#include <stdio.h>
\n#include <stdlib.h>
\n#include <conio.h>
\n#include <string.h>
\n#include <windows.h>
\n#include <tlhelp32.h><\/p>\n
bool Privilege()
\n{
\n \/\/\u63d0\u5347\u5f53\u524d\u8fdb\u7a0b\u7684\u8bbf\u95ee\u4ee4\u724c
\n HANDLE hToken=NULL;
\n
\n if(OpenProcessToken(GetCurrentProcess(),TOKEN_ALL_ACCESS,&hToken)!=TRUE) return false;
\n TOKEN_PRIVILEGES tp;
\n tp.PrivilegeCount=1;
\n LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tp.Privileges[0].Luid);
\n tp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
\n AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,NULL);
\n
\n CloseHandle(hToken);
\n return true;
\n}<\/p>\n
bool ListProcess()
\n{
\n HANDLE hProcessSnapshot;
\n PROCESSENTRY32 pe32;
\n pe32.dwSize=sizeof(PROCESSENTRY32);<\/p>\n
if(!Privilege())
\n printf(“\u63d0\u5347\u8fdb\u7a0b\u8bbf\u95ee\u4ee4\u724c\u6743\u9650\u5931\u8d25\u3002\\n”);<\/p>\n
if((hProcessSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL))==INVALID_HANDLE_VALUE)
\n {
\n CloseHandle(hProcessSnapshot);
\n printf(“\u521b\u5efa\u8fdb\u7a0b\u5feb\u7167\u5931\u8d25\u3002\\n”);
\n return false;
\n }
\n if(!Process32First(hProcessSnapshot,&pe32))
\n {
\n printf(“\u5217\u4e3e\u8fdb\u7a0b\u5217\u8868\u5931\u8d25\u3002\\n”);
\n return false;
\n }
\n do
\n {
\n printf(“FileName:%s\\t\\t\\tPID:%d\\n”,pe32.szExeFile,pe32.th32ProcessID);
\n } while (Process32Next(hProcessSnapshot,&pe32));
\n CloseHandle(hProcessSnapshot);<\/p>\n
return true;
\n}<\/p>\n
bool ListModule(int pid)
\n{
\n int ID=0;
\n HANDLE hModuleSnapshot;
\n MODULEENTRY32 me32;
\n me32.dwSize=sizeof(MODULEENTRY32);<\/p>\n
if((hModuleSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pid))==INVALID_HANDLE_VALUE)
\n {
\n CloseHandle(hModuleSnapshot);
\n printf(“\u521b\u5efa\u8fdb\u7a0b\u6a21\u5757\u5feb\u7167\u5931\u8d25\u3002\\n”);
\n return false;
\n }
\n Module32First(hModuleSnapshot,&me32);
\n do
\n {
\n ID++;
\n printf(“%s\\t\\t\\tID:%d\\n”,me32.szExePath,ID);
\n } while (Module32Next(hModuleSnapshot,&me32));
\n CloseHandle(hModuleSnapshot);<\/p>\n
return true;
\n}<\/p>\n
bool UnloadDLL(int pid,int module_id)
\n{
\n int ID=0;
\n HANDLE hModuleSnapshot;
\n HANDLE hRemoteProcess;
\n MODULEENTRY32 me32;
\n me32.dwSize=sizeof(MODULEENTRY32);
\n
\n if((hModuleSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pid))==INVALID_HANDLE_VALUE)
\n {
\n CloseHandle(hModuleSnapshot);
\n printf(“\u521b\u5efa\u8fdb\u7a0b\u6a21\u5757\u5feb\u7167\u5931\u8d25\u3002\\n”);
\n return false;
\n }
\n Module32First(hModuleSnapshot,&me32);
\n do
\n {
\n ID++;
\n if(ID==module_id) break;
\n } while (Module32Next(hModuleSnapshot,&me32));
\n CloseHandle(hModuleSnapshot);
\n if(ID!=module_id) return false;<\/p>\n
if((hRemoteProcess=OpenProcess(PROCESS_ALL_ACCESS,false,pid))==INVALID_HANDLE_VALUE)
\n {
\n CloseHandle(hRemoteProcess);
\n printf(“\u6253\u5f00\u8fdb\u7a0b\u5931\u8d25\u3002\\n”);
\n return false;
\n }
\n LPTHREAD_START_ROUTINE pFunAddr=(LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(“kernel32.dll”),”FreeLibrary”);
\n if(pFunAddr==NULL)
\n {
\n CloseHandle(hRemoteProcess);
\n printf(“\u83b7\u53d6\u51fd\u6570\u5730\u5740\u5931\u8d25\u3002\\n”);
\n return false;
\n }
\n HANDLE hThread=CreateRemoteThread(hRemoteProcess,NULL,0,pFunAddr,me32.hModule,0,NULL);
\n if(hThread==INVALID_HANDLE_VALUE)
\n {
\n CloseHandle(hRemoteProcess);
\n CloseHandle(hThread);
\n printf(“\u8fdc\u7a0b\u7ebf\u7a0b\u6ce8\u5165\u5931\u8d25\u3002”);
\n return false;
\n }
\n WaitForSingleObject(hThread,INFINITE);
\n CloseHandle(hThread);
\n CloseHandle(hRemoteProcess);<\/p>\n
return true;
\n}<\/p>\n
int main(int argc,char *argv[])
\n{
\n int pid;
\n int ModuleID;<\/p>\n
again:
\n if(!ListProcess())
\n {
\n printf(“\u5217\u4e3e\u8fdb\u7a0b\u5931\u8d25\u3002\\n”);
\n getch();
\n return -1;
\n }
\n printf(“\u8bf7\u9009\u62e9\u4e00\u4e2a\u8fdb\u7a0bPID:”);
\n if(scanf(“%d”,&pid)!=1) return -1;
\n if(!ListModule(pid))
\n {
\n printf(“\u5217\u4e3e\u8fdb\u7a0b\u6a21\u5757\u5931\u8d25\u3002\\n”);
\n getch();
\n return -1;
\n }
\n printf(“\u8bf7\u9009\u62e9\u8981\u5378\u8f7d\u7684ID:”);
\n if(scanf(“%d”,&ModuleID)!=1) return -1;
\n if(!UnloadDLL(pid,ModuleID))
\n {
\n printf(“\u5378\u8f7d\u6a21\u5757\u5931\u8d25\u3002\\n”);
\n getch();
\n return -1;
\n }
\n printf(“\u6a21\u5757\u5378\u8f7d\u6210\u529f\u3002\\n”);
\n getch();
\n goto again;<\/p>\n
return 0;
\n}<\/p>\n","protected":false},"excerpt":{"rendered":"
#include <stdio.h>
\n#include <stdlib.h>
\n#include <conio.h>
\n#include <string.h>
\n#include <windows.h>
\n#include <tlhelp32.h><\/p>\n
bool Privilege()
\n{
\n …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[324],"tags":[],"class_list":["post-42","post","type-post","status-publish","format-standard","hentry"],"yoast_head":"\n