DWORD _stdcall ShieldThread(LPVOID lParam)
{
char DllFilePath[MAX_PATH];
HANDLE hDllFile;
HANDLE hSearch;
void* MemDll;
int SizeDll;
DWORD BytesRead;
WIN32_FIND_DATA FileData;
__try
{
GetModuleFileName(HMODULE(g_hDllModule), DllFilePath,MAX_PATH);
hDllFile =CreateFile(DllFilePath,GENERIC_READ,0,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
SizeDll =GetFileSize(hDllFile,0);
MemDll =VirtualAlloc(0,SizeDll,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE);
ReadFile(hDllFile,MemDll,SizeDll,&BytesRead,0);
CloseHandle(hDllFile);
while(1)
{
hSearch =FindFirstFile(DllFilePath,&FileData);
if(hSearch==INVALID_HANDLE_VALUE)
{
hDllFile=CreateFile(DllFilePath,GENERIC_WRITE,0,0,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);
WriteFile(hDllFile,MemDll,SizeDll,&BytesRead,0);
CloseHandle(hDllFile);
}
FindClose(hSearch);
Sleep(500);
}
}
__finally
{
CloseHandle(hDllFile);
FindClose(hSearch);
}
return 0;
}
某dll程序被删自动还原代码
最新推荐文章于 2024-03-05 10:11:23 发布