ANTICHAT — форум по информационной безопасности, OSINT и технологиям

program Project2;

{$APPTYPE CONSOLE}

uses
  Windows;

const
  find_data : array [0..4] of byte = ($CD, $16, $0F, $85, $09);
  replace_data : array [0..4] of byte = ($CD, $16, $90, $90, $90);

  // выдрал  sysutils
function CompareMem(P1, P2: Pointer; Length: Integer): Boolean; assembler;
asm
        PUSH    ESI
        PUSH    EDI
        MOV     ESI,P1
        MOV     EDI,P2
        MOV     EDX,ECX
        XOR     EAX,EAX
        AND     EDX,3
        SAR     ECX,2
        JS      @@1     // Negative Length implies identity.
        REPE    CMPSD
        JNE     @@2
        MOV     ECX,EDX
        REPE    CMPSB
        JNE     @@2
@@1:    INC     EAX
@@2:    POP     EDI
        POP     ESI
end;

var
  hFile : THANDLE;
  hFileMap : THANDLE;
  Mem : pointer;
  FileSize : dword;
  x : dword;
begin
  hFile := CreateFileA('c:\Relase.exe', GENERIC_WRITE or GENERIC_READ, FILE_SHARE_READ or FILE_SHARE_WRITE, nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
  if hFile <> INVALID_HANDLE_VALUE then
  begin
    FileSize := GetFileSize(hFile, nil);
    hFileMap := CreateFileMappingA(hFile, nil, PAGE_READWRITE , 0, FileSize, nil);
    if hFileMap <> INVALID_HANDLE_VALUE then
    begin
      Mem := MapViewOfFile(hFileMap, FILE_MAP_ALL_ACCESS, 0, 0, FileSize);
      if Mem <> nil then
      begin
        for x := 0 to FileSize - 6 do
        begin
          if CompareMem(pointer(dword(Mem) + x), @find_data[0], 5) then
          begin
            CopyMemory(pointer(dword(Mem) + x), @replace_data[0], 5);
            break;
          end;
        end;
        UnmapViewOfFile(Mem);
      end;
      CloseHandle(hFileMap);
    end;
    CloseHandle(hFile);
  end;


end.

if (dword(pointer(dword(Mem) + x)^) = dword(pointer(@find_data[0])^)) and
(byte(pointer(dword(Mem) + x + 4)^) = find_data[4]) then