Recently, I saw that netizens asked how to delete themselves after the program is running. I don't know if everyone is interested in Trojans. I still want this effect: Users as long as one runs, the executable file is not, but the program is still When running, I am afraid to call "ghosts!", "Wife, come out to see God". In fact, the most typical usage is to write anti-installation procedures. If you are free, BEAR is a way to "delete yourself".
Everyone knows that when the general program is running, the executable itself is protected by the operating system. It cannot be accessed by rewritten, let alone delete themselves when it is still running. Seeing a Undocument method on the homepage of LU0, deleting yourself by changing the file access mode of the system underlying. I saw it very admired. But is there a function that can be found on the MSDN? Yes! Jeffrey Richter has made us an example:
Deleteme.cpp
Module Name: deleteme.cpp
Written by: Jeffrey Richter
Description: Allows An Executable File To Delete Itself
*********************************************************** ****************** /
#include
#include
#include
/
Int WinApi WinMain (Hinstance H, Hinstance B, LPSTR PSZ, INT N) {
// Is this the Original EXE or THE CLONE EXE?
// if the command-line 1 argument, this is the Original Exe
// if the command-line> 1 argument, this is the clone exe
IF (__ARGC == 1) {
// Original Exe: Spawn Clone EXE to DELETE THIS EXE
// Copy this Executable Image INTO The User's Temp Directory
Tchar szpathorig [_max_path], szpathclone [_MAX_PATH];
GetModuleFileName (NULL, SZPATHORIG, _MAX_PATH);
GetTemppath (_MAX_PATH, SZPATHCLONE);
GetTempFileName (szpathclone, __text ("del"), 0, szpathclone);
CopyFile (Szpathorig, Szpathclone, False);
// *** Note ***:
// Open the clone exe usding file_flag_delete_on_close
Handle Hfile = CreateFile (Szpathclone, 0, File_Share_read, null, open_existing, file_flag_delete_on_close, null);
// spawn theclone exe passing it Our EXE's Process Handle
// and the full path name to the Original Exe file.
Tchar Szcmdline [512];
Handle HProcessorig = OpenProcess (Synchronize, True, getCurrentProcessId ()); WSPrintf (Szcmdline, __text ("% s% d /"% s / "), szpathclone, hprocessorig, szpathorig;
Startupinfo Si;
ZeromeMory (& Si, SIZEOF (Si));
Si.cb = sizeof (si);
Process_information pi;
CreateProcess (NULL, SZCMDLINE, NULL, NULL, TRUE, 0, NULL, NULL, & SI, & PI)
CloseHandle (HPROCESSORIG);
CloseHandle (HFILE);
// this Original Process Can Now Terminate.
} else {
// Clone Exe: when Original Exe Terminates, Delete IT
Handle HProcessorig = (Handle) _ttoi (__ targv [1]);
WaitforsingleObject (HProcessorig, Infinite);
CloseHandle (HPROCESSORIG);
Deletefile (__ targv [2]);
// INSERT CODE Here To Remove The Subdirectory TOO (if Desired).
// The System Will Delete the Clone Exe Automatically
// Because it is openmed with file_flag_delete_on_close
}
Return (0);
}
Did you understand?
This program is very simple: isn't it possible to delete itself directly at runtime? Ok, then the program is copied (clone) one yourself, start another process with the replica, then end the run, then the original EXE file is not protected by the system. At this time, the original EXE file is removed by the new process as the killer, and continue Complete other functions of the program.
After the new process is over, the replica is automatically deleted. This is another trick worth mentioning, paying attention:
// Open the clone exe usding file_flag_delete_on_close
Handle Hfile = CreateFile (Szpathclone, 0, File_Share_read, null, open_existing, file_flag_delete_on_close, null);
The file_flag_delete_on_close flag in this is telling the operating system. After all the handles related to this file is turned off (including the Seni-Bing created above), the file is deleted. Almost all temporary documents are created, this flag is indicated.
Also note: Before the replica process, you should wait for the original process to exit. Use the process synchronization technology.
Handle HProcessorig = OpenProcess (Synchronize, True, getCurrentProcessId ());
Get the original process handle. Thesynchronice flag is valid in NT. The role is to make the handle of OpenProcess can be synchronous objects. The replica process is synchronized with the waitforsingleObject function, and then a deletefile, and other destruction (such as deleting the dialogue) Work, finishing work!
The program is based on console. By the incoming parameter is determined to be the original process or the new process of replica, and the information of the target file that needs to be operated (mainly the path), the replica is placed in the system's TEMP directory (getTemppath), You can also find a place you think safely (such as Windows / System32, etc.). There is no deep technology in this. Look at other things to delete their own examples, for example, before the process exits, use fwrite and other methods to output a .bat file, write a few DEL inside, then Winexec this BAT file is Can. Most of the sectariums who have played DOS will. Today, I have learned it, cool.
