问题描述

关于远程线程加载dll释放的问题

有下面的代码：
'''
EnablePrivilege(SE_DEBUG_NAME, TRUE);
hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processid);
char buff[] = "Win32Project2.dll";
PSTR chRemote = NULL;
chRemote = (PSTR)VirtualAllocEx(hprocess, NULL, lstrlen(buff) + 1, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hprocess, (PVOID)chRemote, (PVOID)buff, lstrlen(buff) + 1, NULL);

PTHREAD_START_ROUTINE rThread, r2;
rThread = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("Kernel32")), TEXT("LoadLibraryA"));
HANDLE hThread = NULL, h2 = NULL;
hThread = CreateRemoteThread(hprocess, NULL, 0, rThread, (PVOID)chRemote, 0, NULL);
WaitForSingleObject(hThread, INFINITE);

DWORD hdll=0;
GetExitCodeThread(hThread, &hdll);
r2 = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("Kernel32")), TEXT("FreeLibrary"));
    h2 = CreateRemoteThread(hprocess, NULL, 0, r2, (PVOID)hdll, 0, NULL);
    WaitForSingleObject(h2, INFINITE);

VirtualFreeEx(hprocess, (PVOID)chRemote, 0, MEM_RELEASE);
CloseHandle(hThread);
CloseHandle(hprocess);
CloseHandle(h2);

'''
以上代码在win7 32位下可以正常加载Win32Project2.dll到explorer.exe，之后也可以正常卸载，不过在win8.1 64位下选择x64平台编译运行之后，可以正常加载dll，但FreeLibrary失败，无法卸载dll，这是什么原因？？

解决方案

FreeLibrary失败时，GetLastError获取错误码看是什么错误信息，这才好分析。