从进程中卸载dll

Question

Hello I want to unload this dll from the process it is injected to, how can I do this? this is how I inject the dll to process:

this is just me showing how i inject my dll into a process, but how do i UNLOAD / UNINJECT this dll from the process if my inject method is this

HANDLE h = OpenProcess(PROCESS_ALL_ACCESS, false, GetProcessIdByName("csgo.exe"));
if (h)
{
    LPVOID LoadLibAddr = (LPVOID)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
    //cout << "[!] Initialized Library\n";
    LPVOID dereercomp = VirtualAllocEx(h, NULL, strlen(dllName), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    //cout << "[!] Initialized memory allocation\n";
    WriteProcessMemory(h, dereercomp, dllName, strlen(dllName), NULL);
    //cout << "[!] Wrote dll name to memory: " << strlen(dllName) << " byte(s)\n";
    HANDLE asdc = CreateRemoteThread(h, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddr, dereercomp, 0, NULL);
    //cout << "[!] Created remote thread: " << asdc << endl;
    //cout << "[!] Waiting for Dll exit...\n";
    WaitForSingleObject(asdc, INFINITE);
    VirtualFreeEx(h, dereercomp, strlen(dllName), MEM_RELEASE);
    //cout << "[!] Freeing memory\n";
    CloseHandle(asdc);
    CloseHandle(h);
    //cout << "[!] Closed all handles\n";
    //cout << "[!] Complete!\n";
}

Answer 1

You're using CreateRemoteThread to launch a thread in your target process that runs “LoadLibraryA”.

I have no idea why commenters didn't like your injection code. Looks OK to me. I think you're correctly closing that thread, however I recommend adding GetExitCodeThread call after WaitForSingleObject , this will give you the return code from LoadLibrary so you can check for errors. You can't call FreeLibrary on that handle because different processes. GetLastError won't work either. But at least you can compare with nullptr to detect a fail.

The reason why DLL stays loaded is no one has called FreeLibrary .

One pattern here, in DllMain of your DLL, under DLL_PROCESS_ATTACH case, create one more remote thread. This time no need to use CreateRemoteThread , just call normal CreateThread because that code already runs in the target process. Call CloseHandle at once on the returned handle (this won't kill the new thread just release the handle). Now in that second remote thread, do whatever you want to do in the target process, and when finished, call FreeLibraryAndExitThread API. This will exit the second remote thread, at the same time unloading your DLL from your target process.

More info: DllMain entry point For DLLs, HINSTANCE is same as HMODULE, just cast the first argument to HMODULE and keep that argument in some variable to pass into FreeLibraryAndExitThread .

Update : As said by the commenter, ideally you need to allocate, and copy, one extra character. Just replace strlen(dllName) with strlen(dllName)+1 in both cases.

Update 2 : BTW it's often a good idea to call DisableThreadLibraryCalls first thing in DLL_PROCESS_ATTACH handler. Especially if you then launch new threads from your DllMain .