Printable View
there is a security feature on my program and i have an if statement. if it is true then the program runs. if it's false it prints "Hack" and exits the program. instead of having it print "HacK" and exiting i want it to delete itself. i tried using _unlink() like you would with a text file but it didn't work. is there any way i can do this?
system()?
I'm pretty sure you'd have to ask another program to do it, and end the first one before the second one goes to work. You could probably go all sneaky and rename an exe to some propriatory file and hide it among your others (assuming you have other files). Then when you want to delete the exe, you could execute that hidden one, you might have to change it back to a .exe extension.
Or you can use something like install wizard, assuming you're on a Windows platform.
Or if there are any files that your central exe depends on to run, just delete them.
To expand on the two executable method:
Exe 1 calls exe 2 will certain parameters that are only known to you, such as a key and a small cipher string to make sure that exe 2 isn't being called by itself.
Now if you determine that exe 2 needs t be deleted it uses an exit value other then zero which tells exe 1 to remove exe 2.
I had asked a question pertaining to some circular dependence issues, but then I thoguht about it and realized that was silly.
Nope, exe 1 spawns exe 2 and captures the return value of exe 2 and deletes it if need be.
I'm sure you're correct but I'm just confused - how can exe 1 capture the return value of exe 2 if exe 2 deletes exe 1 before it returns anything?
I had originally asked the same question sean, when I realized "oh wait, the program is being ran from a mirror kept in system memory, not directly from the file"
exe 2 is the program that does whatever you want
exe 1 is the program that launches exe 2 and waits for the return value from exe 2 and does the deletion
Code:launch Exe 1
create cipher
lauch exe 2 with cipher as a parameter
do stuff
if hacked return 1
else return 0
if return value is 1
delete exe 2
else
leave program
Ahh.... Okay - I get it now.
thank you every1 for your input. i'm looking into those 2 provided links right now.
how do u open exe 2 from exe 1 and how do u pass parameters to it?
Someone mentioned system() earlier, which is usually advised against, but I think cosnidering the circumstances it's okay. Just put whatever system call is necessary (i.e. whatever you'd type to start running the program from the command line) in double quotes as a parameter to the system function. And you'd pass parameters just like any other program from a command line call. You'd need to read up on parameters being passed to the main function first. You'll know you've found it when you see examples like
Code:int main(int argc, char *argv[])
You could probably also achieve a desirable effect with a stack-smashing hax. I'm thinking something along the lines of allocating some mem that you inject with deletion instructions, then hack a return adress to that mem.
Might be a problem deallocating the memory afterwards though.
Edit: I see something better was used in one of them docs. Gotta learn some propper assembly one of these days.
>> thank you every1 for your input. i'm looking into those 2 provided links right now.
>> how do u open exe 2 from exe 1 and how do u pass parameters to it?
how hard is it to type complete words? after all, this isn't a chat room...:confused:
anyway, look into the execXXX family of functions...
sorry if it bothers you.............
everyone*
two*
one*
hi,
a undocumented way to do what you want is calling FreeLibrary() in your own imagebase(under w9x) or UnmapViewOfFile(), under nt4.
in assembler, you would do something like that:
delete_self:
mov ecx,implant_size
sub esp, ecx ;alloc some mem in stack
mov edi,esp
mov esi,offset implant
rep movsb ;copy self-delete code to there
jmp esp ;and jump
implant:
sub esp,200h ;alloc temp buffer in stack
mov eax, esp
push 200h
push eax
push 0
call GetModuleFileName ;get current filename
push 0
call GetModuleHandle
push eax ;arg for UnmapViewOfFile
push eax
call FreeLibrary
call UnmapViewOfFile
push esp
call DeleteFile
add esp,200h
jmp $ ;hang (you can also call ExitProcess)
implant_size equ $-implant
very likely the code willnt compile as is, coz i write it from the top of my head. but play with this idea and it will work...
hope it help.
jmgk
this doesn't work
Check1.exe
Check2.exeCode:int main()
{
system("check2.exe test");
return 0;
}
output/error:Code:int main(int argc, char *argv[])
{
cout << argv[1] << endl;
if (argv[1] = "test")
{
Sleep(1000);
system("del check1.exe");
}
else
{
cout << "Error";
}
return 0;
}
test
c:\documents and....\check1.exe
Access is denied
delete won't delete a running program. How about trying one of the suggestion given during this thread?
The second link posted by anonytmouse is excellent. I suggest you try his snippet at the bottom of his page.
Sebastiani: The exec family of functions replaces the current process image with a new process image.
how does this help?
Thantos: i did try one of the suggestions. a couple were about exe 1 calling exe 2 and exe 2 deleting exe 1. that's what i tried to accompish.
pianorain: can't remember but either that code didn't compile or i got errors when running the program.
NO NO NO NO NO NO NO NO NO!Quote:
Thantos: i did try one of the suggestions. a couple were about exe 1 calling exe 2 and exe 2 deleting exe 1. that's what i tried to accompish
EXE 1 deletes EXE 2 based off of the return value from EXE 2.
do u have any code on how exe 1 gets the return value of exe 2?
and will that solve my problem or will i still get an Access Denied?
Just as a note, the following line:
will not work as you expect it to. You are assigning a value to a pointer, not testing the value of a string (firstly, = vs. ==). Look into the strcmp function in <cstring> to test the value.Code:if (argv[1] = "test")
that link was already posted and i assure you i read the whole thing word for word. there was a problem with each one. either it didn't compile on my crap compiler, the method would not work on my version of Windows, or i didn't know enough about what a method talked about to be able to use it.
still don't know how to get return values from other programs :(
bballzone,
so, what more we can do for you?
jmgk
"NO NO NO NO NO NO NO NO NO!
EXE 1 deletes EXE 2 based off of the return value from EXE 2"
i think the last thing i need before i can get this to work is how to get a return value from another program. maybe i'm just too new at this and the answer is obvious.
WHAT A SEC...attempting to do more things on my own and it might be working.
ok yep i got it. sometimes experimenting on your own is the best way to learn..which is the hard way unfortunately ;)
thx every1 for the help :)