置入汇编实现 DLL隐藏自身模块 - 精易论坛

子程序名	返回值类型	公开	备注
Dll入口函数	逻辑型		这个是黑月的入口函数，类似于其它语言的DLLMAIN，在“_启动子程序”之后执行，必须勾上“公开”
参数名	类型	参考	可空	数组	备注
DLL实例句柄	整数型
调用类型	整数型				DLL_PROCESS_ATTACH；DLL_PROCESS_DETACH；DLL_THREAD_ATTACH；DLL_THREAD_DETACH；
保留	整数型

判断 (调用类型＝ #DLL_PROCESS_ATTACH ) ' //进程映射

隐藏模块 (DLL实例句柄)

判断 (调用类型＝ #DLL_PROCESS_DETACH ) ' //进程卸载

判断 (调用类型＝ #DLL_THREAD_ATTACH ) ' //线程映射

判断 (调用类型＝ #DLL_THREAD_DETACH ) ' //线程卸载

返回 (真)

子程序名	返回值类型	公开	备注
隐藏模块			' 问题反馈 taizhong [email protected]
参数名	类型	参考	可空	数组	备注
模块句柄	整数型

' by taizhong [email][email protected][/email]
置入代码 ({ 81, 83, 86, 87, 232, 175, 0, 0, 0, 139, 125, 8, 139, 240, 141, 69, 252, 187, 0, 4, 0, 0, 80, 106, 4, 83, 87, 255, 214, 51, 192, 102, 137, 7, 33, 71, 64, 141, 69, 252, 80, 255, 117, 252, 83, 87, 255, 214, 139, 207, 232, 9, 0, 0, 0, 95, 94, 91, 139, 229, 93, 194, 4, 0, 81, 81, 131, 100, 36, 4, 0, 131, 36, 36, 0, 83, 85, 86, 87, 139, 233, 96, 156, 51, 210, 100, 139, 90, 48, 139, 75, 12, 141, 81, 12, 139, 73, 12, 137, 84, 36, 52, 137, 76, 36, 56, 157, 97, 139, 84, 36, 20, 139, 116, 36, 16, 57, 106, 24, 116, 14, 139, 242, 139, 18, 59, 84, 36, 16, 117, 241, 51, 192, 235, 42, 139, 2, 137, 6, 139, 10, 139, 66, 4, 137, 65, 4, 139, 66, 8, 137, 70, 8, 139, 74, 8, 139, 66, 12, 137, 65, 204, 139, 66, 16, 137, 70, 16, 139, 74, 16, 139, 66, 20, 137, 65, 148, 95, 94, 93, 91, 89, 89, 195, 81, 81, 100, 161, 48, 0, 0, 0, 83, 85, 86, 139, 64, 12, 87, 139, 72, 12, 235, 96, 139, 66, 60, 139, 9, 139, 116, 16, 120, 137, 116, 36, 20, 133, 246, 116, 79, 139, 92, 22, 32, 51, 255, 3, 218, 57, 124, 22, 24, 118, 65, 139, 43, 51, 192, 3, 234, 137, 68, 36, 16, 141, 91, 4, 138, 69, 0, 132, 192, 116, 38, 139, 116, 36, 16, 107, 246, 33, 15, 190, 192, 3, 240, 69, 138, 69, 0, 132, 192, 117, 240, 137, 116, 36, 16, 129, 124, 36, 16, 200, 247, 233, 119, 139, 116, 36, 20, 116, 23, 71, 59, 124, 22, 24, 114, 191, 139, 81, 24, 133, 210, 117, 153, 51, 192, 95, 94, 93, 91, 89, 89, 195, 139, 68, 22, 36, 141, 4, 120, 15, 183, 12, 16, 139, 68, 22, 28, 141, 4, 136, 139, 4, 16, 3, 194, 235, 224 })