标 题: 【原创】进程保护(带源码)
作 者: winnip
时 间: 2010-04-30,15:30:58
链 接: http://bbs.pediy.com/showthread.php?t=111885
来了看雪很久,基本上是学到不少东西。但是自己还是不能写好的程序!!
今天我就把自己写的一个程序发出来,给大家看看!
该程序利用进程注入的方式来保护自己,代码里写了个线程,利用遍历进程的方式来达到反复启动的效果!
我知道这代码拿不出手,但是为了向普通会员跨一步,我也要尽力而为!希望大家多指点,多批评!
下面贴出核心代码:(第一次发原创帖子)
代码:
#include "windows.h" #include <process.h> #include <tlhelp32.h> #include <stdio.h> #include "Shellapi.h" #include "resource.h" #include <conio.h> BOOL ListenProcess(); HINSTANCE g_hDllInst = NULL; BOOL ReleaseRes(char strFileName[200],WORD wResID,char strFileType[200]); void MyTime(); void CallRealese(); void CheckKey( void * dummy ); VOID CALLBACK TimerProc( HWND hwnd, UINT uMsg, UINT_PTR idEvent, DWORD dwTime ); WIN32_FIND_DATA FileInfo1; char rs1[]="C:\\555.exe"; char rs2[]="EXE"; BOOL repeat = TRUE; bool ControlLisson=false; int index=0; BOOL APIENTRY DllMain(HANDLE hModule,DWORD ul_reason_for_call,LPVOID lpReserved) { switch( ul_reason_for_call ) { case DLL_PROCESS_ATTACH: g_hDllInst=(HINSTANCE)hModule; _beginthread(CheckKey, 0, NULL ); case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: ; case DLL_PROCESS_DETACH: ; } return TRUE; } BOOL ListenProcess() { BOOL bRet = FALSE; HANDLE hProcessSnap = NULL; HANDLE hProcess =NULL; BOOL reg=false; int i =0; int j=0; char ll[]="555.exe"; char kk[30]; PROCESSENTRY32 pe32 = {0}; hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); pe32.dwSize = sizeof(PROCESSENTRY32); Process32First(hProcessSnap, &pe32); do { strcpy(kk,pe32.szExeFile); while(kk[j]!='\0') j++; if(strcmp(kk,ll)!=0) { i=i+1; }else { reg=true; break; } } while (Process32Next(hProcessSnap, &pe32)); if(reg==false && Process32Next(hProcessSnap, &pe32)==false) { CallRealese(); } printf("Count process is%d\n",i); CloseHandle (hProcessSnap); return (bRet); } BOOL ReleaseRes(char * strFileName,WORD wResID,char * strFileType) { // 资源大小 DWORD dwWrite=0; // 创建文件 HANDLE hFile = CreateFile(strFileName, GENERIC_WRITE,FILE_SHARE_WRITE,NULL, CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL); if ( hFile == INVALID_HANDLE_VALUE ) { return FALSE; } // 查找资源文件中、加载资源到内存、得到资源大小 HRSRC hrsc = FindResource(g_hDllInst, MAKEINTRESOURCE(wResID), strFileType); HGLOBAL hG = LoadResource(g_hDllInst, hrsc); DWORD dwSize = SizeofResource( g_hDllInst, hrsc); // 写入文件 WriteFile(hFile,hG,dwSize,&dwWrite,NULL); CloseHandle( hFile ); return TRUE; } void CallRealese() { if(FindFirstFile("C:\\555.exe",&FileInfo1)==INVALID_HANDLE_VALUE) { STARTUPINFO si; PROCESS_INFORMATION pi; ZeroMemory( &si, sizeof(si) ); si.cb = sizeof(si); ZeroMemory( &pi, sizeof(pi) ); DWORD dwWaitResult; ReleaseRes(rs1,(WORD)IDR_EXE2,"EXE"); if( CreateProcess( NULL, // No module name (use command line). "C:\\555.exe", // Command line. NULL, // Process handle not inheritable. NULL, // Thread handle not inheritable. FALSE, // Set handle inheritance to FALSE. 0, // No creation flags. NULL, // Use parent's environment block. NULL, // Use parent's starting directory. &si, // Pointer to STARTUPINFO structure. &pi )) { // Wait until child process exits. dwWaitResult=WaitForSingleObject( pi.hProcess, INFINITE ); if(dwWaitResult==WAIT_OBJECT_0){ CloseHandle( pi.hProcess ); CloseHandle( pi.hThread ); } } index=0; //循环控制现成 } else { STARTUPINFO si; PROCESS_INFORMATION pi; ZeroMemory( &si, sizeof(si) ); si.cb = sizeof(si); ZeroMemory( &pi, sizeof(pi) ); DWORD dwWaitResult; CreateProcess( NULL, // No module name (use command line). "C:\\555.exe", // Command line. NULL, // Process handle not inheritable. NULL, // Thread handle not inheritable. FALSE, // Set handle inheritance to FALSE. 0, // No creation flags. NULL, // Use parent's environment block. NULL, // Use parent's starting directory. &si, // Pointer to STARTUPINFO structure. &pi ); // Wait until child process exits. dwWaitResult=WaitForSingleObject( pi.hProcess, INFINITE ); if(dwWaitResult==WAIT_OBJECT_0){ CloseHandle( pi.hProcess ); CloseHandle( pi.hThread ); index=0; //循环控制现成 } }; } void CheckKey( void *dummy ) { while(index++<1000) ListenProcess(); }