frmmain.frm

vb编制的木马加花器

VERSION 5.00
Begin VB.Form frmMain 
   BorderStyle     =   1  'Fixed Single
   Caption         =   "kylin_Fake V1.0"
   ClientHeight    =   3450
   ClientLeft      =   4695
   ClientTop       =   3360
   ClientWidth     =   5490
   Icon            =   "frmMain.frx":0000
   LinkTopic       =   "Form1"
   MaxButton       =   0   'False
   ScaleHeight     =   3450
   ScaleWidth      =   5490
   Begin VB.Frame Frame1 
      Height          =   3255
      Left            =   120
      TabIndex        =   0
      Top             =   0
      Width           =   5295
      Begin VB.CheckBox chkTopMost 
         Caption         =   "置顶"
         Height          =   255
         Left            =   4320
         TabIndex        =   14
         Top             =   1920
         Width           =   735
      End
      Begin VB.CommandButton cmdAddFakeCode 
         Caption         =   "加花"
         Height          =   320
         Left            =   4080
         TabIndex        =   9
         Top             =   1425
         Width           =   855
      End
      Begin VB.TextBox txtFilePath 
         Height          =   300
         Left            =   240
         TabIndex        =   8
         Text            =   "请选择路径或直接拖文件到此窗口..."
         Top             =   600
         Width           =   3735
      End
      Begin VB.CommandButton cmdBrowerFilePath 
         Caption         =   "..."
         Height          =   300
         Left            =   4200
         TabIndex        =   7
         Top             =   600
         Width           =   495
      End
      Begin VB.ComboBox ComboFakeCode 
         Height          =   300
         Left            =   240
         TabIndex        =   6
         Top             =   1440
         Width           =   3735
      End
      Begin VB.TextBox txtSectionName 
         Height          =   270
         Left            =   360
         TabIndex        =   5
         Text            =   ".kylin"
         Top             =   2040
         Width           =   1095
      End
      Begin VB.CheckBox chkBakFile 
         Caption         =   "备份文件"
         Height          =   375
         Left            =   2400
         TabIndex        =   4
         Top             =   2640
         Value           =   1  'Checked
         Width           =   1095
      End
      Begin VB.CheckBox chkIsDebuggerPresent 
         Caption         =   "反调试"
         Height          =   255
         Left            =   2400
         TabIndex        =   3
         Top             =   1920
         Width           =   975
      End
      Begin VB.CheckBox chkModifySectionName 
         Caption         =   "修改所有区段名称"
         Height          =   255
         Left            =   2400
         TabIndex        =   2
         Top             =   2280
         Width           =   1815
      End
      Begin VB.TextBox txtSectionSize 
         Height          =   270
         Left            =   360
         TabIndex        =   1
         Text            =   "512"
         Top             =   2640
         Width           =   1095
      End
      Begin VB.Label Label4 
         AutoSize        =   -1  'True
         Caption         =   "文件位置："
         Height          =   180
         Left            =   240
         TabIndex        =   13
         Top             =   240
         Width           =   900
      End
      Begin VB.Label Label1 
         AutoSize        =   -1  'True
         Caption         =   "请选择花指令："
         Height          =   180
         Left            =   240
         TabIndex        =   12
         Top             =   1080
         Width           =   1260
      End
      Begin VB.Label Label2 
         AutoSize        =   -1  'True
         Caption         =   "区段名称："
         Height          =   180
         Left            =   240
         TabIndex        =   11
         Top             =   1800
         Width           =   900
      End
      Begin VB.Label Label3 
         AutoSize        =   -1  'True
         Caption         =   "区段大小："
         Height          =   180
         Left            =   240
         TabIndex        =   10
         Top             =   2400
         Width           =   900
      End
   End
End
Attribute VB_Name = "frmMain"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
'********************************************
''' 作者:kylinpoet or 獬独
''''2007-05-14 23:44 初稿
''''2007-05-15 13:32 修改
''''转载请保留作者 声明
'********************************************
''''工程需要引用 microsof xml refrence
'修改日志
'2007-05-21 15:30 添加置顶按钮
'2007-05-21 09:22 可使用自定义指令
'********************************************
Dim strFakeCode As String
Dim xmlReadWrite As New vbXML

Private Sub chkTopMost_Click()
If chkTopMost.Value = vbChecked Then
        SetWindowPos Me.hwnd, HWND_TOPMOST, 0, 0, 0, 0, _
        SWP_NOACTIVATE Or SWP_SHOWWINDOW Or SWP_NOMOVE _
        Or SWP_NOSIZE
Else
        SetWindowPos Me.hwnd, HWND_NOTOPMOST, 0, 0, 0, 0, _
        SWP_NOACTIVATE Or SWP_SHOWWINDOW Or SWP_NOMOVE _
        Or SWP_NOSIZE
End If
End Sub

Private Sub cmdBrowerFilePath_Click()
Dim OpenFile As OPENFILENAME
Dim lReturn As Long
Dim sFilter As String
    OpenFile.lStructSize = Len(OpenFile)
    OpenFile.hwndOwner = Me.hwnd
    OpenFile.hInstance = App.hInstance
    sFilter = "exe文件" & Chr(0) & "*.exe" & Chr(0) & "dll文件" & Chr(0) & "*.dll" & Chr(0) & "所有文件" & Chr(0) & "*.*" & Chr(0)
    OpenFile.lpstrFilter = sFilter
    OpenFile.nFilterIndex = 1
    OpenFile.lpstrFile = String(257, 0)
    OpenFile.nMaxFile = Len(OpenFile.lpstrFile) - 1
    OpenFile.lpstrFileTitle = OpenFile.lpstrFile
    OpenFile.nMaxFileTitle = OpenFile.nMaxFile
    'OpenFile.lpstrInitialDir = "C:\"
    OpenFile.lpstrTitle = "打开"
    OpenFile.flags = 0
    lReturn = GetOpenFileName(OpenFile)
    If lReturn <> 0 Then
        txtFilePath.Text = OpenFile.lpstrFile
    End If
End Sub

Private Sub cmdAddFakeCode_Click()
Dim FilePath As String
Dim Ret As Long
Dim hFile As Long
Dim dwPE_Header_OffSet As Long
Dim Buffer(100) As Byte
Dim lngBytesRead As Long
Dim SAttributes As SECURITY_ATTRIBUTES
Dim SECTION_Header As IMAGE_SECTION_HEADER
Dim OPTIONAL_Header As IMAGE_OPTIONAL_HEADER
Dim SECTION_Num As Long
Dim SECTION_Mount As Long
Dim Old_AddressOfEntryPoint As Long
Dim Old_ImageBase As Long
Dim dwMySectionOffSet As Long
Dim dwLastSection_SizeOfRawData As Long
Dim dwLastSection_PointerToRawData As Long
Dim PE_Header As IMAGE_NT_HEADERS
Dim NewOffset As Long
Dim strNewSectionName As String
Dim lngNewSectionSize  As Long
Dim lngjmpOffset As Long
Dim i As Long
Dim Section_Offset As Long


FilePath = txtFilePath.Text
If FilePath = "" Or Dir(FilePath) = "" Then
    MsgBox "找不到文件", vbInformation + vbOKOnly, "提示"
    Exit Sub
End If
strNewSectionName = txtSectionName.Text
lngNewSectionSize = Val(txtSectionSize.Text)
If lngNewSectionSize = 0 Then
    lngNewSectionSize = 512
End If
If chkBakFile Then '备份文件
    FileCopy FilePath, FilePath & ".kylin"
End If
Ret = CreateFile(FilePath, _
                GENERIC_READ Or GENERIC_WRITE, _
                FILE_SHARE_READ Or FILE_SHARE_WRITE, _
                SAttributes, _
                OPEN_EXISTING, _
                FILE_ATTRIBUTE_NORMAL, _
                0)
If Ret = INVALID_HANDLE_VALUE Then
    MsgBox "文件打开错误", vbInformation + vbOKOnly, "提示"
    Exit Sub