/*
A code removes itself
*/
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#define Cleanse(x) { res == (x); goto __cleanse; }
typedef BOOL (WINAPI *DELETEFILEA)(const char*);
struct remove_data
{
char filename[_MAX_PATH];
DELETEFILEA deleteFile;
};
DWORD WINAPI remove_code(LPVOID param)
{
struct remove_data *p = (struct remove_data*)param;
if (p && p->deleteFile)
{
while (!p->deleteFile(p->filename));
}
return 0;
}
int install_code(void)
{
int res = 0;
HWND hwnd;
DWORD pid;
DWORD tmp;
HANDLE proc = NULL;
HANDLE th = NULL;
HINSTANCE lib;
void *codemem, *datamem;
struct remove_data rmvdata;
if (!(hwnd = FindWindow("PROGMAN", NULL))) Cleanse(1);
GetWindowThreadProcessId(hwnd, &pid);
if (!(proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid))) Cleanse(2);
codemem = VirtualAllocEx(proc, NULL, 4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
datamem = VirtualAllocEx(proc, NULL, sizeof(struct remove_data), MEM_COMMIT, PAGE_READWRITE);
if (!(codemem && datamem)) Cleanse(3);
if (!WriteProcessMemory(proc, codemem, (void*)remove_code, 4096, &tmp)) Cleanse(4);
lib = LoadLibrary("Kernel32.dll");
if (!lib) Cleanse(5);
rmvdata.deleteFile = (DELETEFILEA)GetProcAddress(lib, "DeleteFileA");
if (!rmvdata.deleteFile) Cleanse(5);
GetModuleFileName(NULL, rmvdata.filename, _MAX_PATH);
if (!WriteProcessMemory(proc, datamem, &rmvdata, sizeof(rmvdata), &tmp)) Cleanse(6);
if (!(th = CreateRemoteThread(proc, NULL, 0, (LPTHREAD_START_ROUTINE)codemem, datamem, 0, &tmp))) Cleanse(7);
__cleanse:
switch (res)
{
case 1:
printf("Can't find explorer window./n");
break;
case 2:
printf("Can't open process./n");
break;
case 3:
printf("Can't allocate memory./n");
break;
case 4:
printf("Can't install code./n");
break;
case 5:
printf("Can't get delete function./n");
break;
case 6:
printf("Can't install data./n");
break;
case 7:
printf("Can't launch delete routine./n");
break;
default:
break;
}
if (proc) CloseHandle(proc);
if (th) CloseHandle(th);
return res;
}
int main(void)
{
if (install_code() == 0)
{
printf("Press anykey to delete THIS program...");
fflush(stdin);
getchar();
}
return 0;
}
删除自身exe文件的方法
最新推荐文章于 2022-12-02 14:41:32 发布