madshi.net

Code: Select all

BOOL RemoteLoadLibrary(DWORD dwIdProcess,LPCSTR pLibFileName,DWORD dwTimeOut)
{
	HANDLE hTargetProc;
	FARPROC fpLoadLibrary;
	DWORD dwResult;
	BOOL bResult;

	//Open the process
	hTargetProc = OpenProcess(PROCESS_ALL_ACCESS,TRUE,dwIdProcess);

	if (hTargetProc == NULL) {
		return FALSE;
	}

	//Get a pointer to LoadLibraryA
	fpLoadLibrary = GetProcAddress(GetModuleHandle("kernel32.dll"),"LoadLibraryA");

	if (fpLoadLibrary == NULL) {
		CloseHandle(hTargetProc);
		return FALSE;
	}
	
	//Run remotly LoadLibraryA(pLibFileName);
	bResult = RemoteExecute(hTargetProc,(PREMOTE_EXECUTE_ROUTINE)fpLoadLibrary,&dwResult,
		(LPVOID)pLibFileName,strlen(pLibFileName));

	CloseHandle(hTargetProc);

	return bResult;
}

Code: Select all

//Absolute path
char szPath[MAX_PATH];
GetCurrentDirectory(MAX_PATH,szPath);
strcat(szPath,"\\MyDll.dll");

RemoteLoadLibrary(dwIdTargetProc,szPath);

Code: Select all

BOOL RemoteFreeLibrary(DWORD dwIdProcess,LPCSTR pLibFileName) {
	FARPROC fpGetModule,fpFreeLibrary;
	DWORD dwResult;
	BOOL bResult;
	HANDLE hTargetProc;
	HMODULE hModule;

	//Open the process
	hTargetProc = OpenProcess(PROCESS_ALL_ACCESS,TRUE,dwIdProcess);

	if (hTargetProc == NULL) {
		return FALSE;
	}

	//Get a pointer to FreeLibrary and GetModuleHandleA
	fpGetModule = GetProcAddress(GetModuleHandle("kernel32.dll"),"GetModuleHandleA");
	fpFreeLibrary = GetProcAddress(GetModuleHandle("kernel32.dll"),"FreeLibrary");	

	if (fpFreeLibrary == NULL || fpGetModule == NULL) {
		CloseHandle(hTargetProc);
		return FALSE;
	}

	bResult = RemoteExecute(hTargetProc,(PREMOTE_EXECUTE_ROUTINE)fpGetModule,&dwResult,
		(LPVOID)pLibFileName,strlen(pLibFileName));	

	if (dwResult == NULL || !bResult) {
		CloseHandle(hTargetProc);
		return FALSE;
	}

	hModule = (HMODULE)dwResult;

	//Run remotly function FreeLibrary(hModule);
	bResult = RemoteExecute(hTargetProc,(PREMOTE_EXECUTE_ROUTINE)fpFreeLibrary,&dwResult,
		(LPVOID)hModule,sizeof(HMODULE)/8);

	CloseHandle(hTargetProc);

	return bResult;
}

Code: Select all

RemoteFreeLibrary(dwIdTargetProc,"MyDll.dll");