来源:MJ0011内核研究所

挑战一下,看谁的工具能删除它?

用下面代码创建:


PVOID buf = malloc(200000);    
WCHAR path [MAX_PATH] ;     
ZeroMemory(buf , 200000);    
 
GetSystemDirectoryW(path , MAX_PATH);    
wcscpy((wchar_t *)buf , L"\\\\?\\C:\\test");    
CreateDirectoryW((wchar_t *)buf , 0);    
ULONG i ;    
 
for ( i = 0 ; i < 1023 ; i ++)    
{    
wcscat((wchar_t *)buf , L\\test);    
CreateDirectoryW((wchar_t *)buf , 0);    
 
}    
wcscat((wchar_t *)buf , L\\test.exe);    
wcscat(path , L"\\calc.exe");    
CopyFileW(path , (wchar_t *)buf , FALSE);    
 
return ;