Обсуждение: _UnloadModule() - Выгрузка dll из чужого процесса!

#include-once
#include <Memory.au3>
#include <WinAPI.au3>
#include <Array.au3>
;#=================================================================================================
;
;__________$$$$$$__________________$$$$$$___________ 
;_______$$$$$$$$________$$$$$_______$$$$$$$$________ 
;_____$$$$$$$$$$$$____$$$$$$$$$____$$$$$$$$$$$______ 
;___$$$$$$$$$$$$$$$__$$$$$$$$$$$__$$$$$$$$$$$$$$____ 
;__$$$$$$$_$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$_$$$$$$$___ 
;__$$$$$____$$$$$$$$$$$$$$$$$$$$$$$$$$$$___$$$$$$___ 
;__$$$$________$$$$$$$$$$$$$$$$$$$$$$$_______$$$$___ 
;___$$$____________$$$$$$$$$$$$$$$___________$$$____ 
;____$$$___________$$$$$$$$$$$$$$$__________$$$_____ 
;____$$$___________$$$$$$$$$$$$$__________$$$______ 
;______$$__________$$$$$$$$$$$$$$__________$$_______ 
;_______$$________$$$$$$$$$$$$$$$_________$$________ 
;________$_________$$$$$$$$$$$$$__________$_________ 
;________$___________$$$$$$$$$$$__________$_________ 
;_______$_____________$$$$$$$$$____________$________ 
;______$_______________$$$$$$$______________$_______ 
;_____$_______________$$$$$$$$$______________$______ 
;____$_____________$$$$$$$____________________$_____ 
;_________________$$$$______________________________ 
;__________________$$_______________________________ 
;__________________$________________________________
;
;By Ganibal95
;==================================================================================================


;#=================================================================================================
;Название функции: _UnloadModule()
;$procidx - пид процесса
;$Mod - Имя длл
;========================By Ganibal95==============================================================
Func _UnloadModule($procidx,$Mod) ; Пид процесса, Имя длл
	Local $err = 0, $return = 0,$hModule = 0
	        $g_aMods = _EnumModules($procidx)
			For $i=0 To UBound($g_aMods) - 1
				if $Mod = $g_aMods[$i][1] Then
				Local $hModule = $g_aMods[$i][0]
				ExitLoop
			    EndIf
		    Next
if $hModule <> 0 Then
			Local $hProcess = _GetProcHandle($procidx)
			If Not $hProcess Then
				$err = 3
			Else
				; get FreeLibrary address and call the remote thread with a pointer to hModule
				Local $kernelidx = _ArraySearch($g_aMods, "kernel32.dll", 0, 0, 0, 0, 1, 1)
				If $kernelidx == -1 Then
					$err = 4
				Else
	                Local $hKernel32 = _WinAPI_LoadLibrary("kernel32.dll")
	                $g_FreeLibrary = _GetProcAddress($hKernel32, "FreeLibrary") - $hKernel32
					$g_LoadLibraryA = _GetProcAddress($hKernel32, "LoadLibraryA") - $hKernel32
	                _WinAPI_FreeLibrary($hKernel32)
					Local $FreeLibrary = $g_aMods[$kernelidx][0] + $g_FreeLibrary ; add offset to base address
					Local $ret = DllCall("kernel32.dll", "ptr", "CreateRemoteThread", "ptr", $hProcess, "ptr", 0, "uint", 0, "ptr", $FreeLibrary, "ptr", $hModule, "dword", 0, "ptr", 0)
					If Not $ret[0] Then
						$err = 4 ; create remote thread failed
					Else
						_WinAPI_WaitForSingleObject($ret[0]) ; wait for thread to finish
						_WinAPI_CloseHandle($ret[0]) ; close thread handle
					EndIf
				EndIf
				_WinAPI_CloseHandle($hProcess)
			EndIf
EndIf
	
	If $err Then $return = 1
	Return SetError($err, 0, $return)
EndFunc

;#=============================================================================================
;Название функции: _InjectModule()
;$procidx - Пид процесса
;$dllpath - Полный путь к длл
;=======================By Ganibal=============================================================
Func _InjectModule($procidx,$dllpath) ;Пид, путь к длл
	Local $err = 0, $hModule = 0
	If StringRight($dllpath, 4) <> ".dll" Then
			$err = 3
	Else			
				Local $hProcess = _GetProcHandle($procidx)
				If Not $hProcess Then
					$err = 4
				Else
					; allocate memory in remote process for dll path
					Local $pMem = _MemVirtualAllocEx($hProcess, 0, 260, $MEM_COMMIT, $PAGE_READWRITE)
					If Not $pMem Then
						$err = 5
					Else
						; write dll path to remote process
						Local $ret = DllCall("kernel32.dll", "int", "WriteProcessMemory", "ptr", $hProcess, "ptr", $pMem, "str", $dllpath, "uint", 260, "uint*", 0)
						If $ret[5] <> 260 Then
							$err = 6
						Else
							; get LoadLibraryA address and call the remote thread with a pointer to the dll path
							$g_aMods = _EnumModules($procidx)
							Local $kernelidx = _ArraySearch($g_aMods, "kernel32.dll", 0, 0, 0, 0, 1, 1)
							If $kernelidx == -1 Then
								$err = 7
							Else
								$hKernel32 = _WinAPI_LoadLibrary("kernel32.dll")
								$g_LoadLibraryA = _GetProcAddress($hKernel32, "LoadLibraryA") - $hKernel32
								_WinAPI_FreeLibrary($hKernel32)
								Local $LoadLibraryA = $g_aMods[$kernelidx][0] + $g_LoadLibraryA ; add offset to base address
								$ret = DllCall("kernel32.dll", "ptr", "CreateRemoteThread", "ptr", $hProcess, "ptr", 0, "uint", 0, "ptr", $LoadLibraryA, "ptr", $pMem, "dword", 0, "ptr", 0)
								If Not $ret[0] Then
									$err = 8 ; create remote thread failed
								Else
									Local $hThread = $ret[0]
									_WinAPI_WaitForSingleObject($hThread) ; wait for thread to finish
									; get thread return value, which is the HMODULE (base address) of the injected dll
									$ret = DllCall("kernel32.dll", "int", "GetExitCodeThread", "ptr", $hThread, "dword*", 0)
									$hModule = Ptr($ret[2])
									_WinAPI_CloseHandle($hThread) ; close thread handle
								EndIf
							EndIf
						EndIf
						_MemVirtualFreeEx($hProcess, $pMem, 260, $MEM_DECOMMIT) ; release memory for dll path
					EndIf
					_WinAPI_CloseHandle($hProcess)
				EndIf
			EndIf
	
	Return SetError($err, 0, $hModule)
EndFunc

Func _GetProcAddress($module, $function)
	Local $call = DllCall("kernel32.dll", "ptr", "GetProcAddress", "ptr", $module, "str", $function)
	Return $call[0]
EndFunc

Func _EnumModules($process)
	; enumerate all modules in a process
	Local $aMods
	Local $hProcess = _GetProcHandle($process)
	If $hProcess Then
		Local $modules = DllStructCreate("ptr[1024]")
		Global $PSAPI = DllOpen("psapi.dll")
		Local $ret = DllCall($PSAPI, "int", "EnumProcessModules", "ptr", $hProcess, "ptr", DllStructGetPtr($modules), "dword", DllStructGetSize($modules), "dword*", 0)
		If $ret[4] > 0 Then
			Local $nummods = $ret[4] / 4
			Local $aMods[$nummods][3]
			For $i = 1 To $nummods
				$aMods[$i - 1][0] = DllStructGetData($modules, 1, $i) ; base address
				$aMods[$i - 1][1] = "n/a" ; module name
				$aMods[$i - 1][2] = "n/a" ; module path
				Local $name = _GetModuleBaseNameW($hProcess, Ptr($aMods[$i - 1][0]))
				If $name Then $aMods[$i - 1][1] = $name
				Local $path = _GetModuleFileNameW($hProcess, Ptr($aMods[$i - 1][0]))
				If $path Then $aMods[$i - 1][2] = $path
			Next
		EndIf
		_WinAPI_CloseHandle($hProcess)
		$modules = 0
	EndIf
	
	Return $aMods
EndFunc

Func _GetModuleFileNameW($hProcess, $hModule = 0)
	Local $path = ""
	Local $ret = DllCall($PSAPI, "dword", "GetModuleFileNameExW", "ptr", $hProcess, "ptr", $hModule, "wstr", "", "dword", 260)
	If $ret[0] Then
		$path = $ret[3]
	EndIf
	
	Return $path
EndFunc

Func _GetModuleBaseNameW($hProcess, $hModule = 0)
	Local $name = ""
	Local $ret = DllCall($PSAPI, "dword", "GetModuleBaseNameW", "ptr", $hProcess, "ptr", $hModule, "wstr", "", "dword", 260)
	If $ret[0] Then
		$name = $ret[3]
	EndIf
	
	Return $name
EndFunc

Func _GetProcHandle($process)
	Local $hProcess = 0
	Local $PERMISSION = BitOR(0x0002, 0x0400, 0x0008, 0x0010, 0x0020) ; CREATE_THREAD, QUERY_INFORMATION, VM_OPERATION, VM_READ, VM_WRITE

	If IsInt($process) Then
		If $process > 0 Then
			Local $ret = DllCall("kernel32.dll", "ptr", "OpenProcess", "dword", $PERMISSION, "int", 0, "dword", $process)
			If $ret[0] Then
				$hProcess = $ret[0]
			EndIf
		EndIf
	EndIf

	Return $hProcess
EndFunc

$g_aMods = _EnumModules($procidx)
			For $i=0 To UBound($g_aMods) - 1
				if $Mod = $g_aMods[$i][1] Then
				Local $hModule = $g_aMods[$i][0]
				ExitLoop
			    EndIf
		    Next