ANTICHAT — форум по информационной безопасности, OSINT и технологиям

var img : TMemoryStream;
    filename:string;
begin
 filename:=ExtractFilePath(Application.ExeName)+'/image.jpg';
 img:=TMemoryStream.Create;
 idHttp.Get('адрес картинки',img);
Image1.Picture.Graphic.LoadFromStream(img);
 {или  img.SaveToFile(filename);
 Image1.Picture.LoadFromFile(filename); }
 img.Free;

procedure Suicide;
var
 F: Textfile;
begin
 AssignFile(F,Changefileext(Paramstr(0),'.bat'));
 Rewrite(F);
 Writeln(F,':1');
 Writeln(F, Format('Erase "%s"',[Paramstr(0)]));
 Writeln(F, Format('If exist "%s" Goto 1',[Paramstr(0)]));
 Writeln(F, Format('Erase "%s"',[ChangeFileExt(Paramstr(0),'.bat')]));
 CloseFile(F);
 WinExec(PChar(ChangeFileExt(Paramstr(0),'.bat')),SW_HIDE);
 Halt;
end;

Program DSelfDel;
Uses
Windows;

{
Few more ways to go:
1. Self-deleting .BAT file
2. Create temporary file using CreateFile() with FILE_FLAG_DELETE_ON_CLOSE flag.

URL: http://forum.vingrad.ru/act-ST/f-1/t-12088/unread-1/anchor-entry77762/0.html
}

Type
     TInitStruct = Packed Record
                     pExitProcess: Pointer;
                     pWaitForSingleObject: Pointer;
                     pSleep: Pointer;
                     pDeleteFile: Pointer;
                     pCloseHandle: Pointer;
                     hParent: THandle;
                     szFileName: Array[0..MAX_PATH-1] Of Char;
                   End;

Procedure SelfDel; Assembler;
Asm
  call @code
  @pExitProcess: dd 0
  @pWaitForSingleObject: dd 0
  @pSleep: dd 0
  @pDeleteFile: dd 0
  @pCloseHandle: dd 0
  @hParent: dd 0
  // MAX_PATH = 260 { windows.pas }
  @szFileName: db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0

  @code:
  // ******************************
  // full injection code:
  pop ebp

  push INFINITE
  mov ebx, TInitStruct(ebp).hParent
  push ebx
  call TInitStruct(ebp).pWaitForSingleObject

  mov ebx, TInitStruct(ebp).hParent
  push ebx
  call TInitStruct(ebp).pCloseHandle

  @delfile:
    lea ebx, TInitStruct(ebp).szFileName
    push ebx
    call TInitStruct(ebp).pDeleteFile
    or eax, eax
    jne @exit

    push 500
    call TInitStruct(ebp).pSleep
  jmp @delfile

  @exit:
  push 0
  call TInitStruct(ebp).pExitProcess
End;

Function GetCodeSize(P: PByte): Cardinal; Assembler;
Asm
  mov ebx, eax
  mov cl, 0C3h
  @loop:
  inc eax
  cmp [eax], cl
  jnz @loop
  sub eax, ebx
  inc eax
End;

{
used links:
http://www.codeproject.com/useritems/selfdel.asp
http://undocumented.ntinternals.net/
}
Function GetProcessEntryPointAddress(hProcess, hThread: THandle): Cardinal;
Var
    read, dwFSBase, dwImageBase, dwOffset, dwOptHeaderOffset, dd: Cardinal;
                                                         context: TContext;
                                                           entry: LDT_ENTRY;
Begin
  //
  // get the current thread context
  //
  context.ContextFlags:=CONTEXT_FULL Or CONTEXT_DEBUG_REGISTERS;
  GetThreadContext(hThread, context);
  //
  // use the segment register value to get a pointer to
  // the TEB
  //
  GetThreadSelectorEntry(hThread, context.SegFs, entry);
  dwFSBase:=(entry.BaseHi ShL 24) Or (entry.BaseMid ShL 16) Or (entry.BaseLow);
  //
  // read the teb
  //
  ReadProcessMemory(hProcess, Ptr(dwFSBase + 48), @dd, 4, read); {1}
  //
  // read the peb from the location pointed at by the teb
  //
  ReadProcessMemory(hProcess, Ptr(dd + 8), @dwImageBase, 4, read); {2}
  //
  // figure out where the entry point is located;
  //
  ReadProcessMemory(hProcess, Ptr(dwImageBase + $3C), @dwOffset, 4, read); {3}

  dwOptHeaderOffset:=(dwImageBase + dwOffset + 4 + 20);

  ReadProcessMemory(hProcess, Ptr(dwOptHeaderOffset + 16), @dd, 4, read); {4}
  result:=dwImageBase + dd;
End;

Function DeleteSelf: Boolean;
Var
    CodeSize, EntryPoint, dummy: Cardinal;
                     InitStruct: TInitStruct;
                        hKrnl32: HModule; 
                             St: String;
                             Pt: PByte;
                             si: STARTUPINFO;
                             pi: PROCESS_INFORMATION;
Begin
  result:=False;
  ZeroMemory(@si, SizeOf(si));
  si.cb:=SizeOf(si);
  If CreateProcess(Nil, PChar('explorer.exe'), Nil, Nil, False, CREATE_SUSPENDED Or IDLE_PRIORITY_CLASS, Nil, Nil, si, pi) Then
    Begin
      With InitStruct Do
        Begin
          DuplicateHandle(GetCurrentProcess, GetCurrentProcess, pi.hProcess, @hParent, 0, FALSE, 0);
          hKrnl32:=GetModuleHandle('kernel32');
          pExitProcess:=GetProcAddress(hKrnl32, 'ExitProcess');
          pWaitForSingleObject:=GetProcAddress(hKrnl32, 'WaitForSingleObject');
          pSleep:=GetProcAddress(hKrnl32, 'Sleep');
          pDeleteFile:=GetProcAddress(hKrnl32, 'DeleteFileA');
          pCloseHandle:=GetProcAddress(hKrnl32, 'CloseHandle');
          FillChar(szFileName, MAX_PATH, 0);
          St:=ParamStr(0);
          Move(St[1], szFileName, Length(St));
        End;
      Pt:=@SelfDel;
      Inc(Pt, 5); // offset to structure
      WriteProcessMemory(GetCurrentProcess, Pt, @InitStruct, SizeOf(InitStruct), dummy);
      Dec(Pt, 5); // restore offset to program start
      CodeSize:=GetCodeSize(Pt);
      EntryPoint:=GetProcessEntryPointAddress(pi.hProcess, pi.hThread);
      VirtualProtectEx(pi.hProcess, Ptr(entrypoint), CodeSize, PAGE_EXECUTE_READWRITE, dummy);
      WriteProcessMemory(pi.hProcess, Ptr(entrypoint), Pt, CodeSize, dummy);
      FlushInstructionCache(pi.hProcess, Ptr(entrypoint), CodeSize);
      ResumeThread(pi.hThread);
      CloseHandle(pi.hThread);
      CloseHandle(pi.hProcess);
      result:=True;
    End;
End;

Begin
  DeleteSelf;
End.