权限提升

#include <Windows.h>
#include <stdio.h>BOOL SetPrivilege(LPCTSTR lpszPrivilege, BOOL bEnablePrivilege)
{TOKEN_PRIVILEGES tp;HANDLE hToken;LUID luid;OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);LookupPrivilegeValue(NULL, lpszPrivilege, &luid);tp.PrivilegeCount = 1;tp.Privileges[0].Luid = luid;if (bEnablePrivilege)tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;elsetp.Privileges[0].Attributes = 0;AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL);if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)return FALSE;elsereturn TRUE;
}
int main()
{SetPrivilege(SE_DEBUG_NAME, TRUE);return 0;
}

强制卸载DLL

#include <Windows.h>
#include <stdio.h>
#include <TlHelp32.h>BOOL EnjectDll(DWORD dwPID, LPCTSTR szDllName)
{BOOL bMore = FALSE, bFound = FALSE;HANDLE hSnapshot, hProcess, hThread;HMODULE hModule = NULL;MODULEENTRY32 me = { sizeof(me) };LPTHREAD_START_ROUTINE pThreadProc;hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);bMore = Module32First(hSnapshot, &me);for (; bMore; bMore = Module32Next(hSnapshot, &me)){/*if (!_tcsicmp((LPCTSTR)me.szModule, szDllName) || !_tcsicmp((LPCTSTR)me.szExePath, szDllName)){bFound = TRUE;break;}*/}if (!(hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID)))return FALSE;hModule = GetModuleHandle(L"kernel32.dll");pThreadProc = (LPTHREAD_START_ROUTINE)GetProcAddress(hModule, "FreeLibrary");hThread = CreateRemoteThread(hProcess, NULL, 0, pThreadProc, me.modBaseAddr, 0, NULL);WaitForSingleObject(hThread, INFINITE);CloseHandle(hThread);CloseHandle(hProcess);CloseHandle(hSnapshot);return TRUE;
}int main(int argc, char *argv[])
{EnjectDll(2568, L"hook.dll");return 0;
}