loadtmx.bat

来自「Cracker终结者——提供最优秀的软件保护技术」· Batch 代码 · 共 57 行

;@GOTO -)
.586P
.MODEL FLAT
INCLUDE WINDOWS.inc
UNICODE=0
INCLUDE APIMACRO.mac
INCLUDE APIHOOKS.inc
INCLUDELIB iKERNEL32
INCLUDELIB iNTDLL
INCLUDELIB iAPIHOOKS
.CODE
   prinfo      PROCESS_INFORMATION   <>
   stinfo      STARTUPINFO           <STARTUPINFO>
   TEXT        zProcExp, <PROCEXP/0>
   TEXT        zTaskMgr, <TASKMGR/0>
   TEXTA       zDllx,    <TMext0>
   TEXTA       Numero,   <0>
   ASTRING               <.dll/0>

 Start:
   ;AH 3.8+ don't enable debug privilege explicitly
   PUSH        ECX
   iWin32      RtlAdjustPrivilege, 20, TRUE, 0, ESP
   POP         ECX

   SUB         EBP, EBP

   iWin32i     CreateProcess, EBP, szProcExp, EBP, EBP, EBP,\
                              CREATE_SUSPENDED, EBP, EBP,\            
                              OFFSET stinfo, OFFSET prinfo
   TEST        EAX, EAX
   JNE         @F

   iWin32i     CreateProcess, EBP, szTaskMgr, EBP, EBP, EBP,\
                              CREATE_SUSPENDED, EBP, EBP,\            
                              OFFSET stinfo, OFFSET prinfo
   TEST        EAX, EAX
   JE          Exit
  @@:
   INC         Numero
   iWin32      EstablishApiHooksA, NULL, szDllx, prinfo.dwProcessId, 30000
   CMP         Numero, '9'
   JB          @B   
   iWin32      ResumeThread, prinfo.hThread
   iWin32      CloseHandle,  prinfo.hProcess
   iWin32      CloseHandle,  prinfo.hThread
  Exit:
   iWin32      ExitProcess,  EBP
END Start
:-)
@ECHO OFF
ML /c /coff /Gz /Cp /nologo LoadTMx.bat
ELINK LoadTMx /nologo /IGNORE:4078 /SUBSYSTEM:WINDOWS /MERGE:.idata=.text /SECTION:.text,EWR
DEL LoadTMx.obj
PAUSE
CLS