DLL注入模板 - 爱码网

if (pfnThreadRtn == NULL)
__leave;

   // 取得指定进程的所有模块映象.
   hthSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
   if (hthSnapshot == NULL)
    __leave;

   // 取得所有模块列表中的指定的模块.
   BOOL bMoreMods = Module32First(hthSnapshot, &hMod);
   if (bMoreMods == FALSE)
    __leave;

   // 循环取得想要的模块.
   for (;bMoreMods; bMoreMods = Module32Next(hthSnapshot, &hMod))
   {
    if ((strcmp(hMod.szExePath, lpszLibName) == 0) ||
     (strcmp(hMod.szModule, lpszLibName) == 0)){
     break;
    }
   }

   // 创建远程线程来执行FreeLibrary函数.
   hThread = CreateRemoteThread(hProcess,
    NULL,
    0,
    pfnThreadRtn,
    hMod.modBaseAddr,
    0,
    NULL);
   if (hThread == NULL)
    __leave;

   // 等待远程线程终止.
   WaitForSingleObject(hThread, INFINITE);

   bResult=TRUE;

}
__finally
{
   // 关闭句柄.
   if (hThread != NULL)
    CloseHandle(hThread);

   if (hthSnapshot != NULL)
    CloseHandle(hthSnapshot);

   if (hProcess != NULL)
    CloseHandle(hProcess);
}

return bResult;
}

// Injector.h: 函数原型定义.
//
#ifndef _INJECTOR_H_INCLUDED
#define _INJECTOR_H_INCLUDED

BOOL WINAPI LoadLib(DWORD dwProcessId, LPTSTR lpszLibName);
BOOL WINAPI FreeLib(DWORD dwProcessId, LPTSTR lpszLibName);

#endif