selfdeletedlg.cpp

很多木马程序都是运用了自动销毁技术

// SelfDeleteDlg.cpp : implementation file
//

#include "stdafx.h"
#include "SelfDelete.h"
#include "SelfDeleteDlg.h"

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif

/////////////////////////////////////////////////////////////////////////////
// CSelfDeleteDlg dialog

CSelfDeleteDlg::CSelfDeleteDlg(CWnd* pParent /*=NULL*/)
	: CDialog(CSelfDeleteDlg::IDD, pParent)
{
	//{{AFX_DATA_INIT(CSelfDeleteDlg)
		// NOTE: the ClassWizard will add member initialization here
	//}}AFX_DATA_INIT
	// Note that LoadIcon does not require a subsequent DestroyIcon in Win32
	m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME);
}

void CSelfDeleteDlg::DoDataExchange(CDataExchange* pDX)
{
	CDialog::DoDataExchange(pDX);
	//{{AFX_DATA_MAP(CSelfDeleteDlg)
		// NOTE: the ClassWizard will add DDX and DDV calls here
	//}}AFX_DATA_MAP
}

BEGIN_MESSAGE_MAP(CSelfDeleteDlg, CDialog)
	//{{AFX_MSG_MAP(CSelfDeleteDlg)
	ON_WM_PAINT()
	ON_WM_QUERYDRAGICON()
	//}}AFX_MSG_MAP
END_MESSAGE_MAP()

/////////////////////////////////////////////////////////////////////////////
// CSelfDeleteDlg message handlers

BOOL CSelfDeleteDlg::OnInitDialog()
{
	CDialog::OnInitDialog();

	// Set the icon for this dialog.  The framework does this automatically
	//  when the application's main window is not a dialog
	SetIcon(m_hIcon, TRUE);			// Set big icon
	SetIcon(m_hIcon, FALSE);		// Set small icon
		
	return TRUE;  // return TRUE  unless you set the focus to a control
}

// If you add a minimize button to your dialog, you will need the code below
//  to draw the icon.  For MFC applications using the document/view model,
//  this is automatically done for you by the framework.

void CSelfDeleteDlg::OnPaint() 
{
	if (IsIconic())
	{
		CPaintDC dc(this); // device context for painting

		SendMessage(WM_ICONERASEBKGND, (WPARAM) dc.GetSafeHdc(), 0);

		// Center icon in client rectangle
		int cxIcon = GetSystemMetrics(SM_CXICON);
		int cyIcon = GetSystemMetrics(SM_CYICON);
		CRect rect;
		GetClientRect(&rect);
		int x = (rect.Width() - cxIcon + 1) / 2;
		int y = (rect.Height() - cyIcon + 1) / 2;

		// Draw the icon
		dc.DrawIcon(x, y, m_hIcon);
	}
	else
	{
		CDialog::OnPaint();
	}
}

// The system calls this to obtain the cursor to display while the user drags
//  the minimized window.
HCURSOR CSelfDeleteDlg::OnQueryDragIcon()
{
	return (HCURSOR) m_hIcon;
}

void CSelfDeleteDlg::OnOK() 
{
    SelfDelete();
	CDialog::OnOK();
   /* 
    // 下段代码也实现了程序的自删除，但是它只适用于Windows NT/2000系统，程序非常简洁
	// SelfDelete()函数适用于Windows 98/ME/NT/2000，其基本原理也来自下段代码
	HMODULE module = GetModuleHandle(0); 
    CHAR buf[MAX_PATH]; 
    GetModuleFileName(module, buf, sizeof buf); 
    CloseHandle(HANDLE(4)); 
    _asm 
	{ 
        lea eax, buf 
        push 0 
        push 0 
		push eax 
		push ExitProcess 
		push module 
		push DeleteFile 
		push UnmapViewOfFile 
		ret 
	} */
}

// 实现自删除的函数
BOOL CSelfDeleteDlg::SelfDelete()
{
    typedef int (WINAPI *PFClose)(LPVOID);
	OSVERSIONINFO os_info;
	os_info.dwOSVersionInfoSize=sizeof(os_info);
	LPVOID pBuffer=NULL;
	PFClose pClose,pDelete;
	char fn[4096];
	HINSTANCE hins=GetModuleHandle(NULL); // 得到本程序句柄
	GetModuleFileName(NULL,fn,4096);      // 得到本程序名称
	if(!GetVersionEx(&os_info))           // 得到当前Windows系统版本
	   return FALSE;
    
	switch(os_info.dwPlatformId)
	{
		   case VER_PLATFORM_WIN32_NT:    // 当前系统为WinNT平台系统
				__try
				{
					while(CloseHandle((HANDLE)4));
				}
				__except(1)
				{	}
                CloseHandle((HANDLE)4);
                pClose=PFClose(UnmapViewOfFile);
                break;
           case VER_PLATFORM_WIN32_WINDOWS: // 当前系统为Win9X平台系统
                pClose=PFClose(FreeLibrary);
                break;
           default:
                return FALSE;
	}
    pDelete=PFClose(DeleteFile);
    pBuffer=VirtualAlloc(NULL,4096,MEM_COMMIT,PAGE_EXECUTE_READWRITE);    
	_asm
	{
		 call _delete_end
	}
    _asm   // 尝试关闭并删除程序
	{
     _test_close:
         push hins
		 call [pClose]   // 关闭程序
		 or eax,eax
		 jz _test_close
		 lea eax,fn
         push eax
         call [pDelete]  // 删除程序 
         or eax,eax
         jz _Exit_Process
         call eax
     _Exit_Process:  // 退出进程
		 push 0
		 push MEM_RELEASE
         push 0
         push pBuffer 
         push ExitProcess  // 退出进程
         push VirtualFree
         ret
	}
	_delete_end:     // 删除准备工作
	_asm	
	{
	     pop ebx
         push 128
	     push ebx
		 push [pBuffer]
		 call memcpy
         jmp pBuffer
	}
    return TRUE;
}