获取指定进程模块handle 然后FreeLibrary掉

1.  // 使目标进程调用GetModuleHandle，获得DLL在目标进程中的句柄   
   2. DWORD dwHandle, dwID;   
   3. LPVOID pFunc = GetModuleHandleA;   
   4. HANDLE hThread = CreateRemoteThread( hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, lpBuf, 0, &dwID );   
   5. // 等待GetModuleHandle运行完毕   
   6. WaitForSingleObject( hThread, INFINITE );   
   7. // 获得GetModuleHandle的返回值   
   8. GetExitCodeThread( hThread, &dwHandle );   
   9. // 释放目标进程中申请的空间   
  10. VirtualFreeEx( hProcess, lpBuf, dwSize, MEM_DECOMMIT );   
  11. CloseHandle( hThread );   
  12. // 使目标进程调用FreeLibrary，卸载DLL   
  13. pFunc = FreeLibrary;   
  14. hThread = CreateRemoteThread( hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFunc, (LPVOID)dwHandle, 0, &dwID );   
  15. // 等待FreeLibrary卸载完毕   
  16. WaitForSingleObject( hThread, INFINITE );   
  17. CloseHandle( hThread );   
  18. CloseHandle( hProcess );