DLL 주입 및 언로드 원격 스레드

/*
*             
*/
HMODULE FindRemoteMod(HANDLE hProcess, const wchar_t * pszModShortName)
{ 
    HMODULE _hModules [0x100] = {0};
    int _cbNeeded = 0; 
    if (!EnumProcessModules(hProcess
                    , _hModules
                    , sizeof(_hModules)
                    , (unsigned long *)&_cbNeeded)) 
        return (HMODULE)0;
        
    for (int _i = 0; _i < (_cbNeeded >>2); _i ++) 
    { 
        wchar_t _szModuleName [0x200] = {0}; 
        GetModuleBaseNameW(hProcess
                    , _hModules[_i]
                    , _szModuleName
                    , sizeof(_szModuleName)/sizeof(_szModuleName[0]));
    
        if (!wcsicmp(_szModuleName, pszModShortName)) 
            return _hModules[_i]; 
    } 
    return (HMODULE)0;
}

/*
*     dll
*/
BOOL UnloadDll(unsigned long pid, const wchar_t * dllname)
{ 
    //     ，              
    HANDLE hProcess = OpenProcess(PROCESS_VM_READ 
                        | PROCESS_VM_WRITE 
                        | PROCESS_VM_OPERATION 
                        | PROCESS_SUSPEND_RESUME 
                        | PROCESS_CREATE_THREAD 
                        | PROCESS_QUERY_INFORMATION
                        , FALSE
                        , pid); 
    if (NULL == hProcess) 
        return FALSE; 

    //                 
    HANDLE _hToken = INVALID_HANDLE_VALUE; 
    if (!OpenProcessToken(hProcess, TOKEN_READ, &_hToken)) 
    {
        CloseHandle(hProcess);
        return FALSE; 
    } 
    CloseHandle(_hToken); 
    
    HMODULE _hDllModule = CheckDllLoaded(hProcess, dllname); 
    
    if (_hDllModule != 0) 
    { 
        //  FreeLibrary        ，          DLL. 
        unsigned long _tid = 0; 
        CreateRemoteThread(hProcess
        , 0, 0
        , (LPTHREAD_START_ROUTINE)FreeLibrary
        , _hDllModule
        , 0
        , &_tid); 
    } 
    CloseHandle(hProcess); hProcess=0;
    return TRUE;
}

/*
*   dll     
*/
BOOL LoadDll(HANDLE hProcess, const wchar_t * dllpath)
{ 
    //       ，             
    DWORD dwRemoteBufLength = (wcslen(dllpath)+1)*sizeof(wchar_t); 
    
    //                LoadLibraryW        
    wchar_t * _pBuf =(wchar_t * )VirtualAllocEx(hProcess
                                            , NULL
                                            , dwRemoteBufLength
                                            , MEM_COMMIT
                                            , PAGE_READWRITE); 
    if(!_pBuf) 
        return FALSE; 
    
    //  dll               
    if(!(WriteProcessMemory(hProcess
                        ,_pBuf
                        ,(PVOID)dllpath
                        ,dwRemoteBufLength
                        ,NULL)))
        return FALSE;        

    //  LoadLibraryW           
    HANDLE _hThread = CreateRemoteThread(hProcess
                            , NULL
                            , 0
                            , (PTHREAD_START_ROUTINE)(LoadLibraryW)
                            , (PVOID)_pBuf
                            , 0
                            , NULL); 
    //     ?! 
    return (_hThread != INVALID_HANDLE_VALUE);
}