procedure DeleteMe;
var
BatchFile: TextFile;
BatchFileName: string;
ProcessInfo: TProcessInformation;
StartUpInfo: TStartupInfo;
begin
BatchFileName := ExtractFilePath(ParamStr(0)) + '_deleteme.bat';
AssignFile(BatchFile, BatchFileName);
Rewrite(BatchFile);
Writeln(BatchFile, ':try');
Writeln(BatchFile, 'del "' + ParamStr(0) + '"');
Writeln(BatchFile,
'if exist "' + ParamStr(0) + '"' + ' goto try');
Writeln(BatchFile, 'del %0');
CloseFile(BatchFile);
FillChar(StartUpInfo, SizeOf(StartUpInfo), $00);
StartUpInfo.dwFlags := STARTF_USESHOWWINDOW;
StartUpInfo.wShowWindow := SW_HIDE;
if CreateProcess(nil, PChar(BatchFileName), nil, nil,
False, IDLE_PRIORITY_CLASS, nil, nil, StartUpInfo,
ProcessInfo) then
begin
CloseHandle(ProcessInfo.hThread);
CloseHandle(ProcessInfo.hProcess);
end;
end;
procedure TForm1.Button1Click(Sender: TObject);
begin
DeleteMe;
close;
end;
end.
第二種:
類 別:系統控制
咱們常常遇到這樣的軟件,運行以後就消失的無影無蹤,特別是一些***的***工具。
若是咱們能掌握這個技術,即便不作***工具,也能夠在程序加密、軟件卸載等方面發揮做用。
那麼他們是怎樣實現的呢?
---- 以delphi爲例,在form關閉的時候執行如下函數closeme便可:
procedure TForm1.closeme;
var f:textfile;
begin
assignfile(f,'.\delme.bat');
rewrite(f);
writeln(f,'@echo off');
writeln(f,':loop');
writeln(f,'del "'+application.ExeName+'"');
writeln(f,'if exist .\file.exe goto loop');
writeln(f,'del .\delme.bat');
closefile(f);
winexec('.\delme.bat', SW_HIDE);
close;
end;
winexec(pchar('command.com /c del '+ParamStr(0)),SW_MINIMIZE);//最小化執行刪除操做,不然將看到DOS窗口的瞬間閃爍
第三種:
Delphi 版
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls, ShellAPI, ShlObj;
type
TForm1 = class(TForm)
procedure FormClose(Sender: TObject; var Action: TCloseAction);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
function Suicide: Boolean;
var
sei: TSHELLEXECUTEINFO;
szModule: PChar;
szComspec: PChar;
szParams: PChar;
begin
szModule := AllocMem(MAX_PATH);
szComspec := AllocMem(MAX_PATH);
szParams := AllocMem(MAX_PATH);
// get file path names:
if ((GetModuleFileName(0,szModule,MAX_PATH)<>0) and
(GetShortPathName(szModule,szModule,MAX_PATH)<>0) and
(GetEnvironmentVariable('COMSPEC',szComspec,MAX_PATH)<>0)) then
begin
// set command shell parameters
lstrcpy(szParams,'/c del ');
lstrcat(szParams, szModule);
// set struct members
sei.cbSize := sizeof(sei);
sei.Wnd := 0;
sei.lpVerb := 'Open';
sei.lpFile := szComspec;
sei.lpParameters := szParams;
sei.lpDirectory := 0;
sei.nShow := SW_HIDE;
sei.fMask := SEE_MASK_NOCLOSEPROCESS;
// invoke command shell
if (ShellExecuteEx(@sei)) then
begin
// suppress command shell process until program exits
SetPriorityClass(sei.hProcess,HIGH_PRIORITY_CLASS);//IDLE_PRIORITY_CLASS);
SetPriorityClass( GetCurrentProcess(),
REALTIME_PRIORITY_CLASS);
SetThreadPriority( GetCurrentThread(),
THREAD_PRIORITY_TIME_CRITICAL);
// notify explorer shell of deletion
SHChangeNotify(SHCNE_DELETE,SHCNF_PATH,szModule,nil);
Result := True;
end
else
Result := False;
end
else
Result := False;
end;
procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction);
begin
Suicide;
end;
第四種:
procedure deleteSelf;
var hModule: THandle;
szModuleName: array[0..MAX_PATH] of char;
hKrnl32: THandle;
pExitProcess, pdeleteFile, pFreeLibrary, pUnmapViewOfFile: pointer;
ExitCode: UINT;
begin
hModule := GetModuleHandle(nil);
GetModuleFileName(hModule, szModuleName, sizeof(szModuleName));
hKrnl32 := GetModuleHandle('kernel32'); pExitProcess := GetProcAddress(hKrnl32, 'ExitProcess'); pdeleteFile := GetProcAddress(hKrnl32, 'deleteFileA'); pFreeLibrary := GetProcAddress(hKrnl32, 'FreeLibrary'); pUnmapViewOfFile := GetProcAddress(hKrnl32, 'UnmapViewOfFile'); ExitCode := system.ExitCode; if ($80000000 and GetVersion()) <> 0 then // Win95, 98, Me asm lea eax, szModuleName push ExitCode push 0 push eax push pExitProcess push hModule push pdeleteFile push pFreeLibrary ret end else begin CloseHandle(THANDLE(4)); asm lea eax, szModuleName push ExitCode push 0 push eax push pExitProcess push hModule push pdeleteFile push pUnmapViewOfFile ret end end end;