在Windows 7上自动删除EXE

Question

我在互联网上发现了这个代码，但它说要在Windows XP上运行。 我试图在Windows 7上运行它，它的工作，但我不知道它是安全的，不只是运行此代码，而且这样做在Windows 7

// 
// Self-deleting exe under Windows XP 
// 
#include <windows.h> 
#include <tchar.h> 

// get this right! 
#define EXPLORER_PID 1444 

typedef UINT (WINAPI * WAIT_PROC)(HANDLE, DWORD); // WaitForSingleObject 
typedef BOOL (WINAPI * CLOSE_PROC)(HANDLE);  // CloseHandle 
typedef BOOL (WINAPI * DELETE_PROC)(LPCTSTR);  // DeleteFile 
typedef VOID (WINAPI * EXIT_PROC)(DWORD);   // ExitProcess 

typedef struct 
{ 
    WAIT_PROC fnWaitForSingleObject; 
    CLOSE_PROC fnCloseHandle; 
    DELETE_PROC fnDeleteFile; 
    EXIT_PROC fnExitProcess; 

    HANDLE  hProcess; 
    TCHAR  szFileName[MAX_PATH]; 

} INJECT; 

#pragma optimize("gsy", off) 
#pragma check_stack(off)  // doesn't work :-(

DWORD WINAPI RemoteThread(INJECT *remote) 
{ 
    remote->fnWaitForSingleObject(remote->hProcess, INFINITE); 
    remote->fnCloseHandle(remote->hProcess); 
    remote->fnDeleteFile(remote->szFileName); 
    remote->fnExitProcess(0); 

    return 0; 
} 

#pragma check_stack 

HANDLE GetRemoteProcess() 
{ 
    STARTUPINFO   si = { sizeof(si) }; 
    PROCESS_INFORMATION pi; 

    //return OpenProcess(PROCESS_ALL_ACCESS, FALSE, EXPLORER_PID); 

    if(CreateProcess(0, "explorer.exe", 0, 0, FALSE, CREATE_SUSPENDED|CREATE_NO_WINDOW|IDLE_PRIORITY_CLASS, 0, 0, &si, &pi)) 
    { 
     CloseHandle(pi.hThread); 
     return pi.hProcess; 
    } 
    else 
    { 
     return 0; 
    } 
} 

PVOID GetFunctionAddr(PVOID func) 
{ 
#ifdef _DEBUG 

    // get address of function from the JMP <relative> instruction 
    DWORD *offset = (BYTE *)func + 1; 
    return (PVOID)(*offset + (BYTE *)func + 5); 

#else 

    return func; 

#endif 
} 

BOOL SelfDelete() 
{ 
    INJECT local, *remote; 
    BYTE *code; 
    HMODULE hKernel32; 
    HANDLE hRemoteProcess; 
    HANDLE hCurProc; 

    DWORD dwThreadId; 
    HANDLE hThread = 0; 

    char ach[80]; 

    hRemoteProcess = GetRemoteProcess(); 

    if(hRemoteProcess == 0) 
     return FALSE; 

    // Allocate memory in remote process 
    code = VirtualAllocEx(hRemoteProcess, 0, sizeof(INJECT) + 128, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE); 

    if(code == 0) 
    { 
     CloseHandle(hRemoteProcess); 
     return FALSE; 
    } 

    hKernel32 = GetModuleHandle(_T("kernel32.dll")); 

    // setup remote structure 
    remote = (INJECT *)(code + 128); 

    local.fnWaitForSingleObject = (WAIT_PROC)GetProcAddress(hKernel32, "WaitForSingleObject"); 
    local.fnCloseHandle   = (CLOSE_PROC)GetProcAddress(hKernel32, "CloseHandle"); 
    local.fnExitProcess   = (EXIT_PROC)GetProcAddress(hKernel32, "ExitProcess"); 

#ifdef UNICODE 
    local.fnDeleteFile   = (DELETE_PROC)GetProcAddress(hKernel32, "DeleteFileW"); 
#else 
    local.fnDeleteFile   = (DELETE_PROC)GetProcAddress(hKernel32, "DeleteFileA"); 
#endif 

    // duplicate our own process handle for remote process to wait on 
    hCurProc = GetCurrentProcess(); 
    DuplicateHandle(hCurProc, hCurProc, hRemoteProcess, &local.hProcess, 0, FALSE, DUPLICATE_SAME_ACCESS); 

    // find name of current executable 
    GetModuleFileName(NULL, local.szFileName, MAX_PATH); 

    // write in code to execute, and the remote structure 
    WriteProcessMemory(hRemoteProcess, code, GetFunctionAddr(RemoteThread), 128, 0); 
    WriteProcessMemory(hRemoteProcess, remote, &local, sizeof(local), 0); 

    wsprintf(ach, "%x %x\n", code, remote); 
    OutputDebugString(ach); 

    // execute the code in remote process 
    hThread = CreateRemoteThread(hRemoteProcess, 0, 0, code, remote, 0, &dwThreadId); 

    if(hThread != 0) 
    { 
     CloseHandle(hThread); 
    } 

    return TRUE; 
} 

int main(void) 
{ 
    SelfDelete(); 

    return 0; 
} 

顺便说一句，怎么会这样用作C/C++中的库？我的目标是仅仅使用，例如，

#include "selfdel.h"所以我可以在C++程序中使用功能SelfDelete()。

Answer 1

你应该知道这段代码是什么。这是将代码注入到另一个进程中，该进程将作为该进程执行，然后该进程将退出。它应该只是工作（尽管看下面的评论）。我认为这个代码片段的作者已经在Win Vista发布之前写过它，因此你担心。

你可以在你的“selfdel.h”中声明SelfDelete()。调用这个函数并立即退出应该会诀窍。

该实现不需要来自库的用户的任何输入，因为它获取了它所需的所有内容。

// duplicate our own process handle for remote process to wait on 
hCurProc = GetCurrentProcess(); 
... 
// find name of current executable 
GetModuleFileName(NULL, local.szFileName, MAX_PATH); 

一些评论：

• 你的过程中应该有足够的权限创建另一个
• 这种活动可以通过杀毒软件将其视为可疑
• 不要忘了，只要您的程序在呼叫后生存，“僵尸”进程就会等待SelfDelete()
• 考虑其他方法：How can a program delete its own executable