程序自删除的一种实现方式2

#include <windows.h>
#include <tlhelp32.h>
#include <iostream>

__declspec(naked) DWORD WINAPI Start_(LPVOID lpThreadParameter)
{   
	__asm 
	{     
		call    $+5
		sub     [esp],5                 ; // _code_start_           
		mov     ebp,[esp+8]             ; // hHandle
		push    [ebp-4]
		push    INFINITE                
		push    [ebp-4]                 

		call    [ebp-8]                 ; // WaitForSingleObject
		call    [ebp-12]                ; // CloseHandle

		push    ebp                     ; // lpFileName
		call    [ebp-16]                ; // DeleteFileA           

		pop     eax
		push    EXIT_SUCCESS          
		sub     esp,4                   ; // nothing

		push    MEM_RELEASE             
		push    0  
		push    eax                     ; // _code_start_   

		push    [ebp-20]                ; // ExitThread
		mov     eax,[ebp-24]
		jmp     eax                     ; // VirtualFree        
	}
}

BYTE code[] ={
	232,0,0,0,0,128,44,36,5,139,108,36,8,255,117,
	252,106,255,255,117,252,255,85,248,255,85,244,
	85,255,85,240,88,106,0,131,236,4,104,0,
	128,0,0,106,0,80,255,117,236,139,69,232,255,224
};
#include <iostream>
void DeleteMe()
{
	HANDLE hToken;
	TOKEN_PRIVILEGES tp;
	ZeroMemory(&tp,sizeof tp);
	HANDLE hProcess = GetCurrentProcess();

	OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&hToken);
	LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);

	tp.PrivilegeCount = 1;
	tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

	AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES),NULL,NULL);
	CloseHandle(hToken);

	///

	CHAR szFileName[MAX_PATH] = {'\0'};
	GetModuleFileNameA(NULL, szFileName, MAX_PATH);

	DWORD  dwProcessID   = 0;
	PROCESSENTRY32W pe32 = { sizeof( PROCESSENTRY32W ) };
	HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	Process32FirstW(hSnapshot, &pe32);
	do
	{
		if (0 == lstrcmpiW(pe32.szExeFile, L"winlogon.exe"))
		{
			dwProcessID = pe32.th32ProcessID;
			break;
		}
	} while (Process32NextW(hSnapshot, &pe32));

	CloseHandle(hSnapshot);

	//

	HANDLE hTargetProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE,dwProcessID);
	HANDLE h= NULL;
	DuplicateHandle(hProcess,hProcess,hTargetProcess,&h,0,FALSE,DUPLICATE_SAME_ACCESS);
	const SIZE_T dwSize = 4096;
	const DWORD codeLen = dwSize - MAX_PATH - sizeof(HANDLE);


	PBYTE lpRemoteBuf = (PBYTE)VirtualAllocEx(hTargetProcess, NULL, dwSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	PBYTE pLocalBuf =(PBYTE)VirtualAlloc(NULL, dwSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

	HMODULE x =GetModuleHandleA("kernel32") ;
	memcpy(pLocalBuf,code,codeLen);
	*(PHANDLE(pLocalBuf+codeLen)) = h;
	*((FARPROC*)(pLocalBuf+codeLen- 4))  =GetProcAddress(x,"WaitForSingleObject");
	*((FARPROC*)(pLocalBuf+codeLen- 8))  =GetProcAddress(x,"CloseHandle");
	*((FARPROC*)(pLocalBuf+codeLen-12))  =GetProcAddress(x,"DeleteFileA");
	*((FARPROC*)(pLocalBuf+codeLen-16))  =GetProcAddress(x,"ExitThread");
	*((FARPROC*)(pLocalBuf+codeLen-20))  =GetProcAddress(x,"VirtualFree");
	memcpy(pLocalBuf+codeLen+4,szFileName,MAX_PATH);
	WriteProcessMemory(hTargetProcess, lpRemoteBuf, pLocalBuf,dwSize,0);
	VirtualFree(pLocalBuf, 0, MEM_RELEASE);

	HANDLE hThread = CreateRemoteThread(hTargetProcess, NULL, 0,
		(LPTHREAD_START_ROUTINE)lpRemoteBuf,
		(LPVOID)(lpRemoteBuf + codeLen + sizeof(HANDLE) ),0,0);

	CloseHandle(hThread);
	CloseHandle(hTargetProcess);

} 


int main()
{
	DeleteMe();
}