force unload modules of a process - c++

Question

I want to unload some module in a process .
I use this function :
bool UnInjectDll(const TCHAR* ptszDllFile, DWORD dwProcessId)
{
if (NULL == ptszDllFile || 0 == ::_tcslen(ptszDllFile))
{
return false;
}
HANDLE hModuleSnap = INVALID_HANDLE_VALUE;
HANDLE hProcess = NULL;
HANDLE hThread = NULL;
hModuleSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
if (INVALID_HANDLE_VALUE == hModuleSnap)
{
return false;
}
MODULEENTRY32 me32;
memset(&me32, 0, sizeof(MODULEENTRY32));
me32.dwSize = sizeof(MODULEENTRY32);
if(FALSE == ::Module32First(hModuleSnap, &me32))
{
::CloseHandle(hModuleSnap);
return false;
}
bool isFound = false;
do
{
isFound = (0 == ::_tcsicmp(me32.szModule, ptszDllFile) || 0 == ::_tcsicmp(me32.szExePath, ptszDllFile));
if (isFound)
{
break;
}
} while (TRUE == ::Module32Next(hModuleSnap, &me32));
::CloseHandle(hModuleSnap);
if (false == isFound)
{
return false;
}
hProcess = ::OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION, FALSE, dwProcessId);
if (NULL == hProcess)
{
return false;
}
LPTHREAD_START_ROUTINE lpThreadFun = (PTHREAD_START_ROUTINE)::GetProcAddress(::GetModuleHandle(_T("Kernel32")), "FreeLibrary");
if (NULL == lpThreadFun)
{
::CloseHandle(hProcess);
return false;
}
hThread = ::CreateRemoteThread(hProcess, NULL, 0, lpThreadFun, me32.modBaseAddr , 0, NULL);
if (NULL == hThread)
{
::CloseHandle(hProcess);
return false;
}
::WaitForSingleObject(hThread, INFINITE);
::CloseHandle(hThread);
::CloseHandle(hProcess);
return true;
}
But when I use this code it can not special module that I want to unload from project.
I also use "process detective" tool for doing this but this tool can not do this also.
Now I want a function that I can be sure will unload a special module from a process I want. for example you create a simple program that only show a messagebox , now if you see the modules of it's process , it has a module ntdll.dll and some other modules , now you can not remove ntdll.dll module or some other module from it. i want a function to force a process to remove any module from process I want.

Answer 1

What your are trying to do is utterly dangerous (and as of my knowledge, luckily, not possible).
Your program or library is linked against certain other DLLs. These libraries in return are referencing others as well, and so on, and so on. When your program or DLL is loaded into memory space by the loader of Windows, these "dependencies" will be loaded also and your import address tables will be patched so that your calls know where to jump when they are to be executed. All of your code will be hard-wired together as an atomic entity.
Unloading a DLL that has been statically linked in that manner (.dlls files can be linked statically also, not to be confused with static .lib files) basically forces your application to crash the second any call is made that depends on that libarary - especially the ntdll.dll which will be the root of most of all the libs you linked against. The calls will be thrown into the void. These libraries cannot be unloaded because they are in a sense part of your program.
If you however loaded a library dynamically at runtime, you are free to unload it any time you want. Since you are probably working via dynamic addresses using GetProcAddress anyway, it is up to you to make sure that your function pointers have a valid target.
You can take a hat on and off any way you desire, but you can't (and shouldn't) rip out your heart ;)
It doesn't fully answer your question though I know, but although this is just a warning that you never should do this without a very very good reason (which I don't know you really have), I am quite positive that you can't do what you are asking - but I am happy to let other people correct me here.
If you want to do something to the loaded libraries, and you are already on this destructive course, just overwrite the library or IATs in memory directly. You can go in with a crowbar, sure, but I don't think you will achive what you are looking for...