procedure TForm1.Button1Click(Sender: TObject);
var
dwProcessID, dwBaseOfDll: LongWord;
wstrExeFileName, wstrDllName: WideString;
var
hProcess: THandle;
p: Pointer;
hThread: THandle;
dwThreadID: LongWord;
hFileHandle: THandle;
byValue: Byte;
dwTmp: LongWord;
wszBuffer: array[0..1023] of WideChar;
dwLen: LongWord;
pszLibFileRemote: Pointer;
begin
//获取mOasisRuntime.dll的路径
if not GetProcessID('radstudio_10_4_esd_99797b.tmp', dwProcessID, wstrExeFileName) then Exit;
if not GetModuleBase(dwProcessID, 'mOasisRuntime.dll', dwBaseOfDll, wstrDllName) then Exit;
if not WideFileExists(wstrDllName) then Exit;
//从进程卸载该Dll
hProcess := OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessID);
if hProcess = 0 then Exit;
p := GetProcAddress(GetModuleHandle(kernel32), 'FreeLibrary');
hThread := CreateRemoteThread(hProcess, nil, 0, p, Pointer(dwBaseOfDll), 0, dwThreadID);
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hProcess);
//修改该Dll文件
hFileHandle := CreateFileW(PWideChar(wstrDllName), GENERIC_WRITE, 0, nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
if hFileHandle = INVALID_HANDLE_VALUE then Exit;
SetFilePointer(hFileHandle, 1495017, nil, FILE_BEGIN);
byValue := $EB;
WriteFile(hFileHandle, byValue, 1, dwTmp, 0);
CloseHandle(hFileHandle);
//重新加载该Dll
hProcess := OpenProcess(PROCESS_CREATE_THREAD or PROCESS_QUERY_INFORMATION or PROCESS_VM_OPERATION or PROCESS_VM_READ or PROCESS_VM_WRITE, FALSE, dwProcessID);
if hProcess = 0 then Exit;
lstrcpyW(wszBuffer, PWideChar(wstrDllName));
dwLen := (1 + Length(wstrDllName)) * sizeof(WCHAR);
pszLibFileRemote := VirtualAllocEx(hProcess, nil, dwLen, MEM_COMMIT, PAGE_READWRITE);
if pszLibFileRemote = nil then
begin
CloseHandle(hProcess);
Exit;
end;
dwTmp := 0;
if not WriteProcessMemory(hProcess, pszLibFileRemote, @wszBuffer[0], dwLen, dwTmp) then
begin
CloseHandle(hProcess);
Exit;
end;
p := GetProcAddress(GetModuleHandle(kernel32), 'LoadLibraryW');
hThread := CreateRemoteThread(hProcess, nil, 0, p, pszLibFileRemote, 0, dwThreadID);
WaitForSingleObject(hThread, INFINITE);
VirtualFreeEx(hProcess, pszLibFileRemote, dwLen, MEM_RELEASE);
CloseHandle(hProcess);
ShowMessage('ok');
end;