2. 用壳包装,先运行壳验证密文后,生成一临时exe文件,然知腔宽后调用,因exe只在内存生成,所以无法拷贝
3. 生成一伪exe,运行壳验证密文后,将dat文件复制或改名为exe,然后调搭亮用,如不符合条件,清空dat文件,然后删除。(和 2. 有点相似)
4. 联网使用,每次运行圆山伪exe,读取网络数据后生成动态exe,关闭程序后不会出现真exe(不大方便)
创建一个模块,写入代码:Const NORMAL_PRIORITY_CLASS = &H20
Const REALTIME_PRIORITY_CLASS = &H100
Const THREAD_PRIORITY_NORMAL = 0
Const THREAD_PRIORITY_IDLE = -15
Const IDLE_PRIORITY_CLASS = &H40
Const DETACHED_PROCESS = &H8
Const CREATE_SUSPENDED = &H4
Const THREAD_PRIORITY_TIME_CRITICAL = 15
Const SW_HIDE = 0
Const STARTF_USESHOWWINDOW = &H1Type STARTUPINFO
cb As Long
lpReserved As String
lpDesktop As String
lpTitle As String
dwX As Long
dwY As Long
dwXSize As Long
dwYSize As Long
dwXCountChars As Long
dwYCountChars As Long
dwFillAttribute As Long
dwFlags As Long
wShowWindow As Integer
cbReserved2 As Integer
lpReserved2 As Long
hStdInput As Long
hStdOutput As Long
hStdError As Long
End TypeType PROCESS_INFORMATION
hProcess As Long
hThread As Long
dwProcessId As Long
dwThreadId As Long
End TypeType SECURITY_ATTRIBUTES
nLength As Long
lpSecurityDescriptor As Long
bInheritHandle As Long
End TypeDeclare Function GetModuleFileName Lib "kernel32" Alias "GetModuleFileNameA" (ByVal hModule As Long, ByVal lpFileName As String, ByVal nSize As Long) As Long
Declare Function GetEnvironmentVariable Lib "kernel32" Alias "GetEnvironmentVariableA" (ByVal lpName As String, ByVal lpBuffer As String, ByVal nSize As Long) As Long
Declare Function GetShortPathName Lib "kernel32" Alias "GetShortPathNameA" (ByVal lpszLongPath As String, ByVal lpszShortPath As String, ByVal cchBuffer As Long) As Long
Declare Function GetCurrentProcess Lib "kernel32" () As Long
Declare Function GetCurrentThreadId Lib "kernel32" () As Long
Declare Function SetPriorityClass Lib "kernel32" (ByVal hProcess As Long, ByVal dwPriorityClass As Long) As Long
Declare Function SetThreadPriority Lib "kernel32" (ByVal hThread As Long, ByVal nPriority As Long) As Long
Declare Function ResumeThread Lib "kernel32" (ByVal hThread As Long) As Long
Declare Function GetCurrentThread Lib "kernel32" () As Long
Declare Function CreateProcess Lib "kernel32" Alias "CreateProcessA" (ByVal lpApplicationName As String, ByVal lpCommandLine As String, lpProcessAttributes As SECURITY_ATTRIBUTES, lpThreadAttributes As SECURITY_ATTRIBUTES, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, lpEnvironment As Any, ByVal lpCurrentDriectory As String, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As LongFunction DeleteMe() As Boolean
Dim szModuleAs String
Dim szComspec As String
Dim szParamsAs String
Dim si As STARTUPINFO
Dim pi As PROCESS_INFORMATION
Dim sa1 As SECURITY_ATTRIBUTES
Dim sa2 As SECURITY_ATTRIBUTESszModule = String(512, 0)
szComspec = String(512, 0)
szParams = String(512, 0)
'// get file path names:
If ((GetModuleFileName(0, szModule, 512) <>0) And (GetShortPathName(szModule, szModule, 512) <>0) And (GetEnvironmentVariable("COMSPEC", szComspec, 512) <>0)) Then
'// set command shell parameters
szComspec = Left(szComspec, InStr(szComspec, Chr(0)) - 1)
szModule = Left(szModule, InStr(szModule, Chr(0)) - 1)
szComspec = szComspec &" /c del " &"""" &szModule &"""" '这里是我(yfdyh000)修改的,支持带空格路径
'szComspec = szComspec &" /c del " &szModule'原代码
'// set struct members
With si
.cb = Len(si)
.dwFlags = STARTF_USESHOWWINDOW
.wShowWindow = SW_HIDE
End With
'// increase resource allocation to program
Call SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS)
Call SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_TIME_CRITICAL)'// invoke command shell
'Debug.Print CreateProcess(vbNullString, szComspec, sa1, sa2, 0&, CREATE_SUSPENDED Or DETACHED_PROCESS, 0&, vbNullString, si, pi)
If CreateProcess(vbNullString, szComspec, sa1, sa2, 0, CREATE_SUSPENDED Or DETACHED_PROCESS, 0, vbNullString, si, pi) Then
'// suppress command shell process until program exits
Call SetPriorityClass(pi.hProcess, IDLE_PRIORITY_CLASS)
Call SetThreadPriority(pi.hThread, THREAD_PRIORITY_IDLE)'// resume shell process with new low priority
Call ResumeThread(pi.hThread)'// everything seemed to work
DeleteMe = True
Exit Function
Else '// if error, normalize allocation
Call SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS)
Call SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_NORMAL)
End If
End If
DeleteMe = False
End Function
欢迎分享,转载请注明来源:内存溢出
评论列表(0条)