文件名称:DLL自卸载无模块注入源码
介绍说明--下载内容来自于网络,使用问题请自行百度
.版本 2
hFile = CreateFileA (strFileName, #GENERIC_READ, #FILE_SHARE_READ, 0, #OPEN_EXISTING, #FILE_ATTRIBUTE_NORMAL, 0)
.如果真 (hFile = -1)
返回 (假)
.如果真结束
pFileBuff = 0
nFileSize = GetFileSize (hFile, 0)
.如果真 (nFileSize = 0)
返回 (假)
.如果真结束
pFileBuff = VirtualAlloc (0, nFileSize, #MEM_COMMIT, #PAGE_EXECUTE_READWRITE)
dwReadSize = 0
.如果真 (ReadFile (hFile, pFileBuff, nFileSize, dwReadSize, 0) = 假)
返回 (假)
.如果真结束
pBase = pFileBuff
' 判断是否是PE
p强转数组 [1] = 强制转换 (pIDH, pFileBuff)
.如果真 (pIDH.e_magic ≠ 23117)
返回 (假)
.如果真结束
ptmp = pFileBuff + 读内存整数型 (-1, pFileBuff + 60)
p强转数组 [2] = 强制转换 (pINH, ptmp)
.如果真 (pINH.Signature ≠ 17744)
返回 (假)
.如果真结束
dwMemSize = nFileSize
pAllocMem = pFileBuff
强制转换 (pIDH, p强转数组 [1])
强制转换 (pINH, p强转数组 [2])
返回 (真)(Version 2
HFile = CreateFileA (strFileName, #GENERIC_READ, #FILE_SHARE_READ, 0, #OPEN_EXISTING, #FILE_ATTRIBUTE_NORMAL, 0)
If true (hFile = -1)
Return (false)
If it is over
PFileBuff = 0
NFileSize = GetFileSize (hFile, 0)
If true (nFileSize = 0)
Return (false)
If it is over
PFileBuff = VirtualAlloc (0, nFileSize, #MEM_COMMIT, #PAGE_EXECUTE_READWRITE)
DwReadSize = 0
If true (ReadFile (hFile, pFileBuff, nFileSize, dwReadSize, 0) = false)
Return (false)
If it is over
PBase = pFileBuff
'whether the judgment is PE
P strong turn array [1] = forced conversion (pIDH, pFileBuff)
If (pIDH.e_magic = 23117)
Return (false)
If it is over
PTMP = PFileBuff read memory integer type (-1, PFileBuff60)
P strong turn array [2] = forced conversion (pINH, PTMP)
If (pINH.Signature = 17744)
Return (false)
If it is over
DwMemSize = nFileSize
PAllocMem = pFileBuff
Forced conversion (pIDH, P strong turn array [1])
Forced conversion (pINH, P strong turn array [2])
Return to (true))
hFile = CreateFileA (strFileName, #GENERIC_READ, #FILE_SHARE_READ, 0, #OPEN_EXISTING, #FILE_ATTRIBUTE_NORMAL, 0)
.如果真 (hFile = -1)
返回 (假)
.如果真结束
pFileBuff = 0
nFileSize = GetFileSize (hFile, 0)
.如果真 (nFileSize = 0)
返回 (假)
.如果真结束
pFileBuff = VirtualAlloc (0, nFileSize, #MEM_COMMIT, #PAGE_EXECUTE_READWRITE)
dwReadSize = 0
.如果真 (ReadFile (hFile, pFileBuff, nFileSize, dwReadSize, 0) = 假)
返回 (假)
.如果真结束
pBase = pFileBuff
' 判断是否是PE
p强转数组 [1] = 强制转换 (pIDH, pFileBuff)
.如果真 (pIDH.e_magic ≠ 23117)
返回 (假)
.如果真结束
ptmp = pFileBuff + 读内存整数型 (-1, pFileBuff + 60)
p强转数组 [2] = 强制转换 (pINH, ptmp)
.如果真 (pINH.Signature ≠ 17744)
返回 (假)
.如果真结束
dwMemSize = nFileSize
pAllocMem = pFileBuff
强制转换 (pIDH, p强转数组 [1])
强制转换 (pINH, p强转数组 [2])
返回 (真)(Version 2
HFile = CreateFileA (strFileName, #GENERIC_READ, #FILE_SHARE_READ, 0, #OPEN_EXISTING, #FILE_ATTRIBUTE_NORMAL, 0)
If true (hFile = -1)
Return (false)
If it is over
PFileBuff = 0
NFileSize = GetFileSize (hFile, 0)
If true (nFileSize = 0)
Return (false)
If it is over
PFileBuff = VirtualAlloc (0, nFileSize, #MEM_COMMIT, #PAGE_EXECUTE_READWRITE)
DwReadSize = 0
If true (ReadFile (hFile, pFileBuff, nFileSize, dwReadSize, 0) = false)
Return (false)
If it is over
PBase = pFileBuff
'whether the judgment is PE
P strong turn array [1] = forced conversion (pIDH, pFileBuff)
If (pIDH.e_magic = 23117)
Return (false)
If it is over
PTMP = PFileBuff read memory integer type (-1, PFileBuff60)
P strong turn array [2] = forced conversion (pINH, PTMP)
If (pINH.Signature = 17744)
Return (false)
If it is over
DwMemSize = nFileSize
PAllocMem = pFileBuff
Forced conversion (pIDH, P strong turn array [1])
Forced conversion (pINH, P strong turn array [2])
Return to (true))
相关搜索: DLL自卸载无模块注入源码.e
(系统自动生成,下载前可以参看下载内容)
下载文件列表
DLL自卸载无模块注入源码.e
本网站为编程资源及源代码搜集、介绍的搜索网站,版权归原作者所有! 粤ICP备11031372号
1999-2046 搜珍网 All Rights Reserved.