Exe易做图代码

//http://hi.baidu.com/zxhouse 
#include <windows.h>    
   
BOOL DeleteMyself(WCHAR *pHelper)    
{    
    int ret;    
     WCHAR helper[MAX_PATH];    
     ZeroMemory(helper, sizeof(helper));    
    if (pHelper)    
         wcsncpy(helper, pHelper, MAX_PATH-2);    
    else   
         wcscpy(helper, L"calc.exe");    
        
     STARTUPINFOW si = {sizeof(STARTUPINFOW),0};    
     PROCESS_INFORMATION pi;    
        
     HANDLE hSYNC = OpenProcess(SYNCHRONIZE, TRUE, GetCurrentProcessId());    
        
    if (CreateProcessW(NULL, helper, 0, 0, TRUE, CREATE_SUSPENDED, 0, 0, &si, &pi))    
     {    
         CONTEXT ctx = {CONTEXT_FULL,0};    
         ret = GetThreadContext(pi.hThread, &ctx);    
            
         WCHAR MyselfPath[MAX_PATH];    
        int nPathLen = GetModuleFileNameW(NULL, MyselfPath, MAX_PATH);    
            
         struct StackContext    
         {    
             DWORD_PTR DeleteFileW;    
             DWORD_PTR WaitForSingleObject_argv1;    
             DWORD_PTR WaitForSingleObject_argv2;    
             DWORD_PTR ExitProcess;    
             DWORD_PTR DeleteFileW_argv1;    
             DWORD_PTR 易做图;    
             DWORD_PTR ExitProcess_argv1;    
         }stackctx;    
            
         HMODULE hKernel32 = GetModuleHandleW(L"Kernel32.dll");    
            
         ctx.Eip = (DWORD_PTR)GetProcAddress(hKernel32, "WaitForSingleObject");    
         ctx.Esp = (DWORD_PTR)VirtualAllocEx(pi.hProcess, 0, 512*1024, MEM_COMMIT, PAGE_EXECUTE_READWRITE);    
         ctx.Esp += 256*1024;    
         stackctx.DeleteFileW = (DWORD_PTR)GetProcAddress(hKernel32, "DeleteFileW");    
         stackctx.WaitForSingleObject_argv1 = (DWORD_PTR)hSYNC;    
         stackctx.WaitForSingleObject_argv2 = (DWORD_PTR)-1;    
         stackctx.ExitProcess = (DWORD_PTR)GetProcAddress(hKernel32, "ExitProcess");    
         stackctx.DeleteFileW_argv1 = (DWORD_PTR)VirtualAllocEx(pi.hProcess, 0, (nPathLen+1)*sizeof(WCHAR), MEM_COMMIT, PAGE_EXECUTE_READWRITE);    
         ret = WriteProcessMemory(pi.hProcess, (LPVOID)stackctx.DeleteFileW_argv1, MyselfPath, (nPathLen+1)*sizeof(WCHAR), NULL);    
        if (!ret) return FALSE;    
            
         stackctx.易做图 = 0;    
         stackctx.ExitProcess_argv1 = 0;    
            
         ret = WriteProcessMemory(pi.hProcess, (LPVOID)(ctx.Esp), &stackctx, sizeof(stackctx), NULL);    
        if (!ret) return FALSE;    
            
         ret = SetThreadContext(pi.hThread, &ctx);    
        if (!ret) return FALSE;    
            
         ResumeThread(pi.hThread);    
         CloseHandle(pi.hThread);    
         CloseHandle(pi.hProcess);    
        return TRUE;    
     }else   
     {    
        return FALSE;    
     }    
}    
   
   
int main()    
{    
     DeleteMyself(0);    
    return 0;    
}    
   
//2000/xp/2003/vista 上已经测试通过 

补充：综合编程 , 安全编程 ,

上一个：在任意的远程桌面的session中运行指定的程序
下一个：最新的HIV过注册表监控完全攻略