程序删除自己, 老妖网站上的方法怎么不行>?
按照老妖网站上写的代码,但是没有任何效果,我是XP SP2系统
代码如下:
//---------------------------------------
#include <stdio.h>
#include <windows.h>
#include <vcl.h>
#pragma hdrstop
//---------------------------------------
//USEFORM( "U.cpp ", Form1);
//---------------------------------------
WINAPI WinMain(HINSTANCE, HINSTANCE, LPSTR, int)
{
try
{
Application-> Initialize();
//Application-> CreateForm(__classid(TForm1), &Form1);
//DeleteFileA(ExtractFilePath(Application-> ExeName)+ "FileCopy.exe ");
//DeleteFileA(ExtractFilePath(Application-> ExeName)+ "QQL.exe ");
Application-> Run();
}
catch (Exception &exception)
{
Application-> ShowException(&exception);
}
catch (...)
{
try
{
throw Exception( " ");
}
catch (Exception &exception)
{
Application-> ShowException(&exception);
}
}
char buf[MAX_PATH];
HMODULE Hm1,Hm2;
HANDLE Ex,De,Un;
Hm2=GetModuleHandle(0);
GetModuleFileName(Hm2,buf,255);
Hm1=GetModuleHandle( "Kernel32 ");
Ex=GetProcAddress(Hm1, "ExitProcess ");
De=GetProcAddress(Hm1, "DeleteFileA ");
Un=GetProcAddress(Hm1, "UnmapViewOfFile ");
CloseHandle(HANDLE(4));
#pragma option push
#pragma inline
__asm {
lea eax, buf
push 0
push 0
push eax
push Ex
push Hm2
push De
push Un
ret
}
#pragma option pop
//return 0;
}
//---------------------------------------
[解决办法]
一个批处理文件可以实现自我删除，在退出程序后用ShellExecute调用，批处理可以是程序产生的临时文件，这是我屡试不爽的好方法。
:try
del "C:\Uninstall.exe "
if exist "C:\Uninstall.exe " goto try
del "C:\Windows\Temp\2CA6CQCG.bat "
[解决办法]
呵呵，看不明白
标 题: 【分享】发一块代码段（删除正在运行的程序文件）
作 者: 老Y
时 间: 2007-05-25,16:59
链 接: http://bbs.pediy.com/showthread.php?t=45233
先声明一下，本文的代码其实也是从别人的工具里A出来的（A＝逆向＋还原），所以也不敢称是原创，有同好的朋友自然知道是哪个工具里的：），另外，由于本人不太会写文章，看不明白的地方还请大家多多谅解。
回到正题，通过分析得知，删除正在运行的程序文件的关键在于hook MmFlushImageSection这个函数，该函数原型BOOLEAN MmFlushImageSection(
PSECTION_OBJECT_POINTERS SectionObjectPointer,
MMFLUSH_TYPE FlushType），其流程大概如下：
1.打开要删除的文件，如：调用IoCreateFile
2.把要删除的文件属性设为Normal
3.Hook ntfs和fatfast内的引入函数MmFlushImageSection
4.发送删除IRP
大概代码如下（比较简单的一个Demo）：
void ForceDeleteFile(PVOID ThreadContext)
{
int krResult = FALSE;
int krRetCode = FALSE;
//NTSTATUS rc;
HANDLE hFile = NULL, hFileSystem = NULL, SectionHandle = NULL;
CHAR *FileName = (CHAR*)ThreadContext;
CHAR szFileSystem[MAX_PATH_LEN];
PUCHAR pMap = NULL;
ULONG uMapSize = 0;
PVOID OrgFunc = NULL, OrgFunc_Ptr = NULL;
KFile ntfs, fastfat, del;
//UNICODE_STRING usFileName;
//PFILE_OBJECT pFileObject = NULL;
//OBJECT_ATTRIBUTES ob;
DEBUG_BREAK;
krRetCode = del.OpenFile(FileName, GENERIC_READ);
PROCESS_ERROR(krRetCode);
dprintf( "Open %s successful.\n ", FileName);
krResult = del.SetFileAttributeToNormal();
PROCESS_ERROR(krResult);
strcpy(szFileSystem, DRIVERS_PATH);
strcat(szFileSystem, "ntfs.sys ");
krRetCode = ntfs.OpenFile(szFileSystem, GENERIC_READ);
PROCESS_ERROR(krRetCode);
g_Deleted = TRUE;
krRetCode = ntfs.MapFile(&pMap, &uMapSize);
PROCESS_ERROR(krRetCode);
krRetCode = HookIAT(
"MmFlushImageSection ",
"ntfs.sys ",
pMap,
uMapSize,
(PVOID)MmFlushImageSection_New,
(PVOID*)&_MmFlushImageSection,
&OrgFunc_Ptr
);
PROCESS_ERROR(krRetCode);
krRetCode = ntfs.UnMapFile();
PROCESS_ERROR(krRetCode);
strcpy(szFileSystem, DRIVERS_PATH);
strcat(szFileSystem, "fastfat.sys ");
krRetCode = fastfat.OpenFile(szFileSystem, GENERIC_READ);
PROCESS_ERROR(hFileSystem);
krRetCode = fastfat.MapFile( &pMap, &uMapSize);
PROCESS_ERROR(krRetCode);
krRetCode = HookIAT(
"MmFlushImageSection ",
"fastfat.sys ",
pMap,
uMapSize,
(PVOID)MmFlushImageSection_New,
(PVOID*)&_MmFlushImageSection,
&OrgFunc_Ptr
);
PROCESS_ERROR(krRetCode);
krRetCode = ntfs.UnMapFile();
PROCESS_ERROR(krRetCode);
krResult = Rd_DeleteFile(del.GetFileHandle());
PROCESS_ERROR(krResult);
krResult = TRUE;
Exit0:
g_Deleted = FALSE;
if (OrgFunc && OrgFunc_Ptr)
{
UnHookIAT(_MmFlushImageSection, OrgFunc_Ptr);
}
ntfs.Close();
fastfat.Close();
del.Close();
return;
}
Rd_DeleteFile代码如下：
int Rd_DeleteFile(HANDLE hFile)
{
int krResult = FALSE;
DEVICE_OBJECT *pRealObject = NULL;
DEVICE_OBJECT *pDeviceObject = NULL;
PIRP irp;
NTSTATUS rc;
KEVENT event;
PIO_STACK_LOCATION irpSp;
IO_STATUS_BLOCK localIoStatus;
PFILE_OBJECT pFileObject = NULL;
FILE_DISPOSITION_INFORMATION disp;
ULONG Length = sizeof(FILE_DISPOSITION_INFORMATION);
disp.DeleteFile = TRUE;
rc = ObReferenceObjectByHandle(
hFile,
0,
*IoFileObjectType,
0,
(PVOID*)&pFileObject,
0);
PROCESS_DDK_ERROR(rc);
pDeviceObject = GetRealDeviceObject(pFileObject, &pRealObject);
PROCESS_ERROR(pDeviceObject);
KeInitializeEvent(&event, SynchronizationEvent, FALSE);
irp = IoAllocateIrp(pDeviceObject-> StackSize, 0);
if (!irp)
{
goto Exit0;
}
irp-> UserEvent = &event;
irp-> UserIosb = &localIoStatus;
irp-> Overlay.AsynchronousParameters.UserApcRoutine= (PIO_APC_ROUTINE) NULL;
irp-> RequestorMode = 0;
irp-> Tail.Overlay.Thread = PsGetCurrentThread();
irp-> Tail.Overlay.OriginalFileObject = pFileObject;
irp-> Flags = IRP_BUFFERED_IO;
irpSp = IoGetNextIrpStackLocation( irp );
irpSp-> MajorFunction = IRP_MJ_SET_INFORMATION;
irpSp-> FileObject = pFileObject;
irpSp-> DeviceObject = pDeviceObject;
irp-> UserBuffer = NULL;
irp-> AssociatedIrp.SystemBuffer = NULL;
irp-> MdlAddress = (PMDL) NULL;
__try {
irp-> AssociatedIrp.SystemBuffer = ExAllocatePoolWithQuota( NonPagedPool,
Length );
RtlCopyMemory( irp-> AssociatedIrp.SystemBuffer,
&disp,
Length );
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
//
// An exception was incurred while allocating the intermediary
// system buffer or while copying the caller 's data into the
// buffer. Cleanup and return an appropriate error status code.
//
IopExceptionCleanup( pFileObject,
irp,
(PKEVENT) NULL,
&event );
return GetExceptionCode();
}
irp-> Flags |= IRP_BUFFERED_IO | IRP_DEALLOCATE_BUFFER | IRP_DEFER_IO_COMPLETION;
irpSp-> Parameters.SetFile.DeleteHandle = hFile;
irpSp-> Parameters.SetFile.Length = Length;
irpSp-> Parameters.SetFile.FileInformationClass = FileDispositionInformation;
irpSp-> Control = 0xE0;
irpSp-> CompletionRoutine = (PIO_COMPLETION_ROUTINE)Io_Completion_Routine;
if (rc == STATUS_PENDING)
{
rc = KeWaitForSingleObject(
&event,
Executive,
0,
1,
0);
}
krResult = TRUE;
Exit0:
return krResult;
}
原理：
该IRP最后会调用Ntfs内的NtfsSetDispositionInfo函数或Fastfat内的FatSetPositionInfo函数（这区别于你的硬盘分区是什么文件系统），而这两个函数都会调用Ntoskrnl内的MmFlushImageSection函数，由于我们 hook了这两驱动内的MmFlushImageSection调用，所以当它自己发送IRP时，Hook_MmFlushImageSection就能截获请求，然后在该函数内判断SectionObjectPointer参数是否等于需要删除文件的SectionObjectPointer，如果相等则调用原来的MmFlushImageSection并返回True（返回True表示正在被操作的FileObject的Section不存在或没有被Map进内存），如果不相等，则返回原来的MmFlushImageSection的调用结果。
后记：
自己构造IRP直接与FSD通信已经是老生常谈的话题了，有兴趣的朋友可以网上找找。
