Summary of the Self-deletion method of Programs

Author: icyfoxlovelace/ice Fox prodigal son [EST]
Information Source: This article is first published on the black line of defense.

The auto-deletion of programs is no longer a new topic. It is easier for you to think about the mistakes you encountered in your school, I think it is necessary to summarize all the methods I know and hope they will be helpful for beginners.
The auto-deletion of programs is widely used in the final auto-deletion of anti-installation programs (Environmental Protection !), Of course, it is more common to see automatic destruction of Trojans and viruses installed for the first time ^ * ^. It depends on your own usage!
Classic auto-Deletion
When talking about the app's self-deletion, you can't say nothing about the code written by Gary Nebbett and other prawns. It's a classic story! The Code uses C language Embedded Assembly asm:
In Win9x, you only need to execute the FreeLibrary operation on the exe handle to remove the ing of the exe IMAGE in the memory. Then, you can call DeleteFile to delete your own files.
The code in Win9x is as follows [selfkill-9x.c]:
# Include "windows. h"
Int main (int argc, char * argv [])
{
Char buf [MAX_PATH];
HMODULE module;
Module = GetModuleHandle (0 );
GetModuleFileName (module, buf, MAX_PATH );
_ Asm
{
Lea eax, buf
Push 0
Push 0
Push eax
Push ExitProcess
Push module
Push DeleteFile
Push FreeLibrary
Ret
}
Return 0;
}

In WinNT/2 K, you need to first call CloseHandle to close the image handle corresponding to the exe file itself [Hard encoding 4], then call UnmapViewOfFile to remove the HANDLE of another corresponding IMAGE, in addition, the efile of the program in the memory is removed, and you can use DeleteFile to delete the program! (Note: This method is not applicable to WinXP !)

The Code For WinNT/2 k is as follows [selfkill-nt.c]:
# Include "windows. h"
Int main (int argc, char * argv [])
{
Char buf [MAX_PATH];
HMODULE module;
Module = GetModuleHandle (0 );
GetModuleFileName (module, buf, MAX_PATH );
CloseHandle (HANDLE) 4 );
_ Asm
{
Lea eax, buf
Push 0
Push 0
Push eax
Push ExitProcess
Push module
Push DeleteFile
Push UnmapViewOfFile
Ret
}
Return 0;
}


Combine the code used in Win9x and WinNT/2 K to execute all the API code used on the two platforms, although several APIs may fail to run on a platform, several of them will run successfully, but the final result is that the exe program file is deleted before exiting!

The code for Win9x and WinNT/2 k is as follows [selfkill-9x + nt. c]:
# Include "windows. h"
Int main (int argc, char * argv [])
{
Char buf [MAX_PATH];
HMODULE module;
Module = GetModuleHandle (0 );
GetModuleFileName (module, buf, MAX_PATH );
CloseHandle (HANDLE) 4 );

_ Asm
{
Lea eax, buf
Push 0
Push 0
Push eax
Push ExitProcess
Push module
Push DeleteFile
Push module
Push UnmapViewOfFile
Push FreeLibrary
Ret
}
Return 0;
}

Because I was learning the compilation of [MASM32] under Win32, I wrote it again, but the result showed that each execution failed and showed an error,

============ Insert image 1 ======================

Through the Disassembly and comparison, it is found that the MASM32 compiler uses FreeLibrary or UnmapViewOfFile to remove the program's memory ing because of the differences between the encoding of API calls and the C compiler, when DeleteFile is called, the Code [JMP DeleteFile] In the IMAGE ing address is referenced, which leads to an error in Read Memory execution.
Error Analysis
When a common program calls an API, the compiler compiles an API call statement into several parameter pressure stack commands followed by an indirect call Statement (this refers to the Microsoft compiler, the Borland compiler uses jmp dword ptr [XXXXXXXXh]) in the following format:

Push arg1
Push arg2
......
Call dword ptr [XXXXXXXXh]
The address XXXXXXXXh is in the Import Section of the program image. When the program is loaded and running, the loader is responsible for adding the address of the API function to it;

1. the API function calling format of a program compiled with MASM32 is:
Call capi;
......
......
......
Capi:
Jmp dword ptr [XXXXXXXX]; XXXXXXXX stores the real address of the called API Function

Among them, the jmp dword ptr [XXXXXXXX] command is automatically added after all the code of the program by the "compiler". The advantage of this call is that the code size can be reduced when the same API is called multiple times,
II. The format of API function calls for a program compiled in C is:
Call dword ptr [XXXXXXXX]; The XXXXXXXX address stores the real address of the called API function.

It is precisely because the above API function call formats are different that cause the program compiled with MASM32 to fail to delete itself, after UnmapViewOfFile is called, the Code section of the jmp dword ptr [XXXXXXXX] command in the code segment becomes unreadable. Then, the execution of the DeleteFile API will fail and the program will fail! Therefore, if we use MASM32 to compile such a self-deletion program, we should change the push DeleteFile command:

Mov eax, DeleteFile
Obtain the jmp dword ptr [XXXXXXXX] command address, machine code FF25XXXXXXXX
Inc eax
Inc eax
Mov eax, dword ptr [eax]
Push dword ptr [eax]
This is the true address of the DeleteFile into the stack, of course, with dynamic access to the API is also good, but it is better to this Code less, the following is my modified MASM32 code [selfkill9x-nt.asm]:

. 386
. Model flat, stdcall
Option casemap: none

Include windows. inc
Include kernel32.inc
Includelib kernel32.lib
. Code
Start:
Mov ebp, esp
Invoke GetModuleHandle, NULL; get the module handle
Mov ebx, eax
Invoke GetModuleFileName, ebx, ebp, MAX_PATH; get its own path
Invoke CloseHandle, 4; close the IMAGE handle corresponding to the exe file [hard-coded as 4]
Push 0; ExitProcess Parameters
Push 0
Push ebp; DeleteFile Parameters
Mov eax, ExitProcess
Inc eax
Inc eax
Mov eax, dword ptr [eax]
Push dword ptr [eax]; push ExitProcess

Push ebx; UnmapViewOfFile Parameters
Mov eax, DeleteFile
Inc eax
Inc eax
Mov eax, dword ptr [eax]
Push dword ptr [eax]; push DeleteFile
Push ebx; FreeLibrary Parameters
Mov eax, UnmapViewOfFile
Inc eax
Inc eax
Mov eax, dword ptr [eax]
Push dword ptr [eax]; push UnmapViewOfFile
Push FreeLibrary; FreeLibrary does not need to be changed because it can also be read by calling its time code section.
Ret
End start

Remote thread insertion and Deletion
Remote thread insertion is now widely used for self-protection and concealment of Trojans and viruses. We can also use it for self-deletion of programs.

The code inserted to delete its own remote thread is as follows:
KREMOTE_CODE_START equ this byte
Call @ F
@@:
Pop ebx
Sub ebx, offset @ B; thread code relocation
Push 500
Call [ebx + _ lpselfkillSleep]; sleep for 0.5 seconds
Lea eax, [ebx + offset _ selfkillselfname]
Push eax
Call [ebx + _ lpselfkillDeleteFile]; delete a program file
Ret

_ LpselfkillSleep dd? ; Sleep hard-coded address
_ LpselfkillDeleteFile dd? ; DeleteFile hard-coded address
_ Selfkillselfname:; name of the program itself, which is generated and written in the main program

KREMOTE_CODE_END equ this byte
KREMOTE_CODE_LENGTH equ offset KREMOTE_CODE_END-offset KREMOTE_CODE_START

Use GetProcAddress in the main program to get Sleep and DeleteF