// 轻量化杀毒软件 - 终极整合版 v9.0
#define _CRT_SECURE_NO_WARNINGS
#include <windows.h>
#include <iostream>
#include <fstream>
#include <string>
#include <vector>
#include <set>
#include <map>
#include <thread>
#include <mutex>
#include <sstream>
#include <algorithm>
#include <tlhelp3
2.h>
using namespace std;
// ========== 动态加载 Psapi.dll ==========
typedef BOOL (WINAPI *LPFN_GETMODULEFILENAMEEXA)(
HANDLE hProcess,
HMODULE hModule,
LPSTR lpFilename,
DWORD nSize
);
HMODULE hPsapi = nullptr;
LPFN_GETMODULEFILENAMEEXA pGetModuleFileNameExA = nullptr;
BOOL SafeGetModuleFileNameExA(HANDLE hProcess, HMODULE hModule, LPSTR lpFilename, DWORD nSize) {
if (pGetModuleFileNameExA) return pGetModuleFileNameExA(hProcess, hModule, lpFilename, nSize);
strcpy(lpFilename, "<unknown>");
return FALSE;
}
bool LoadPsapiFunction() {
hPsapi = LoadLibraryA("Psapi.dll");
if (!hPsapi) return false;
pGetModuleFileNameExA = (LPFN_GETMODULEFILENAMEEXA)GetProcAddress(hPsapi, "GetModuleFileNameExA");
return pGetModuleFileNameExA != nullptr;
}
// ========== 全局常量 ==========
const string LOG_FILE = "antivirus.log";
const string WHITELIST_FILE = "whitelist.txt";
const string QUARANTINE_DIR = "quarantine";
const string QUARANTINE_LOG = "quarantine_log.txt";
map<string, string> g_whitelist; // 文件/目录白名单
set<string> g_trustedProcesses; // 可信进程名（防误报）
volatile bool g_monitoring = false;
int fileCount = 0, suspiciousCount = 0;
mutex printMutex;
// ========== 函数前置声明 ==========
void log(const string& msg);
string toLower(string s);
string normalizePath(const string& path);
void loadWhitelist();
void saveWhitelist();
bool isWhitelisted(const string& filePath);
bool isTrustedProcess(const string& exeName);
bool SuspendProcess(DWORD pid);
bool ResumeProcess(DWORD pid);
enum Action { TERMINATE, IGNORE, ADD_TO_WHITELIST };
Action ShowDecisionDialog(const string& processName, const string& reason);
DWORD WINAPI BehaviorMonitorThread(LPVOID param);
void addFalsePositive();
void manageQuarantine();
bool restoreFileFromQuarantine(const string& quarantinedFile);
void deleteFileFromQuarantine(const string& quarantinedFile);
void clearQuarantine();
vector<string> listQuarantinedFiles();
void quarantineFile(const string& filePath);
bool isFileSuspicious(const string& filePath, string& matchedRule);
void handleSuspiciousFile(const string& filePath);
void scanPath(const string& root);
void scanCurrentDir();
void scanCustomDir();
void scanAllDrives();
void startRealTimeMonitor();
void stopRealTimeMonitor();
void showMainMenu();
// ========== 工具函数 ==========
void log(const string& msg) {
ofstream out(LOG_FILE.c_str(), ios::app);
if (!out.is_open()) return;
time_t t = time(0);
char* ts = ctime(&t); if (ts) ts[strlen(ts)-1] = 0;
out << "[" << ts << "] " << msg << endl;
out.close();
}
string toLower(string s) {
transform(s.begin(), s.end(), s.begin(), ::tolower);
return s;
}
string normalizePath(const string& path) {
if (path.empty()) return "";
string norm = path;
replace(norm.begin(), norm.end(), '/', '\\');
transform(norm.begin(), norm.end(), norm.begin(), ::tolower);
DWORD attr = GetFileAttributesA(norm.c_str());
if (attr != 0xFFFFFFFF && (attr & FILE_ATTRIBUTE_DIRECTORY)) {
if (!norm.empty() && norm.back() != '\\') norm += '\\';
}
return norm;
}
// ========== 白名单操作 ==========
void loadWhitelist() {
ifstream in(WHITELIST_FILE.c_str());
if (!in.is_open()) {
ofstream create(WHITELIST_FILE.c_str()); create.close();
cout << "✅ 白名单文件不存在，已创建。\n";
return;
}
string line;
while (getline(in, line)) {
size_t pos = line.find('|');
if (pos != string::npos) {
string path = normalizePath(line.substr(0, pos));
string type = line.substr(pos + 1);
if (type == "FILE" || type == "DIR") g_whitelist[path] = type;
} else {
g_trustedProcesses.insert(toLower(line)); // 信任的进程名
}
}
in.close();
cout << "✅ 已加载 " << g_whitelist.size() << " 个路径白名单，"
<< g_trustedProcesses.size() << " 个可信进程。\n";
log("Loaded whitelist.");
}
void saveWhitelist() {
ofstream out(WHITELIST_FILE.c_str());
if (!out.is_open()) return;
for (const auto& item : g_whitelist)
out << item.first << "|" << item.second << endl;
for (const string& proc : g_trustedProcesses)
out << proc << endl;
out.close();
log("Whitelist saved.");
}
bool isWhitelisted(const string& filePath) {
string np = normalizePath(filePath);
if (g_whitelist.find(np) != g_whitelist.end()) return true;
for (const auto& item : g_whitelist)
if (item.second == "DIR" && np.find(item.first) == 0) return true;
return false;
}
bool isTrustedProcess(const string& exeName) {
return g_trustedProcesses.find(toLower(exeName)) != g_trustedProcesses.end();
}
// ========== 挂起/恢复进程（使用 NtSuspendProcess）==========
using NtSuspendProcess = NTSTATUS(NTAPI*)(HANDLE ProcessHandle);
using NtResumeProcess = NTSTATUS(NTAPI*)(HANDLE ProcessHandle);
bool SuspendProcess(DWORD pid) {
HANDLE hProc = OpenProcess(PROCESS_SUSPEND_RESUME, FALSE, pid);
if (!hProc) return false;
NtSuspendProcess pNtSuspendProcess = (NtSuspendProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtSuspendProcess");
if (pNtSuspendProcess) {
pNtSuspendProcess(hProc);
CloseHandle(hProc);
return true;
}
CloseHandle(hProc);
return false;
}
bool ResumeProcess(DWORD pid) {
HANDLE hProc = OpenProcess(PROCESS_SUSPEND_RESUME, FALSE, pid);
if (!hProc) return false;
NtResumeProcess pNtResumeProcess = (NtResumeProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtResumeProcess");
if (pNtResumeProcess) {
pNtResumeProcess(hProc);
CloseHandle(hProc);
return true;
}
CloseHandle(hProc);
return false;
}
// ========== 用户决策弹窗 ==========
Action ShowDecisionDialog(const string& processName, const string& reason) {
stringstream msg;
msg << "发现可疑行为！\n\n"
<< "进程: " << processName << "\n"
<< "原因: " << reason << "\n\n"
<< "请选择处理方式：\n"
<< "是 —— 终止该进程\n"
<< "否 —— 忽略本次\n"
<< "取消 —— 加入白名单并忽略";
int result = MessageBoxA(nullptr, msg.str().c_str(), "【安全警告】", MB_YESNOCANCEL | MB_ICONWARNING);
switch (result) {
case IDYES: return TERMINATE;
case IDNO: return IGNORE;
default: return ADD_TO_WHITELIST;
}
}
// ========== 行为监控线程 ==========
DWORD WINAPI BehaviorMonitorThread(LPVOID param) {
cout << "🔍 启动行为监控引擎...\n";
log("Behavior monitor started");
set<DWORD> prevPids;
set<string> prevAutoRun;
while (g_monitoring) {
Sleep(
2000);
// --- 1. 监控新进程 ---
HANDLE hSnap = CreateToolhelp3
2Snapshot(TH3
2CS_SNAPPROCESS, 0);
if (hSnap == INVALID_HANDLE_VALUE) continue;
PROCESSENTRY3
2 pe = {sizeof(pe)};
set<DWORD> currPids;
if (Process3
2First(hSnap, &pe)) {
do {
currPids.insert(pe.th3
2ProcessID);
if (prevPids.find(pe.th3
2ProcessID) == prevPids.end()) {
string exeName = toLower(pe.szExeFile);
if (isTrustedProcess(exeName)) continue;
HANDLE hProc = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pe.th3
2ProcessID);
if (!hProc) continue;
char path[MAX_PATH] = {0};
if (SafeGetModuleFileNameExA(hProc, nullptr, path, MAX_PATH)) {
string lowerPath = toLower(path);
if (lowerPath.find("\\temp\\") != string::npos ||
lowerPath.find("downloads") != string::npos ||
lowerPath.find("appdata\\local\\temp") != string::npos) {
SuspendProcess(pe.th3
2ProcessID);
MessageBoxA(nullptr, ("⏸️ 已暂停可疑进程:\n" + string(pe.szExeFile)).c_str(),
"进程已暂停", MB_OK | MB_ICONINFORMATION);
Action act = ShowDecisionDialog(pe.szExeFile, "从临时目录启动");
if (act == TERMINATE) {
TerminateProcess(hProc, 0);
log("Terminated suspicious process: " + string(pe.szExeFile));
} else if (act == ADD_TO_WHITELIST) {
g_trustedProcesses.insert(exeName);
saveWhitelist();
ResumeProcess(pe.th3
2ProcessID);
MessageBoxA(nullptr, ("✅ 已将 " + string(pe.szExeFile) + " 加入白名单").c_str(),
"已信任", MB_OK);
log("Added to whitelist: " + string(pe.szExeFile));
} else {
ResumeProcess(pe.th3
2ProcessID);
}
}
}
CloseHandle(hProc);
}
} while (Process3
2Next(hSnap, &pe));
}
CloseHandle(hSnap);
prevPids = currPids;
// ---
2. 监控自启动项 ---
HKEY hKey;
if (
RegOpenKeyEx(HKEY_CURRENT_USER,
"Software\\Microsoft\\Windows\\CurrentVersion\\Run",
0, KEY_READ, &hKey) == ERROR_SUCCESS) {
set<string> currAutoRun;
char name[
256], path[10
24];
DWORD i = 0, nameLen, pathLen, type;
while (true) {
nameLen = sizeof(name); pathLen = sizeof(path);
LONG ret = RegEnumValue(hKey, i++, name, &nameLen, nullptr, &type, (BYTE*)path, &pathLen);
if (ret != ERROR_SUCCESS) break;
currAutoRun.insert(string(name));
if (prevAutoRun.find(name) == prevAutoRun.end()) {
string p = toLower(path);
if (p.find(".exe") != string::npos &&
p.find("chrome") == string::npos &&
p.find("steam") == string::npos) {
Action act = ShowDecisionDialog("autorun:" + string(name), "新增可疑自启动项");
if (act == TERMINATE) {
RegDeleteValue(hKey, name);
MessageBoxA(nullptr, "已删除
注册表自启动项", "✅ 删除
成功", MB_OK);
log("Deleted autorun: " + string(name));
} else if (act == ADD_TO_WHITELIST) {
g_trustedProcesses.insert("autorun:" + toLower(name));
saveWhitelist();
}
}
}
}
RegCloseKey(hKey);
prevAutoRun = currAutoRun;
}
// --- 3. 检测远程线程注入 ---
HANDLE hThreadSnap = CreateToolhelp3
2Snapshot(TH3
2CS_SNAPTHREAD, 0);
if (hThreadSnap != INVALID_HANDLE_VALUE) {
THREADENTRY3
2 te = {sizeof(te)};
if (Thread3
2First(hThreadSnap, &te)) {
do {
HANDLE hThread = OpenThread(THREAD_GET_CONTEXT, FALSE, te.th3
2ThreadID);
if (hThread) {
DWORD ownerPid = te.th3
2OwnerProcessID;
char ownerName[MAX_PATH] = {0};
HANDLE hProc = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, ownerPid);
if (hProc && SafeGetModuleFileNameExA(hProc, nullptr, ownerName, MAX_PATH)) {
string owner = toLower(ownerName);
if (owner.find("explorer.exe") != string::npos ||
owner.find("winlogon.exe") != string::npos ||
owner.find("lsass.exe") != string::npos) {
SuspendProcess(ownerPid);
MessageBoxA(nullptr, ("⏸️ 检测到向关键进程注入代码: " + string(ownerName)).c_str(),
"⚠️ DLL 注入警告", MB_OK | MB_ICONERROR);
Action act = ShowDecisionDialog(ownerName, "DLL 注入");
if (act == TERMINATE) {
TerminateProcess(hProc, 0);
log("💥 Terminated injected process: " + string(ownerName));
} else if (act == ADD_TO_WHITELIST) {
g_trustedProcesses.insert(owner);
saveWhitelist();
ResumeProcess(ownerPid);
} else {
ResumeProcess(ownerPid);
}
}
}
if (hProc) CloseHandle(hProc);
CloseHandle(hThread);
}
} while (Thread3
2Next(hThreadSnap, &te));
}
CloseHandle(hThreadSnap);
}
}
return 0;
}
// ========== 隔离区管理 ==========
vector<string> listQuarantinedFiles() {
vector<string> files;
WIN3
2_FIND_DATAA data;
string pattern = QUARANTINE_DIR + "\\*";
HANDLE hFind = FindFirstFileA(pattern.c_str(), &data);
if (hFind == INVALID_HANDLE_VALUE) return files;
do {
if (!(data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY))
files.push_back(string(data.cFileName));
} while (FindNextFileA(hFind, &data));
FindClose(hFind);
return files;
}
bool restoreFileFromQuarantine(const string& quarantinedFile) {
string basename = quarantinedFile.substr(quarantinedFile.find_last_of("\\/") + 1);
ifstream logIn(QUARANTINE_LOG.c_str());
if (!logIn.is_open()) {
cout << "❌ 隔离日志无法打开。\n";
return false;
}
string line, originalPath;
vector<string> remainingLogs;
bool found = false;
while (getline(logIn, line)) {
size_t pos = line.find('=');
if (pos != string::npos && line.substr(0, pos) == basename) {
originalPath = line.substr(pos + 1);
found = true;
} else {
remainingLogs.push_back(line);
}
}
logIn.close();
if (!found) {
cout << "❌ 无法找到该文件的原始路径记录。\n";
return false;
}
string parentDir = originalPath.substr(0, originalPath.find_last_of("\\/"));
DWORD attr = GetFileAttributesA(parentDir.c_str());
if (attr == 0xFFFFFFFF || !(attr & FILE_ATTRIBUTE_DIRECTORY)) {
cout << "❌ 原目录不存在：" << parentDir << "\n";
cout << "1. 选择新目录恢复\n
2. 取消\n>";
char c; cin >> c; cin.ignore();
if (c != '1') return false;
cout << "请输入目标目录: "; string targetDir; getline(cin, targetDir);
attr = GetFileAttributesA(targetDir.c_str());
if (attr == 0xFFFFFFFF || !(attr & FILE_ATTRIBUTE_DIRECTORY)) {
cout << "❌ 目标目录无效。\n";
return false;
}
originalPath = targetDir + "\\" + basename;
}
if (MoveFileA(quarantinedFile.c_str(), originalPath.c_str())) {
ofstream logOut(QUARANTINE_LOG.c_str());
for (const string& l : remainingLogs) logOut << l << endl;
logOut.close();
cout << "✅ 文件已恢复至: " << originalPath << endl;
log("Restored from quarantine: " + originalPath);
return true;
} else {
cout << "❌ 恢复失败，错误码: " << GetLastError() << endl;
return false;
}
}
void deleteFileFromQuarantine(const string& quarantinedFile) {
string basename = quarantinedFile.substr(quarantinedFile.find_last_of("\\/") + 1);
ifstream in(QUARANTINE_LOG.c_str());
vector<string> lines;
string line;
while (getline(in, line)) {
if (line.find("=") != string::npos && line.substr(0, line.find('=')) != basename) {
lines.push_back(line);
}
}
in.close();
ofstream out(QUARANTINE_LOG.c_str());
for (const string& l : lines) out << l << endl;
out.close();
if (DeleteFileA(quarantinedFile.c_str())) {
cout << "🗑️ 文件已永久删除。\n";
log("Deleted from quarantine: " + basename);
} else {
cout << "❌ 删除失败，错误码: " << GetLastError() << endl;
}
}
void clearQuarantine() {
vector<string> files = listQuarantinedFiles();
for (const string& f : files) DeleteFileA((QUARANTINE_DIR + "\\" + f).c_str());
ofstream(QUARANTINE_LOG.c_str()).close();
cout << "🧹 隔离区和日志已全部清空。\n";
log("Quarantine cleared.");
}
void manageQuarantine() {
while (true) {
vector<string> files = listQuarantinedFiles();
if (files.empty()) {
cout << "\n📭 隔离区为空。\n";
break;
}
cout << "\n--- 🔒 隔离区文件列表 ---\n";
for (size_t i = 0; i < files.size(); ++i)
cout << i + 1 << ". " << files[i] << endl;
cout << "\n操作选项：\n";
cout << "1. 恢复文件\n
2. 删除文件\n3. 清空隔离区\n0.
返回\n>";
char c; cin >> c; cin.ignore();
switch (c) {
case '1': {
cout << "选择编号: "; int n; cin >> n; cin.ignore();
if (n >= 1 && n <= (int)files.size())
restoreFileFromQuarantine(QUARANTINE_DIR + "\\" + files[n-1]);
else cout << "❌ 无效编号。\n";
break;
}
case '
2': {
cout << "选择编号: "; int n; cin >> n; cin.ignore();
if (n >= 1 && n <= (int)files.size())
deleteFileFromQuarantine(QUARANTINE_DIR + "\\" + files[n-1]);
else cout << "❌ 无效编号。\n";
break;
}
case '3': clearQuarantine(); break;
case '0': return;
default: cout << "❌ 无效选择。\n";
}
}
}
void quarantineFile(const string& filePath) {
if (!CreateDirectoryA(QUARANTINE_DIR.c_str(), nullptr)) {
if (GetLastError() != ERROR_ALREADY_EXISTS) {
cout << "❌ 无法创建隔离目录。\n";
return;
}
}
string filename = filePath.substr(filePath.find_last_of("\\/") + 1);
string dest = QUARANTINE_DIR + "\\" + filename;
string temp = dest;
int counter = 1;
while (GetFileAttributesA(temp.c_str()) != 0xFFFFFFFF)
temp = QUARANTINE_DIR + "\\" + to_string(counter++) + "_" + filename;
if (MoveFileA(filePath.c_str(), temp.c_str())) {
ofstream logOut(QUARANTINE_LOG.c_str(), ios::app);
logOut << temp.substr(temp.find_last_of("\\/") + 1) << "=" << filePath << endl;
logOut.close();
cout << "🔒 文件已隔离: " << temp << " (原路径: " << filePath << ")" << endl;
log("Quarantined: " + filePath);
} else {
cout << "❌ 隔离失败！错误码: " << GetLastError() << endl;
}
}
bool isFileSuspicious(const string& filePath, string& matchedRule) {
ifstream file(filePath, ios::binary);
if (!file.is_open()) return false;
string line;
vector<pair<string, string>> keywords = {
{"format ", "检测到磁盘格式化命令"},
{"del ", "检测到批量删除文件命令"},
{"rd /s", "检测到递归删除目录命令"},
{"shutdown", "检测到关机指令"},
{"reg delete", "检测到
注册表删除操作"},
{"powershell -c", "检测到远程代码执行"},
{"wscript.shell", "检测到脚本执行环境创建"},
{"%0|%0", "无限递归自调用"},
{"taskkill /f /im", "终止关键系统程序"}
};
while (getline(file, line)) {
transform(line.begin(), line.end(), line.begin(), ::tolower);
for (const auto& kw : keywords) {
if (line.find(kw.first) != string::npos) {
matchedRule = kw.second;
file.close();
return true;
}
}
}
file.close();
return false;
}
void handleSuspiciousFile(const string& filePath) {
string matchedRule;
if (!isFileSuspicious(filePath, matchedRule)) return;
stringstream msg;
msg << "发现可疑脚本！\n\n"
<< "文件路径: " << filePath << "\n"
<< "威胁类型: " << matchedRule << "\n\n"
<< "处理方式：\n"
<< "是 —— 隔离该文件\n"
<< "否 —— 加入白名单\n"
<< "取消 —— 忽略本次";
MessageBeep(MB_ICONEXCLAMATION);
int result = MessageBoxA(nullptr, msg.str().c_str(), "【安全警告】", MB_YESNOCANCEL | MB_ICONWARNING);
switch (result) {
case IDYES:
quarantineFile(filePath);
break;
case IDNO:
g_whitelist[normalizePath(filePath)] = "FILE";
saveWhitelist();
MessageBoxA(nullptr, ("已信任: " + filePath).c_str(), "✅ 已加入白名单", MB_OK);
break;
case IDCANCEL:
break;
}
}
void scanPath(const string& root) {
WIN3
2_FIND_DATAA data;
string pattern = root + "\\*";
HANDLE hFind = FindFirstFileA(pattern.c_str(), &data);
if (hFind == INVALID_HANDLE_VALUE) {
cout << "❌ 无法访问: " << root << endl;
return;
}
do {
string filename = data.cFileName;
if (filename == "." || filename == "..") continue;
string fullPath = root + "\\" + filename;
if (data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) {
scanPath(fullPath);
} else {
set<string> exts = {"bat", "vbs", "js", "ps1", "cmd", "exe"};
string ext = filename.substr(filename.find_last_of('.') + 1);
transform(ext.begin(), ext.end(), ext.begin(), ::tolower);
if (exts.count(ext)) {
fileCount++;
if (isWhitelisted(fullPath)) {
cout << "✅ 白名单跳过: " << fullPath << endl;
continue;
}
if (isFileSuspicious(fullPath)) {
suspiciousCount++;
handleSuspiciousFile(fullPath);
}
}
}
} while (FindNextFileA(hFind, &data));
FindClose(hFind);
}
void scanCurrentDir() {
char buffer[MAX_PATH]; GetCurrentDirectoryA(MAX_PATH, buffer);
string current(buffer);
cout << "🔍 正在扫描当前目录: " << current << "\n";
fileCount = 0; suspiciousCount = 0;
scanPath(current);
cout << "\n📊 扫描完成！共检查 " << fileCount << " 个脚本，发现 " << suspiciousCount << " 个可疑项。\n";
}
void scanCustomDir() {
string path;
cout << "请输入要扫描的路径:\n>";
getline(cin, path);
if (path.empty()) return;
cout << "🔍 正在扫描: " << path << "\n";
fileCount = 0; suspiciousCount = 0;
scanPath(path);
cout << "\n📊 扫描完成！共检查 " << fileCount << " 个脚本，发现 " << suspiciousCount << " 个可疑项。\n";
}
void scanAllDrives() {
DWORD drives = GetLogicalDrives();
cout << "🔍 正在扫描所有磁盘...\n";
for (int i = 0; i <
26; ++i) {
if (drives & (1 << i)) {
string drive = string() + static_cast<char>('A' + i) + ":\\";
UINT type = GetDriveTypeA(drive.c_str());
if (type == DRIVE_FIXED || type == DRIVE_REMOVABLE) {
cout << "\n🔍 开始扫描驱动器 " << drive << "\n";
fileCount = 0; suspiciousCount = 0;
scanPath(drive);
cout << "📊 " << drive << " 扫描完成：检查 " << fileCount
<< " 文件，发现 " << suspiciousCount << " 可疑项。\n";
}
}
}
}
void startRealTimeMonitor() {
cout << "此功能暂未实现（文件级实时监控）。\n";
}
void stopRealTimeMonitor() {
g_monitoring = false;
}
void addFalsePositive() {
cout << "请输入误报的进程名（如 chrome.exe）:\n>";
string proc; getline(cin, proc);
if (proc.empty()) return;
g_trustedProcesses.insert(toLower(proc));
saveWhitelist();
cout << "✅ 已将 \"" << proc << "\" 添加为可信进程。\n";
log("Added false positive: " + proc);
}
void showMainMenu() {
system("cls");
cout << "\n========== 🛡️ 杀毒工具 v9.0 ==========\n";
cout << "1. 扫描当前目录\n";
cout << "
2. 扫描指定目录\n";
cout << "3. 扫描全盘\n";
cout << "4. 主动防御（实时监控）\n";
cout << "5. 管理隔离区\n";
cout << "6. 启用行为监控（动态防护）\n";
cout << "7. 添加误报程序（防误报）\n";
cout << "0. 退出\n>";
}
int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {
SetConsoleOutputCP(936);
SetConsoleCP(936);
AllocConsole();
freopen("CONOUT$", "w", stdout);
freopen("CONIN$", "r", stdin);
if (!LoadPsapiFunction()) {
MessageBoxA(nullptr, "⚠️ 无法加载 Psapi.dll", "警告", MB_OK | MB_ICONWARNING);
}
cout << "🛡️ 欢迎使用轻量化静态隔离杀毒软件\n";
loadWhitelist();
CreateDirectoryA(QUARANTINE_DIR.c_str(), nullptr);
while (true) {
showMainMenu();
char choice;
cin >> choice;
cin.ignore();
switch (choice) {
case '1': scanCurrentDir(); break;
case '
2': scanCustomDir(); break;
case '3': scanAllDrives(); break;
case '4': cout << "此功能预留。\n"; break;
case '5': manageQuarantine(); break;
case '6':
if (!g_monitoring) {
g_monitoring = true;
CreateThread(nullptr, 0, BehaviorMonitorThread, nullptr, 0, nullptr);
cout << "✅ 行为监控已启用\n";
} else {
cout << "⚠️ 行为监控已在运行\n";
}
break;
case '7': addFalsePositive(); break;
case '0':
if (g_monitoring) g_monitoring = false;
if (hPsapi) FreeLibrary(hPsapi);
FreeConsole();
MessageBoxA(nullptr, "👋 杀毒软件已退出", "提示", MB_OK);
return 0;
default:
MessageBoxA(nullptr, "❌ 无效选择", "错误", MB_OK | MB_ICONERROR);
}
system("pause");
}
}
还是不行
本文解析了注册表操作中遇到的权限问题，特别是删除键值时返回错误代码2的原因。指出了解决方案在于使用RegOpenKeyEx时加入KEY_WOW64_64KEY参数以获取更高权限。
扫一扫
912
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
