利用NtUnmapViewOfSection强制卸载模块

确实可以卸载指定进程指定位置的模块，但有几个问题：
[1] PEB的模块列表中还存在该模块的记录，大部分模块枚举函数都是枚举这个列表
[2] 可能会出现访问异常

看来RING3下是不可能做到强制卸载模块的完美实现，要进ring0才行。下面是测试代码


typedef ULONG (WINAPI *PFNNtUnmapViewOfSection)( IN HANDLE ProcessHandle,IN PVOID BaseAddress );




BOOL UnmapViewOfModule ( DWORD dwProcessId, LPVOID lpBaseAddr )




...{


HMODULE hModule = GetModuleHandle ( L"ntdll.dll" ) ;


if ( hModule == NULL )


hModule = LoadLibrary ( L"ntdll.dll" ) ;




PFNNtUnmapViewOfSection pfnNtUnmapViewOfSection = (PFNNtUnmapViewOfSection)GetProcAddress ( hModule, "NtUnmapViewOfSection" ) ;




HANDLE hProcess = OpenProcess ( PROCESS_ALL_ACCESS, TRUE, dwProcessId ) ;


ULONG ret = pfnNtUnmapViewOfSection ( hProcess, lpBaseAddr ) ;


CloseHandle ( hProcess ) ;


return ret ? false : true ;


}