- UID
- 20912
注册时间2006-8-25
阅读权限30
最后登录1970-1-1
龙战于野

该用户从未签到
|
发表于 2007-3-23 18:15:00
|
显示全部楼层
代码有点长
稳定性有待测试
所以一时就不贴了
先露原理吧:
1。退出文件前修改主程序本身代码
如下修改004510cd处的标志:
- push eax
- mov eax,dword ptr [004510cd]
- and eax,0ff
- dec eax
- mov dword ptr[004510cd],eax
- pop eax
复制代码
2。自删除前备份修改过的代码
3。退出时自删除
如下一段经典自删除代码:
- var
- BatchFile: TextFile;
- BatchFileName: string;
- ProcessInfo: TProcessInformation;
- StartUpInfo: TStartupInfo;
- begin
- BatchFileName := ExtractFilePath(ParamStr(0)) + '_deleteme.bat';
- AssignFile(BatchFile, BatchFileName);
- Rewrite(BatchFile);
- Writeln(BatchFile, ':try');
- Writeln(BatchFile, 'del "' + ParamStr(0) + '"');
- Writeln(BatchFile,
- 'if exist "' + ParamStr(0) + '"' + ' goto try');
- Writeln(BatchFile, 'del %0');
- CloseFile(BatchFile);
- FillChar(StartUpInfo, SizeOf(StartUpInfo), $00);
- StartUpInfo.dwFlags := STARTF_USESHOWWINDOW;
- StartUpInfo.wShowWindow := SW_HIDE;
- if CreateProcess(nil, PChar(BatchFileName), nil, nil,
- False, IDLE_PRIORITY_CLASS, nil, nil, StartUpInfo,
- ProcessInfo) then
- begin
- CloseHandle(ProcessInfo.hThread);
- CloseHandle(ProcessInfo.hProcess);
- end;
- end;
复制代码
3。自删除后把备分文件改回原文件名。
从表面逻辑上说不通,确定是可行的……呵呵~ |
|