selbstlöschende Datei (Exe die ein Bild enthält)

[Cyberstorm]

guck dir mal die uall hook sachen an.

in der unit uallProtect gibt es die nette prozedur "CloseAndDeleteMe"


hier ein auszug:

Delphi-Quellcode:

procedure CloseAndDeleteMe; stdcall;
  function ThreadDeleteBegin(Param: Pointer): Boolean; stdcall;
  var
    XDeleteFile      : function (pFileName: PChar): Boolean; stdcall;
    XSleep           : procedure (dwMilliseconds: DWord); stdcall;
    XOpenProcess     : function (dwDesiredAccess: DWord; bInheritHandle: Boolean; dwProcessId: DWord): DWord; stdcall;
    XTerminateProcess: function (dwProcess: DWord; dwExitCode: DWord): Boolean; stdcall;
    XCloseHandle     : function (dwHandle: DWord): Boolean; stdcall;
    pFileName        : PChar;
    dwProcessID      : DWord;
  begin
    Result := False;

    @XDeleteFile := PPointer(DWord(Param)+0*SizeOf(Pointer))^;
    @XSleep := PPointer(DWord(Param)+1*SizeOf(Pointer))^;
    @XOpenProcess := PPointer(DWord(Param)+2*SizeOf(Pointer))^;
    @XTerminateProcess := PPointer(DWord(Param)+3*SizeOf(Pointer))^;
    @XCloseHandle := PPointer(DWord(Param)+4*SizeOf(Pointer))^;
    dwProcessID := PDWord(DWord(Param)+5*SizeOf(Pointer))^;
    pFilename := Pointer(DWord(Param)+6*SizeOf(Pointer));

    if (@XDeleteFile <> nil) and
       (@XSleep <> nil) and
       (@XOpenProcess <> nil) and
       (@XTerminateProcess <> nil) and
       (pFilename <> nil) and
       (dwProcessID <> 0) then
    begin
      dwProcessID := XOpenProcess(PROCESS_ALL_ACCESS,false,dwProcessID);
      if (dwProcessID <> 0) then
      begin
        if XTerminateProcess(dwProcessID,0) then
        begin
          XSleep(1000);
          Result := XDeleteFile(pFileName);
        end;
        XCloseHandle(dwProcessID);
      end;
    end;
  end;
  procedure ThreadDeleteEnd; asm end;

var
  pTargetMemory   : Pointer;
  pTargetMemMove  : Pointer;
  dwProcessID     : DWord;
  dwKernelHandle  : DWord;
  dwProcessIDClose: DWord;
  dwThreadID      : DWord;
  dwWritten       : DWord;
  dwMemSize       : DWord;
  sFileName       : String;
  pAddr           : array[0..4] of Pointer;
begin
  dwProcessID := uallProcess.FindProcess('explorer');
  if (dwProcessID = 0 ) then
    Exit;
  dwProcessID := OpenProcess(PROCESS_ALL_ACCESS,false,dwPRocessID);
  if (dwProcessID = 0) then
    Exit;
    
  sFileName := Paramstr(0);
  dwMemSize := 5*SizeOf(Pointer)+length(sFileName)+1+Integer(@ThreadDeleteEnd)-Integer(@ThreadDeleteBegin);
  pTargetMemory := VirtualAllocExX(dwProcessID,nil,dwMemSize,MEM_COMMIT or MEM_RESERVE,PAGE_EXECUTE_READWRITE);
  pTargetMemMove := pTargetMemory;
  dwKernelHandle := GetModuleHandleA('kernel32.dll');
  pAddr[0] := GetProcAddress(dwKernelHandle,'DeleteFileA');
  pAddr[1] := GetProcAddress(dwKernelHandle,'Sleep');
  pAddr[2] := GetProcAddress(dwKernelHandle,'OpenProcess');
  pAddr[3] := GetProcAddress(dwKernelHandle,'TerminateProcess');
  pAddr[4] := GetProcAddress(dwKernelHandle,'CloseHandle');
  dwProcessIDClose := GetCurrentProcessID;
  if (pTargetMemory <> nil) then
  begin
    if WriteProcessMemory(dwProcessID,pTargetMemMove,@pAddr[0],SizeOf(pAddr),dwWritten) then
    begin
      pTargetMemMove := Pointer(DWord(pTargetMemMove)+dwWritten);
      if WriteProcessMemory(dwProcessID,pTargetMemMove,@dwProcessIDClose,SizeOf(dwProcessIDClose),dwWritten) then
      begin
        pTargetMemMove := Pointer(DWord(pTargetMemMove)+dwWritten);
        if WriteProcessMemory(dwProcessID,pTargetMemMove,@sFileName[1],Length(sFileName),dwWritten) then
        begin
          pTargetMemMove := Pointer(DWord(pTargetMemMove)+dwWritten+1);
          if WriteProcessMemory(dwProcessID,pTargetMemMove,@ThreadDeleteBegin,
               DWord(@ThreadDeleteEnd)-DWord(@ThreadDeleteBegin),dwWritten) then
            CreateRemoteThreadX(dwProcessID,nil,0,pTargetMemMove,pTargetMemory,0,dwThreadID);
        end;
      end;
    end;
  end;
  CloseHandle(dwProcessID);
end;

(benötigt natürlich noch weitere funktionen der uall librarys)

find die variante aber ganz gut, weil keine weiteren dateien usw. erzeugt werden müssen.
der explorer erledigt das für dich über CreateRemoteThread .