在视窗 7 上自动删除 exe

Auto deleting exe on windows 7

本文关键字:删除 exe      更新时间:2023-10-16

我在互联网上找到了这段代码,但它说要在Windows XP上运行。我尝试在 Windows 7 上运行它并且它有效,但我想知道它是否安全,不仅运行此代码,而且在 Windows 7 上运行。

//
//  Self-deleting exe under Windows XP
//
#include <windows.h>
#include <tchar.h>
// get this right!
#define EXPLORER_PID 1444
typedef UINT  (WINAPI * WAIT_PROC)(HANDLE, DWORD);  // WaitForSingleObject
typedef BOOL  (WINAPI * CLOSE_PROC)(HANDLE);        // CloseHandle
typedef BOOL  (WINAPI * DELETE_PROC)(LPCTSTR);      // DeleteFile
typedef VOID  (WINAPI * EXIT_PROC)(DWORD);          // ExitProcess
typedef struct
{
    WAIT_PROC   fnWaitForSingleObject;
    CLOSE_PROC  fnCloseHandle;
    DELETE_PROC fnDeleteFile;
    EXIT_PROC   fnExitProcess;
    HANDLE      hProcess;
    TCHAR       szFileName[MAX_PATH];
} INJECT;
#pragma optimize("gsy", off)
#pragma check_stack(off)        // doesn't work :-(
DWORD WINAPI RemoteThread(INJECT *remote)
{
    remote->fnWaitForSingleObject(remote->hProcess, INFINITE);
    remote->fnCloseHandle(remote->hProcess);
    remote->fnDeleteFile(remote->szFileName);
    remote->fnExitProcess(0);
    return 0;
}
#pragma check_stack
HANDLE GetRemoteProcess()
{
    STARTUPINFO         si = { sizeof(si) };
    PROCESS_INFORMATION pi;
    //return OpenProcess(PROCESS_ALL_ACCESS, FALSE, EXPLORER_PID);
    if(CreateProcess(0, "explorer.exe", 0, 0, FALSE, CREATE_SUSPENDED|CREATE_NO_WINDOW|IDLE_PRIORITY_CLASS, 0, 0, &si, &pi))
    {
        CloseHandle(pi.hThread);
        return pi.hProcess;
    }
    else
    {
        return 0;
    }
}
PVOID GetFunctionAddr(PVOID func)
{
#ifdef _DEBUG
    // get address of function from the JMP <relative> instruction
    DWORD *offset = (BYTE *)func + 1;
    return (PVOID)(*offset + (BYTE *)func + 5);
#else
    return func;
#endif
}
BOOL SelfDelete()
{
    INJECT local, *remote;
    BYTE   *code;
    HMODULE hKernel32;
    HANDLE  hRemoteProcess;
    HANDLE  hCurProc;
    DWORD   dwThreadId;
    HANDLE  hThread = 0;
    char ach[80];
    hRemoteProcess = GetRemoteProcess();
    if(hRemoteProcess == 0)
        return FALSE;
    // Allocate memory in remote process
    code = VirtualAllocEx(hRemoteProcess, 0, sizeof(INJECT) + 128, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    if(code == 0)
    {
        CloseHandle(hRemoteProcess);
        return FALSE;
    }
    hKernel32 = GetModuleHandle(_T("kernel32.dll"));
    // setup remote structure
    remote = (INJECT *)(code + 128);
    local.fnWaitForSingleObject  = (WAIT_PROC)GetProcAddress(hKernel32,  "WaitForSingleObject");
    local.fnCloseHandle          = (CLOSE_PROC)GetProcAddress(hKernel32, "CloseHandle");
    local.fnExitProcess          = (EXIT_PROC)GetProcAddress(hKernel32, "ExitProcess");
#ifdef UNICODE
    local.fnDeleteFile            = (DELETE_PROC)GetProcAddress(hKernel32, "DeleteFileW");
#else
    local.fnDeleteFile            = (DELETE_PROC)GetProcAddress(hKernel32, "DeleteFileA");
#endif
    // duplicate our own process handle for remote process to wait on
    hCurProc = GetCurrentProcess();
    DuplicateHandle(hCurProc, hCurProc, hRemoteProcess, &local.hProcess, 0, FALSE, DUPLICATE_SAME_ACCESS);
    // find name of current executable
    GetModuleFileName(NULL, local.szFileName, MAX_PATH);
    // write in code to execute, and the remote structure
    WriteProcessMemory(hRemoteProcess, code,    GetFunctionAddr(RemoteThread), 128, 0);
    WriteProcessMemory(hRemoteProcess, remote, &local, sizeof(local), 0);
    wsprintf(ach, "%x %xn", code, remote);
    OutputDebugString(ach);
    // execute the code in remote process
    hThread = CreateRemoteThread(hRemoteProcess, 0, 0, code, remote, 0, &dwThreadId);
    if(hThread != 0)
    {
        CloseHandle(hThread);
    }
    return TRUE;
}
int main(void)
{
    SelfDelete();
    return 0;
}

顺便问一下,这怎么能用作 C/C++ 中的库?我的目标是,例如,

#include "selfdel.h"这样我就可以只使用C++程序中SelfDelete()函数。

你应该意识到这段代码是什么。它是将代码注入到另一个进程中,该进程将作为该进程执行,然后该进程将退出。它应该可以正常工作(尽管请查看下面的评论)。我认为这个代码片段的作者在 Win Vista 发布之前就已经写好了它,因此您有顾虑。

您可以在"selfdel.h"中声明SelfDelete()。调用此函数并立即退出应该可以解决问题。

该实现不需要库用户的任何输入,因为它可以获得所需的一切。

// duplicate our own process handle for remote process to wait on
hCurProc = GetCurrentProcess();
...
// find name of current executable
GetModuleFileName(NULL, local.szFileName, MAX_PATH);

一些评论:

  • 您的进程应具有足够的权限来创建另一个进程
  • 此类活动可能会被防病毒软件视为可疑
  • 不要忘记,只要您的进程在调用SelfDelete()后仍然存在,"僵尸"进程就会等待
  • 考虑其他方法:程序如何删除自己的可执行文件