(hModuleSnap); return false; } // 遍歷查找指定模塊 bool isFound = false; do { isFound = (0 == ::_tcsicmp(me32.szModule, ptszDllFile) || 0 == ::_tcsicmp(me32.szExePath, ptszDllFile)); if (isFound) // 找到指定模塊 { break; } } while (TRUE == ::Module32Next(hModuleSnap, &me32)); ::CloseHandle(hModuleSnap); if (false == isFound) { return false; } // 獲取目標進程句柄 hProcess = ::OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION, FALSE, dwProcessId); if (NULL == hProcess) { return false; } // 從 Kernel32.dll 中獲取 FreeLibrary 函數地址 LPTHREAD_START_ROUTINE lpThreadFun = (PTHREAD_START_ROUTINE)::GetProcAddress(::GetModuleHandle(_T("Kernel32")), "FreeLibrary"); if (NULL == lpThreadFun) { ::CloseHandle(hProcess); return false; } // 創建遠程線程調用 FreeLibrary hThread = ::CreateRemoteThread(hProcess, NULL, 0, lpThreadFun, me32.modBaseAddr /* 模塊地址 */, 0, NULL); if (NULL == hThread) { ::CloseHandle(hProcess); return false; } // 等待遠程線程結束 ::WaitForSingleObject(hThread, INFINITE); // 清理 ::CloseHandle(hThread); ::CloseHandle(hProcess); return true; }