[转]强制卸载目标进程模块

http://blog.csdn.net/qq752923276/article/details/7333835

代码来源于网络，卸载模块后通过查询PEB得到进程信息的程序没有得到更新，（如：Windows优化大师和360的进程查看），可以通过冰刃查看。

注：强制卸载可能导致目标进程崩溃。

哈哈，又有了种结束进程的方式，卸载目标进程的ntdll.dll。

下面是代码：

class ForceQuit
{
public:
bool EnablePriv()
{
HANDLE hToken;
if ( OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken) )
{
TOKEN_PRIVILEGES tkp;

LookupPrivilegeValue( NULL,SE_DEBUG_NAME,&tkp.Privileges[0].Luid );//修改进程权限
tkp.PrivilegeCount=1;
tkp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges( hToken,FALSE,&tkp,sizeof tkp,NULL,NULL );//通知系统修改进程权限

return( (GetLastError()==ERROR_SUCCESS) );
}
return false;
}
bool GetProcessIdByName(LPSTR lpProcessName,LPDWORD lpdwPID)
{
HANDLE hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
assert(hSnap!=INVALID_HANDLE_VALUE);
PROCESSENTRY32 pt32;
pt32.dwSize=sizeof pt32;
bool result=false;
if (Process32First(hSnap,&pt32))
{
do
{
if (!lstrcmpi(pt32.szExeFile,lpProcessName))
{
*lpdwPID=pt32.th32ProcessID;
result=true;
break;
}
}while (Process32Next(hSnap,&pt32));
}
CloseHandle(hSnap);
return result;
}
bool GetModuleBaseAddrByPID(DWORD dwProcessID,LPSTR lpDllName,LPDWORD lpdwBaseAddr)
{
HANDLE hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,dwProcessID);
assert(hSnap!=INVALID_HANDLE_VALUE);
MODULEENTRY32 md32;
md32.dwSize=sizeof md32;
bool result=false;
if(Module32First(hSnap,&md32))
{
do
{
if(!lstrcmpiA(lpDllName,md32.szModule))
{
*lpdwBaseAddr=(DWORD)md32.modBaseAddr;
result=true;
break;
}
}
while(Module32Next(hSnap,&md32));
}
CloseHandle(hSnap);
return result;
}

bool Execute(LPSTR lpProcessName,LPSTR lpDllName)
{
typedef DWORD (_stdcall *XXXNtUnmapViewOfSection)( HANDLE hProcess, PVOID Address);

PVOID   NtdllAddress;
HANDLE   hProcess;

DWORD dwProcessID;
EnablePriv();
if(GetProcessIdByName(lpProcessName,&dwProcessID))
{
hProcess = OpenProcess( PROCESS_VM_OPERATION, FALSE, dwProcessID);
assert(hProcess!=NULL);
XXXNtUnmapViewOfSection  NtUnmapViewOfSection = (XXXNtUnmapViewOfSection)GetProcAddress(LoadLibraryA("ntdll.dll"), "NtUnmapViewOfSection" );
assert(NtUnmapViewOfSection!=NULL);
NtdllAddress = (PVOID)NtUnmapViewOfSection;

DWORD moduleBaseAddr;
if(GetModuleBaseAddrByPID(dwProcessID,lpDllName,&moduleBaseAddr))
NtUnmapViewOfSection( hProcess,(PVOID)moduleBaseAddr);

CloseHandle( hProcess );
return true;
}
return false;
}
};

　　调用：

ForceQuit quit;

quit.EnablePriv();

quit.Execute(DestProcessName,DestModuleName);