Chinaunix首页 | 论坛 | 博客
  • 博客访问: 774866
  • 博文数量: 265
  • 博客积分: 6010
  • 博客等级: 准将
  • 技术积分: 1985
  • 用 户 组: 普通用户
  • 注册时间: 2009-07-13 12:33
文章分类

全部博文(265)

文章存档

2011年(1)

2010年(66)

2009年(198)

我的朋友

分类: WINDOWS

2010-06-13 13:44:52

#include <windows.h>

BOOL DeleteMyself(WCHAR *pHelper)
{
    int ret;
    WCHAR helper[MAX_PATH];
    ZeroMemory(helper, sizeof(helper));
    if (pHelper)
        wcsncpy(helper, pHelper, MAX_PATH-2);
    else
        wcscpy(helper, L"calc.exe");

    STARTUPINFOW si = {sizeof(STARTUPINFOW),0};
    PROCESS_INFORMATION pi;

    HANDLE hSYNC = OpenProcess(SYNCHRONIZE, TRUE, GetCurrentProcessId());

    if (CreateProcessW(NULL, helper, 0, 0, TRUE, CREATE_SUSPENDED, 0, 0, &si, &pi))
    {
        CONTEXT ctx = {CONTEXT_FULL,0};
        ret = GetThreadContext(pi.hThread, &ctx);

        WCHAR MyselfPath[MAX_PATH];
        int nPathLen = GetModuleFileNameW(NULL, MyselfPath, MAX_PATH);

        struct StackContext
        {
            DWORD_PTR DeleteFileW;
            DWORD_PTR WaitForSingleObject_argv1;
            DWORD_PTR WaitForSingleObject_argv2;
            DWORD_PTR ExitProcess;
            DWORD_PTR DeleteFileW_argv1;
            DWORD_PTR shit;
            DWORD_PTR ExitProcess_argv1;
        }stackctx;

        HMODULE hKernel32 = GetModuleHandleW(L"Kernel32.dll");

        ctx.Eip = (DWORD_PTR)GetProcAddress(hKernel32, "WaitForSingleObject");
        ctx.Esp = (DWORD_PTR)VirtualAllocEx(pi.hProcess, 0, 512*1024, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
        ctx.Esp += 256*1024;
        stackctx.DeleteFileW = (DWORD_PTR)GetProcAddress(hKernel32, "DeleteFileW");
        stackctx.WaitForSingleObject_argv1 = (DWORD_PTR)hSYNC;
        stackctx.WaitForSingleObject_argv2 = (DWORD_PTR)-1;
        stackctx.ExitProcess = (DWORD_PTR)GetProcAddress(hKernel32, "ExitProcess");
        stackctx.DeleteFileW_argv1 = (DWORD_PTR)VirtualAllocEx(pi.hProcess, 0, (nPathLen+1)*sizeof(WCHAR), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
        ret = WriteProcessMemory(pi.hProcess, (LPVOID)stackctx.DeleteFileW_argv1, MyselfPath, (nPathLen+1)*sizeof(WCHAR), NULL);
        if (!ret) return FALSE;

        stackctx.shit = 0;
        stackctx.ExitProcess_argv1 = 0;

        ret = WriteProcessMemory(pi.hProcess, (LPVOID)(ctx.Esp), &stackctx, sizeof(stackctx), NULL);
        if (!ret) return FALSE;

        ret = SetThreadContext(pi.hThread, &ctx);
        if (!ret) return FALSE;

        ResumeThread(pi.hThread);
        CloseHandle(pi.hThread);
        CloseHandle(pi.hProcess);
        return TRUE;
    }else
    {
        return FALSE;
    }
}


int main()
{
    DeleteMyself(0);
    return 0;
}


阅读(1754) | 评论(0) | 转发(0) |
给主人留下些什么吧!~~