在Windows 7上自動刪除EXE

Question

我在互聯網上發現了這個代碼，但它說要在Windows XP上運行。 我試圖在Windows 7上運行它，它的工作，但我不知道它是安全的，不只是運行此代碼，而且這樣做在Windows 7

// 
// Self-deleting exe under Windows XP 
// 
#include <windows.h> 
#include <tchar.h> 

// get this right! 
#define EXPLORER_PID 1444 

typedef UINT (WINAPI * WAIT_PROC)(HANDLE, DWORD); // WaitForSingleObject 
typedef BOOL (WINAPI * CLOSE_PROC)(HANDLE);  // CloseHandle 
typedef BOOL (WINAPI * DELETE_PROC)(LPCTSTR);  // DeleteFile 
typedef VOID (WINAPI * EXIT_PROC)(DWORD);   // ExitProcess 

typedef struct 
{ 
    WAIT_PROC fnWaitForSingleObject; 
    CLOSE_PROC fnCloseHandle; 
    DELETE_PROC fnDeleteFile; 
    EXIT_PROC fnExitProcess; 

    HANDLE  hProcess; 
    TCHAR  szFileName[MAX_PATH]; 

} INJECT; 

#pragma optimize("gsy", off) 
#pragma check_stack(off)  // doesn't work :-(

DWORD WINAPI RemoteThread(INJECT *remote) 
{ 
    remote->fnWaitForSingleObject(remote->hProcess, INFINITE); 
    remote->fnCloseHandle(remote->hProcess); 
    remote->fnDeleteFile(remote->szFileName); 
    remote->fnExitProcess(0); 

    return 0; 
} 

#pragma check_stack 

HANDLE GetRemoteProcess() 
{ 
    STARTUPINFO   si = { sizeof(si) }; 
    PROCESS_INFORMATION pi; 

    //return OpenProcess(PROCESS_ALL_ACCESS, FALSE, EXPLORER_PID); 

    if(CreateProcess(0, "explorer.exe", 0, 0, FALSE, CREATE_SUSPENDED|CREATE_NO_WINDOW|IDLE_PRIORITY_CLASS, 0, 0, &si, &pi)) 
    { 
     CloseHandle(pi.hThread); 
     return pi.hProcess; 
    } 
    else 
    { 
     return 0; 
    } 
} 

PVOID GetFunctionAddr(PVOID func) 
{ 
#ifdef _DEBUG 

    // get address of function from the JMP <relative> instruction 
    DWORD *offset = (BYTE *)func + 1; 
    return (PVOID)(*offset + (BYTE *)func + 5); 

#else 

    return func; 

#endif 
} 

BOOL SelfDelete() 
{ 
    INJECT local, *remote; 
    BYTE *code; 
    HMODULE hKernel32; 
    HANDLE hRemoteProcess; 
    HANDLE hCurProc; 

    DWORD dwThreadId; 
    HANDLE hThread = 0; 

    char ach[80]; 

    hRemoteProcess = GetRemoteProcess(); 

    if(hRemoteProcess == 0) 
     return FALSE; 

    // Allocate memory in remote process 
    code = VirtualAllocEx(hRemoteProcess, 0, sizeof(INJECT) + 128, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE); 

    if(code == 0) 
    { 
     CloseHandle(hRemoteProcess); 
     return FALSE; 
    } 

    hKernel32 = GetModuleHandle(_T("kernel32.dll")); 

    // setup remote structure 
    remote = (INJECT *)(code + 128); 

    local.fnWaitForSingleObject = (WAIT_PROC)GetProcAddress(hKernel32, "WaitForSingleObject"); 
    local.fnCloseHandle   = (CLOSE_PROC)GetProcAddress(hKernel32, "CloseHandle"); 
    local.fnExitProcess   = (EXIT_PROC)GetProcAddress(hKernel32, "ExitProcess"); 

#ifdef UNICODE 
    local.fnDeleteFile   = (DELETE_PROC)GetProcAddress(hKernel32, "DeleteFileW"); 
#else 
    local.fnDeleteFile   = (DELETE_PROC)GetProcAddress(hKernel32, "DeleteFileA"); 
#endif 

    // duplicate our own process handle for remote process to wait on 
    hCurProc = GetCurrentProcess(); 
    DuplicateHandle(hCurProc, hCurProc, hRemoteProcess, &local.hProcess, 0, FALSE, DUPLICATE_SAME_ACCESS); 

    // find name of current executable 
    GetModuleFileName(NULL, local.szFileName, MAX_PATH); 

    // write in code to execute, and the remote structure 
    WriteProcessMemory(hRemoteProcess, code, GetFunctionAddr(RemoteThread), 128, 0); 
    WriteProcessMemory(hRemoteProcess, remote, &local, sizeof(local), 0); 

    wsprintf(ach, "%x %x\n", code, remote); 
    OutputDebugString(ach); 

    // execute the code in remote process 
    hThread = CreateRemoteThread(hRemoteProcess, 0, 0, code, remote, 0, &dwThreadId); 

    if(hThread != 0) 
    { 
     CloseHandle(hThread); 
    } 

    return TRUE; 
} 

int main(void) 
{ 
    SelfDelete(); 

    return 0; 
} 

順便說一句，怎麼會這樣用作C/C++中的庫？我的目標是僅僅使用，例如，

#include "selfdel.h"所以我可以在C++程序中使用功能SelfDelete()。

Answer 1

你應該知道這段代碼是什麼。這是將代碼注入到另一個進程中，該進程將作爲該進程執行，然後該進程將退出。它應該只是工作（儘管看下面的評論）。我認爲這個代碼片段的作者已經在Win Vista發佈之前寫過它，因此你擔心。

你可以在你的「selfdel.h」中聲明SelfDelete()。調用這個函數並立即退出應該會訣竅。

該實現不需要來自庫的用戶的任何輸入，因爲它獲取了它所需的所有內容。

// duplicate our own process handle for remote process to wait on 
hCurProc = GetCurrentProcess(); 
... 
// find name of current executable 
GetModuleFileName(NULL, local.szFileName, MAX_PATH); 

一些評論：

• 你的過程中應該有足夠的權限創建另一個
• 這種活動可以通過殺毒軟件將其視爲可疑
• 不要忘了，只要您的程序在呼叫後生存，「殭屍」進程就會等待SelfDelete()
• 考慮其他方法：How can a program delete its own executable