卸载dll无效 about wxhelper HOT 5 CLOSED

if (!dPid) {
	return 0;
}

snapMod = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dPid);
me32.dwSize = sizeof(tagMODULEENTRY32W);
if (Module32FirstW(snapMod, &me32))
{
	while (wcscmp(wDllName, me32.szModule))
	{
		if (!Module32NextW(snapMod, &me32))
			goto error;
	}
	CloseHandle(snapMod);
	result = me32.hModule;
}
else
{
error:
	CloseHandle(snapMod);
	result = 0;
}
return result;

dwPid = GetPIDForProcess(szPName);
ulDllLength = wcslen(szDllPath) + 1;
hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, dwPid);
if (!hProcess) {
	return 0;
}

lpRemoteDllBase = VirtualAllocEx(hProcess, NULL, ulDllLength, MEM_COMMIT, PAGE_READWRITE);
if (lpRemoteDllBase)
{
	if (WriteProcessMemory(hProcess, lpRemoteDllBase, szDllPath, ulDllLength, NULL)
		&& (hKernelModule = GetModuleHandleW(L"kernel32.dll")) != 0
		&& (lpSysLibAddr = (LPTHREAD_START_ROUTINE)GetProcAddress(hKernelModule, "LoadLibraryW")) != 0
		&& (hRemoteThread = CreateRemoteThread(hProcess, NULL, 0, lpSysLibAddr, lpRemoteDllBase, 0, NULL)) != 0)
	{
		WaitForSingleObject(hRemoteThread, INFINITE);
		VirtualFreeEx(hProcess, lpRemoteDllBase, ulDllLength, MEM_DECOMMIT | MEM_RELEASE);
		CloseHandle(hRemoteThread);
		CloseHandle(hProcess);
		OutputDebugStringA("[DBG] dll inject success");
		result = 1;
	}
	else
	{
		VirtualFreeEx(hProcess, lpRemoteDllBase, ulDllLength, MEM_DECOMMIT | MEM_RELEASE);
		CloseHandle(hProcess);
		result = 0;
	}
}
else
{
	CloseHandle(hProcess);
	result = 0;
}
return result;

dwPID = GetPIDForProcess(szPName);
hProcess = OpenProcess(0x1FFFFFu, 0, dwPID);
if (!hProcess) {
	return 0;
}

hK32 = GetModuleHandleW(L"Kernel32.dll");
if (!hK32) {
	return 0;
}

lpFreeLibAddr = (LPTHREAD_START_ROUTINE)GetProcAddress(hK32, "FreeLibraryAndExitThread");
hDll = GetDLLHandle(szDName, dwPID);
if (hDll && CreateRemoteThread(hProcess, 0, 0, lpFreeLibAddr, hDll, 0, 0)) {
	return 1;
}

CloseHandle(hProcess);
return 0;