这样取得的地址实际上是这个封装代码的,而这段代码又处于 UnmapViewOfMap 解除映像范围类,因此,到调用 DeleteFile 函数的时候就无法反问到这段代码了。 解决的办法是,用GetProcAddress动态取得这几个API的地址。 Delphi&CB代码如下:
// procedure DeleteSelf; var pExitProcess: Pointer; pDeleteFile: Pointer; pUnmapViewOfFile: Pointer; hModule: THANDLE; cBuf:array[0..MAX_PATH]of Char; begin hModule := GetModuleHandle('kernel32'); if hModule <> 0 then begin pExitProcess := GetProcAddress(hModule, 'ExitProcess'); pDeleteFile := GetProcAddress(hModule, 'DeleteFileA'); pUnmapViewOfFile := GetProcAddress(hModule, 'UnmapViewOfFile'); end else begin pExitProcess := nil; pDeleteFile := nil; pUnmapViewOfFile := nil; end; hModule := GetModuleHandle(nil); GetModuleFileName(hModule, cBuf, Sizeof(cBuf)); CloseHandle(THANDLE(4)); asm XOR EAX, EAX; PUSH EAX; PUSH EAX; LEA EAX, cBuf; PUSH EAX; MOV EAX, pExitProcess; PUSH EAX; MOV EAX, hModule; PUSH EAX; MOV EAX, pDeleteFile; PUSH EAX; MOV EAX, pUnmapViewOfFile; PUSH EAX; RET; end; end;//