删除自身的程序代码

 

#include <windows.h>

#include <stdio.h>

#include <stdlib.h>

 

#define Cleanse(x) { res == (x); goto __cleanse; }

 

typedef BOOL (WINAPI *DELETEFILEA)(const char*);

 

struct remove_data

{

    char filename[_MAX_PATH];

    DELETEFILEA deleteFile;

};

 

DWORD WINAPI remove_code(LPVOID param)

{

    struct remove_data *p = (struct remove_data*)param;

    if (p && p->deleteFile)

    {

        while (!p->deleteFile(p->filename));

    }

    return 0;

}

 

int install_code(void)

{

    int res = 0;

    HWND hwnd;

    DWORD pid;

    DWORD tmp;

    HANDLE proc = NULL;

    HANDLE th = NULL;

    HINSTANCE lib;

    void *codemem, *datamem;

    struct remove_data rmvdata;

 

    if (!(hwnd = FindWindow("PROGMAN", NULL))) Cleanse(1);

 

    GetWindowThreadProcessId(hwnd, &pid);

    if (!(proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid))) Cleanse(2);

 

    codemem = VirtualAllocEx(proc, NULL, 4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

    datamem = VirtualAllocEx(proc, NULL, sizeof(struct remove_data), MEM_COMMIT, PAGE_READWRITE);

    if (!(codemem && datamem)) Cleanse(3);

 

    if (!WriteProcessMemory(proc, codemem, (void*)remove_code, 4096, &tmp)) Cleanse(4);

 

    lib = LoadLibrary("Kernel32.dll");

    if (!lib) Cleanse(5);

 

    rmvdata.deleteFile = (DELETEFILEA)GetProcAddress(lib, "DeleteFileA");

    if (!rmvdata.deleteFile) Cleanse(5);

 

    GetModuleFileName(NULL, rmvdata.filename, _MAX_PATH);

 

    if (!WriteProcessMemory(proc, datamem, &rmvdata, sizeof(rmvdata), &tmp)) Cleanse(6);

 

    if (!(th = CreateRemoteThread(proc, NULL, 0, (LPTHREAD_START_ROUTINE)codemem, datamem, 0, &tmp))) Cleanse(7);

 

__cleanse:

    switch (res)

    {

    case 1:

        printf("Can't find explorer window./n");

        break;

 

    case 2:

        printf("Can't open process./n");

        break;

 

    case 3:

        printf("Can't allocate memory./n");

        break;

 

    case 4:

        printf("Can't install code./n");

        break;

 

    case 5:

        printf("Can't get delete function./n");

        break;

 

    case 6:

        printf("Can't install data./n");

        break;

 

    case 7:

        printf("Can't launch delete routine./n");

        break;

 

    default:

        break;

    }

 

    if (proc) CloseHandle(proc);

    if (th) CloseHandle(th);

 

    return res;

}

 

int main(void)

{

    if (install_code() == 0)

    {

        printf("Press anykey to delete THIS program...");

        fflush(stdin);

        getchar();

    }

 

    return 0;

}