杀死自己,无非就是一个ExitProcess把自己退出去,然后另外一个再启动自己,代码:
.386
.model flat, stdcall
option casemap:none
include windows.inc
include kernel32.inc
include user32.inc
includelib kernel32.lib
includelib user32.lib
.data
szFileName db '22222222.exe',0
.data?
hSnapShot dd ?
stProcess PROCESSENTRY32 <?>
stStartUp STARTUPINFO <?>
stProcInfo PROCESS_INFORMATION <?>
hInstance dd ?
hWinList dd ?
.code
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_Snapshot proc
invoke RtlZeroMemory,addr stProcess,sizeof stProcess ;清空stProcess,不然进程会重叠
mov stProcess.dwSize,sizeof stProcess
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,addr stProcess ;开始历遍快照
mov hSnapShot,eax ;保存到句柄中
invoke Process32First,hSnapShot,addr stProcess ;历遍第一个进程
.while eax
invoke lstrcmp,addr szFileName,addr stProcess.szExeFile ;对比是否发现22222222.exe
.if eax == NULL ;如果发现了,就调用_Snapshot1刷新快照
call _Snapshot1
.endif
invoke Process32Next,hSnapShot,addr stProcess
.endw
call _Process ;如果没发现,就执行22222222.exe
invoke ExitProcess,NULL ;一定要退出,不然会大量消耗CPU导致死机
_Snapshot endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_Snapshot1 proc
invoke RtlZeroMemory,addr stProcess,sizeof stProcess
mov stProcess.dwSize,sizeof stProcess
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,addr stProcess
mov hSnapShot,eax
invoke Process32First,hSnapShot,addr stProcess
.while eax
invoke lstrcmp,addr szFileName,addr stProcess.szExeFile ;刷新并开始对比是否发现22222222.exe
.if eax == NULL ;如果发现
call _Snapshot ;重新刷新快照重复
.endif
invoke Process32Next,hSnapShot,addr stProcess
.endw
call _Process ;如果没发现,就执行它,执行完毕,退出
invoke ExitProcess,NULL
_Snapshot1 endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;开始调用CreateProcess创建22222222.exe
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_Process proc
invoke GetStartupInfo,addr stStartUp
invoke CreateProcess,addr szFileName,NULL,NULL,NULL,NULL,\
NORMAL_PRIORITY_CLASS,NULL,NULL,addr stStartUp,addr stProcInfo
ret
_Process endp
start:
call _Snapshot ;程序一开始运行就要马上历遍快照
end start
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.386
.model flat, stdcall
option casemap:none
include windows.inc
include kernel32.inc
include user32.inc
includelib kernel32.lib
includelib user32.lib
.data
szFileName db '111111111.exe',0
.data?
Pid dd ?
hSnapShot dd ?
stProcess PROCESSENTRY32 <?>
stStartUp STARTUPINFO <?>
stProcInfo PROCESS_INFORMATION <?>
hInstance dd ?
hWinList dd ?
.code
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_Snapshot proc
invoke RtlZeroMemory,addr stProcess,sizeof stProcess
mov stProcess.dwSize,sizeof stProcess
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,addr stProcess
mov hSnapShot,eax
invoke Process32First,hSnapShot,addr stProcess
.while eax
invoke lstrcmp,addr szFileName,addr stProcess.szExeFile
.if eax == NULL
call _Snapshot1
.endif
invoke Process32Next,hSnapShot,addr stProcess
.endw
call _Process
invoke ExitProcess,NULL
_Snapshot endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_Snapshot1 proc
invoke RtlZeroMemory,addr stProcess,sizeof stProcess
mov stProcess.dwSize,sizeof stProcess
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,addr stProcess
mov hSnapShot,eax
invoke Process32First,hSnapShot,addr stProcess
.while eax
invoke lstrcmp,addr szFileName,addr stProcess.szExeFile
.if eax == NULL
call _Snapshot
.endif
invoke Process32Next,hSnapShot,addr stProcess
.endw
call _Process
invoke ExitProcess,NULL
_Snapshot1 endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_Process proc
invoke GetStartupInfo,addr stStartUp
invoke CreateProcess,addr szFileName,NULL,NULL,NULL,NULL,\
NORMAL_PRIORITY_CLASS,NULL,NULL,addr stStartUp,addr stProcInfo
ret
_Process endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
start:
call _Snapshot
end start
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
上传的附件: