某dll程序被删自动还原代码

来源：互联网发布：外交豁免权知乎编辑：程序博客网时间：2024/06/06 00:43
DWORD _stdcall ShieldThread(LPVOID lParam)    {     char   DllFilePath[MAX_PATH];        HANDLE hDllFile;     HANDLE hSearch;      void*  MemDll;      int    SizeDll;       DWORD  BytesRead;     WIN32_FIND_DATA  FileData;             __try       {              GetModuleFileName(HMODULE(g_hDllModule), DllFilePath,MAX_PATH);            hDllFile =CreateFile(DllFilePath,GENERIC_READ,0,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);            SizeDll  =GetFileSize(hDllFile,0);            MemDll   =VirtualAlloc(0,SizeDll,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE);            ReadFile(hDllFile,MemDll,SizeDll,&BytesRead,0);            CloseHandle(hDllFile);                       while(1)            {                hSearch =FindFirstFile(DllFilePath,&FileData);                if(hSearch==INVALID_HANDLE_VALUE)                {                              hDllFile=CreateFile(DllFilePath,GENERIC_WRITE,0,0,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);                    WriteFile(hDllFile,MemDll,SizeDll,&BytesRead,0);                    CloseHandle(hDllFile);                }                 FindClose(hSearch);             Sleep(500);         }        }        __finally       {            CloseHandle(hDllFile);            FindClose(hSearch);        }            return 0; }