欢迎光临
我们一直在努力

vb.net实现木马注册机原理:动态配置exe-.NET教程,VB.Net语言

建站超值云服务器,限时71元/月

注册机就是批量生成相同功能的而内部配置不用程序文件的程序,这个程序的好处是不用在修改源代码重新编译的情况下产生新的文件,广泛应用与木马行业。

        原理有很多,这里实现的是在文件结尾追加配置字符的方法。
 程序下载,右键另存为rar文件:../uploadfile/200510/20051017144056534.gif
没有配置过的界面:
已经配置过的运行界面,背景是用notepad.exe打开文件可以看到文件最后的配置字符串:
主要源代码:

  private sub b_ok_click(byval sender as system.object, byval e as system.eventargs) handles b_ok.click

        检查配置

        if len(me.tb_myconfig.text) = 0 then

            me.l_res.text = “请输入你要设置的字符!”

            return

        end if

        设置文件保存位置

        dim strurl as string

        if ofd.showdialog = dialogresult.ok then

            strurl = ofd.filename

        else

            return

        end if

        复制本身到指定文件

        io.file.copy(application.executablepath, strurl, true)

        dim ms as io.filestream

        dim bw as io.binarywriter

        try

            打开文件

            ms = new io.filestream(strurl, io.fileaccess.readwrite)

            bw = new io.binarywriter(ms)

            读取中文件配置的位置,以确定该文件是否被配置过

            dim ip as integer = seekpostion(application.executablepath)

 
 

            if ip = 0 then

                如果没有配置过,就定位到文件结尾

                bw.seek(0, io.seekorigin.end)

            else

                已经配置过的话,就定位到配置位置

                bw.seek(ip, io.seekorigin.begin)

            end if

            连续写2个 vbcrlf,这个就是是否被配置的标志

            bw.write(vbcrlf)

            bw.write(vbcrlf)

            这里写配置进去!

            bw.write(system.text.encoding.default.getbytes(me.tb_myconfig.text))

            bw.flush()

        catch ex as exception

            me.l_res.text = “错误:” & ex.message

            return

        finally

            关闭文件

            bw.close()

            ms.close()

        end try

 
 

        try

            启动新程序

            system.diagnostics.process.start(strurl)

            结束当前京城

            me.dispose()

        catch ex as exception

 
 

        end try

 
 

 
 

    end sub

 
 

 
 

    private sub frmmain_load(byval sender as system.object, byval e as system.eventargs) handles mybase.load

        显示是否配置 以及配置结果

        me.tb_myconfig.text = reanconfig(application.executablepath)

        if seekpostion(application.executablepath) = 0 then

            me.l_res.text = “该程序没有被配置过!”

        else

            me.l_res.text = “该程序已经被配置过了!”

        end if

    end sub

 
 

 
 

 
 

 
 

    function seekpostion(byval strpath as string) as integer

        dim ip as integer = 0 位置

 
 

        dim ms as io.filestream

        dim br as io.binaryreader

        try

            ms = new io.filestream(strpath, io.filemode.open, io.fileaccess.read)

            br = new io.binaryreader(ms)

            读取文件

            dim b() as byte = br.readbytes(ms.length)

 
 

            dim ic as integer

            for i as integer = 0 to b.length – 5

                ic = i

                这里检查标志,就是上面连续写2个 vbcrlf  vbcrlf

                if b(ic) = 13 and b(ic + 1) = 10 and b(ic + 3) = 13 and b(ic + 4) = 10 then

                    ip = ic

                    exit for

                end if

            next

 
 

        catch ex as exception

            console.write(ex.message)

        finally

            if not ms is nothing then

                ms.close()

            end if

            if not br is nothing then

                br.close()

            end if

        end try

 
 

        return ip

    end function

 
 

    private function reanconfig(byval strpath as string) as string

        dim ip as integer = seekpostion(strpath)

        if ip = 0 then

            return nothing

        end if

 
 

        dim ms as io.filestream

        dim br as io.binaryreader

        try

            ms = new io.filestream(application.executablepath, io.filemode.open, io.fileaccess.read)

            br = new io.binaryreader(ms)

            br.readbytes(ip + 5) 舍弃前面的数据

 
 

            读取最后的数据!

            return system.text.encoding.default.getstring(br.readbytes(ms.length – ip – 5))

 
 

        catch ex as exception

            console.write(ex.message)

            return nothing

        finally

            if not ms is nothing then

                ms.close()

            end if

            if not br is nothing then

                br.close()

            end if

        end try

 
 

    end function

赞(0)
版权申明:本站文章部分自网络,如有侵权,请联系:west999com@outlook.com 特别注意:本站所有转载文章言论不代表本站观点! 本站所提供的图片等素材,版权归原作者所有,如需使用,请与原作者联系。未经允许不得转载:IDC资讯中心 » vb.net实现木马注册机原理:动态配置exe-.NET教程,VB.Net语言
分享到: 更多 (0)