[kenox]

Hello


I am sorry for my bad english

When i try delete dll with a command the system return 'access denied'.
I try to use gmer for remove dll and it succeeded delete the dll

how does it ?

thank you

[Dmitry Varshavsky]

1. Close all opened handles
2. Unmap all of mapped views for this file

[kenox]

thank you.

What function can i use ?

I use RtlCreateUserThread with LdrUnloadDll

this does not work.

My code is

Code: Select all

PVOID searchDllProcess(const wchar_t* nameDll,DWORD pid)
{
    HANDLE snapshotModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pid);
    MODULEENTRY32 structmodsnapshot = {0};

    structmodsnapshot.dwSize = sizeof(MODULEENTRY32);

    if(snapshotModule == INVALID_HANDLE_VALUE)return NULL;
    if(Module32First( snapshotModule , &structmodsnapshot ) == FALSE)return NULL;

    while(Module32Next(snapshotModule , &structmodsnapshot))
    {
        if(!wcscmp(structmodsnapshot.szModule,nameDll))
        {
            CloseHandle(snapshotModule);
			return (PVOID)structmodsnapshot.modBaseAddr;
        }
    }
    CloseHandle(snapshotModule);
    return NULL;
}


...
PVOID addrDllParametre = searchDllProcess(nameDll,pid);
...
addrUnloadDll = (PVOID)GetProcAddress(GetModuleHandle(L"ntdll.dll"),"LdrUnloadDll");
...
RtlCreateUserThread(handleProcess,NULL,false,0,0,0,(PUSER_THREAD_START_ROUTINE)addrUnloadDll,addrDllParametre,&hThread,NULL);

can you help me please.

[Eric_71]

you can force removal using NtUnmapViewOfSection ( at your own risk for the process )

Code: Select all

NtUnmapViewOfSection
(
    IN HANDLE ProcessHandle,
    IN PVOID  BaseAddress
); 

[EP_X0FF]

@kenox

Which exactly dll you want to unload and why you want to do this. Start from this.

Unloading 3rd party dlls is unsafe.

[kenox]

I have not exactly a dll, I want unload the dll which inject in my process by the malwares.

I have testing NtUnmapViewOfSection, my process to crash.

[EP_X0FF]

I have testing NtUnmapViewOfSection, my process to crash.

And why it should not. You are unmapped memory that can be accessed by multiple program threads. Of course it will crash. What you want to do:
1) "unload dll as gmer"
2) unmap dll
3) disable loading of unknown dlls

[kenox]

I want unload the dll of all process.

"unload dll as gmer"

[EP_X0FF]

http://msdn.microsoft.com/ru-ru/library ... s.85).aspx

Everything else is unsafe.
Thread closed.