exe自杀

bek · 发表于 2010-1-14 15:12:13


	本帖最后由 bek 于 2010-1-14 15:13 编辑 #include <windows.h> BOOL DeleteMyself(WCHAR pHelper) { int ret; WCHAR helper[MAX_PATH]; ZeroMemory(helper, sizeof(helper)); if (pHelper) wcsncpy(helper, pHelper, MAX_PATH-2); else wcscpy(helper, L"calc.exe"); STARTUPINFOW si = {sizeof(STARTUPINFOW),0}; PROCESS_INFORMATION pi; HANDLE hSYNC = OpenProcess(SYNCHRONIZE, TRUE, GetCurrentProcessId()); if (CreateProcessW(NULL, helper, 0, 0, TRUE, CREATE_SUSPENDED, 0, 0, &si, &pi)) { CONTEXT ctx = {CONTEXT_FULL,0}; ret = GetThreadContext(pi.hThread, &ctx); WCHAR MyselfPath[MAX_PATH]; int nPathLen = GetModuleFileNameW(NULL, MyselfPath, MAX_PATH); struct StackContext { DWORD_PTR DeleteFileW; DWORD_PTR WaitForSingleObject_argv1; DWORD_PTR WaitForSingleObject_argv2; DWORD_PTR ExitProcess; DWORD_PTR DeleteFileW_argv1; DWORD_PTR shit; DWORD_PTR ExitProcess_argv1; }stackctx; HMODULE hKernel32 = GetModuleHandleW(L"Kernel32.dll"); ctx.Eip = (DWORD_PTR)GetProcAddress(hKernel32, "WaitForSingleObject"); ctx.Esp = (DWORD_PTR)VirtualAllocEx(pi.hProcess, 0, 5121024, MEM_COMMIT, PAGE_EXECUTE_READWRITE); ctx.Esp += 2561024; stackctx.DeleteFileW = (DWORD_PTR)GetProcAddress(hKernel32, "DeleteFileW"); stackctx.WaitForSingleObject_argv1 = (DWORD_PTR)hSYNC; stackctx.WaitForSingleObject_argv2 = (DWORD_PTR)-1; stackctx.ExitProcess = (DWORD_PTR)GetProcAddress(hKernel32, "ExitProcess"); stackctx.DeleteFileW_argv1 = (DWORD_PTR)VirtualAllocEx(pi.hProcess, 0, (nPathLen+1)sizeof(WCHAR), MEM_COMMIT, PAGE_EXECUTE_READWRITE); ret = WriteProcessMemory(pi.hProcess, (LPVOID)stackctx.DeleteFileW_argv1, MyselfPath, (nPathLen+1)sizeof(WCHAR), NULL); if (!ret) return FALSE; stackctx.shit = 0; stackctx.ExitProcess_argv1 = 0; ret = WriteProcessMemory(pi.hProcess, (LPVOID)(ctx.Esp), &stackctx, sizeof(stackctx), NULL); if (!ret) return FALSE; ret = SetThreadContext(pi.hThread, &ctx); if (!ret) return FALSE; ResumeThread(pi.hThread); CloseHandle(pi.hThread); CloseHandle(pi.hProcess); return TRUE; }else { return FALSE; } } int main() { DeleteMyself(0); return 0; } //2000/xp/2003/vista/win7 上已经测试通过并不会触发金山，瑞星。江民。ESET Smart Security BE 4.2.22.0主动防御复制代码*

bek · 发表于 2010-1-15 04:14:40


	自己看看 {:3_239:}

565190861 · 发表于 2010-1-15 10:26:06


	是什么东西。。？看不懂····

微信扫一扫分享朋友圈

exe自杀

相关帖子

评论 2

微信扫一扫 分享朋友圈

exe自杀

相关帖子

评论 2

微信扫一扫分享朋友圈