|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
nbw知道在哪啊，怎么我找了半天都找不到，你告诉我链接好吗？
|
|
|
|
|
|
|
|
|
|
|
|
最初由 nbw 发布 这个也许可行,没试过
|
|
|
最初由 nbw 发布 牛人呀，这也想的出来，PFPF！
|
|
|
看到各位高人都来捧场，我今天终于把这个程序给做出来了，就是用的远程线程的技术，上次没有成功居然是一个非常小的错误
 现将源代码上传，欢迎大家参考。 居然没有权限上传！只好贴源代码了，有谁要工具的话直接给我来信marxixing@tom.com #include <windows.h> #include <tlhelp32.h> #include <stdio.h> #include "resource.h" // Forward declarations: BOOL GetProcessList( ); BOOL ListProcessModules( DWORD dwPID, HANDLE hProc); void EnableDebugPriv(void); bool Remote(HANDLE hProc, HMODULE hModule); BOOL SignFindVirus=false; //发现病毒标志 char Virus[128]; char Virname[MAX_PATH]; typedef struct _RemotePara { char pMessageBox[12]; DWORD Milliseconds; HMODULE pHandModle; DWORD dwMessageBox; DWORD dwFreeLibrary; DWORD dwSleep; }RemotePara; //////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////// INT_PTR CALLBACK DialogProc(HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam) { switch(uMsg) { case WM_INITDIALOG: EnableDebugPriv(); return 0; case WM_COMMAND: switch(LOWORD(wParam)) { case IDOK: GetDlgItemText(hDlg,EDITVIRUS,Virus,MAX_PATH); GetProcessList(); if(SignFindVirus==false) { MessageBox(NULL,"请确认文件名是否正确!","OK",MB_ICONINFORMATION); return 1; } else { BOOL delfile; for(int i=0;i<5;i++) { delfile=DeleteFile(Virname); if(delfile) break; else { Sleep(100); continue; } } if(delfile) { MessageBox(NULL,"文件已被成功清除!","OK",MB_OK); return 1; } else { MessageBox(NULL,"文件无法被清除!","OK",MB_OK); return 0; } } return 0; case IDCANCEL: EndDialog(hDlg,0); return 0; case IDHELP: MessageBox(NULL,"在文件名对话框中输入要删除的文件名，不需要路径.\n" "用来删除一个正在运行的exe或dll文件", "KillFiler帮助",MB_OK); return 0; } break; case WM_CLOSE: EndDialog(hDlg,0); return 0; } return 0; } int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE, LPSTR lpCmdLine, int nCmdShow ) { DialogBox( hInstance, MAKEINTRESOURCE(IDD_DIALOG1), NULL, (DLGPROC)DialogProc ); return 1; } ////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////// //进程权限提升函数，无参数，无返回值 void EnableDebugPriv(void) { HANDLE hToken; LUID sedebugnameValue; TOKEN_PRIVILEGES tkp; if ( ! OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) ) return; if ( ! LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &sedebugnameValue ) ) { CloseHandle( hToken ); return; } tkp.PrivilegeCount = 1; tkp.Privileges[0].Luid = sedebugnameValue; tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; if ( ! AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof tkp, NULL, NULL ) ) CloseHandle( hToken ); return; } ////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////// //枚举系统内的所有进程模块。 //返回True成功，False失败 BOOL GetProcessList( ) { HANDLE hProcessSnap; HANDLE hProcess; PROCESSENTRY32 pe32; hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 ); if( hProcessSnap == INVALID_HANDLE_VALUE ) { return( FALSE ); } pe32.dwSize = sizeof( PROCESSENTRY32 ); if( !Process32First( hProcessSnap, &pe32 ) ) { CloseHandle( hProcessSnap ); // Must clean up the snapshot object! return( FALSE ); } do { hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID ); if(strcmp(strlwr(pe32.szExeFile),strlwr(Virus))==NULL) { SignFindVirus=true; strcpy(Virname,pe32.szExeFile); TerminateProcess(hProcess,NULL); ListProcessModules(pe32.th32ProcessID,hProcess); return (TRUE); } else ListProcessModules(pe32.th32ProcessID,hProcess); } while( Process32Next( hProcessSnap, &pe32 ) ); CloseHandle( hProcessSnap ); return( TRUE ); } ////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////// //枚举指定进程模块 //dwID：进程ID //hProcess：进程句柄 //返回True成功，False失败 BOOL ListProcessModules( DWORD dwPID, HANDLE hProcess) { HANDLE hModuleSnap = INVALID_HANDLE_VALUE; MODULEENTRY32 me32; hModuleSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwPID ); if( hModuleSnap == INVALID_HANDLE_VALUE ) { return(FALSE); } me32.dwSize = sizeof( MODULEENTRY32 ); if( !Module32First( hModuleSnap, &me32)) { CloseHandle( hModuleSnap ); // Must clean up the snapshot object! return( FALSE ); } do { if(strcmp(strlwr(me32.szModule),strlwr(Virus))==NULL) { SignFindVirus=true; strcpy(Virname,me32.szExePath); Remote(hProcess,me32.hModule); return (TRUE); } } while( Module32Next( hModuleSnap, &me32 ) ); CloseHandle( hModuleSnap ); return( TRUE ); } ////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////// //远程线程体 DWORD __stdcall ThreadProc (RemotePara *lpPara) { typedef int (__stdcall *MMessageBoxA)(HWND,LPCTSTR,LPCTSTR,DWORD);//定义MessageBox函数 typedef int (__stdcall *MFreeLibrary)(HMODULE); typedef int (__stdcall *MSleep)(DWORD); MFreeLibrary myFreeLibrary; MMessageBoxA myMessageBoxA; MSleep mySleep; myMessageBoxA =(MMessageBoxA) lpPara->dwMessageBox ;//得到函数入口地址 myFreeLibrary =(MFreeLibrary) lpPara->dwFreeLibrary;// mySleep =(MSleep) lpPara->dwSleep; do { myFreeLibrary(lpPara->pHandModle); mySleep(lpPara->Milliseconds); //休眠100毫秒，再次进行释放 } while(myFreeLibrary(lpPara->pHandModle)==NULL); return 1; } ////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////// bool Remote(HANDLE hProcess, HMODULE hModule) { const DWORD THREADSIZE=1024*4; DWORD byte_write; void *pRemoteThread =VirtualAllocEx(hProcess,0,THREADSIZE,MEM_COMMIT| MEM_RESERVE,PAGE_EXECUTE_READWRITE); if(!pRemoteThread) { // char szBuffer[128]; // DWORD Err=GetLastError(); // wsprintf(szBuffer,"VirtualAllocEx fail Error Code %d",Err); // MessageBox(NULL,szBuffer,NULL,NULL); return 0; } if(!::WriteProcessMemory(hProcess,pRemoteThread,&ThreadProc,THREADSIZE,0)) { MessageBox(NULL,"WriteProcessMemory fail",NULL,NULL); return 0; } //再付值 RemotePara myRemotePara; ZeroMemory(&myRemotePara,sizeof(RemotePara)); myRemotePara.dwMessageBox =(DWORD)MessageBoxA; myRemotePara.dwFreeLibrary=(DWORD)FreeLibrary; myRemotePara.dwSleep=(DWORD)Sleep; strcat(myRemotePara.pMessageBox,"Fail\0"); myRemotePara.pHandModle=hModule; myRemotePara.Milliseconds=100; //写进目标进程 RemotePara *pRemotePara =(RemotePara *)VirtualAllocEx (hProcess ,0,sizeof(RemotePara),MEM_COMMIT,PAGE_READWRITE);//注意申请空间时的页面属性 if(!pRemotePara) { MessageBox(NULL,"VirTualAllocEx fail",NULL,NULL); return 0; } if(!WriteProcessMemory (hProcess ,pRemotePara,&myRemotePara,sizeof myRemotePara,0)) { MessageBox(NULL,"WriteProcessMemory fail",NULL,NULL); return 0; } //启动线程 HANDLE hThread=CreateRemoteThread (hProcess ,0,0,(DWORD (__stdcall *)(void *))pRemoteThread ,pRemotePara,0,&byte_write); if((!hThread)||(byte_write==NULL)) { // MessageBox(NULL,"CreateRemoteThread fail",NULL,NULL); return 0; } return(TRUE); } |
|
|
|
|
|
|
|
|
建议将该文移动动CPU先生的专栏（这个CPU老是不献/现身
），然后加精。
|
|
|
|
