mirror of
https://github.com/ZeroMemoryEx/SleepKiller
synced 2026-06-08 13:00:56 +00:00
GєṭRєҡṭBȏʏ724
4b54e41e6d
1. Change the patch stub to a single RET, a bunch of NOPs is pretty pointless, especially if you hardcode how much the amount of NOP you used, it have a chance that the NOPs will "bleed" to the next function. 2. Refactor the main function code 3. The biggest change, patch NtDelayExecution instead of Sleep for wider range of effect, malwares can easily switch to using NtDelayExecution (just like what i did with mine). Tho this will make any kind of sleep doesnt work, whilst patching Sleep, some stuff still can use SleepEx or NtDelayExecution instead.
54 lines
1.0 KiB
C++
54 lines
1.0 KiB
C++
#include <windows.h>
|
|
#include <tlhelp32.h>
|
|
|
|
|
|
char patch[] = { 0xC3 }; // no need for a bunch of NOPs, a single RET should be enough
|
|
|
|
DWORD GetPID(LPCSTR pn)
|
|
{
|
|
DWORD procId = 0;
|
|
HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
|
|
|
|
if (hSnap != INVALID_HANDLE_VALUE)
|
|
{
|
|
PROCESSENTRY32 pE;
|
|
pE.dwSize = sizeof(pE);
|
|
|
|
if (Process32First(hSnap, &pE))
|
|
{
|
|
if (!pE.th32ProcessID)
|
|
Process32Next(hSnap, &pE);
|
|
do
|
|
{
|
|
if (!_stricmp(pE.szExeFile, pn))
|
|
{
|
|
procId = pE.th32ProcessID;
|
|
break;
|
|
}
|
|
} while (Process32Next(hSnap, &pE));
|
|
}
|
|
}
|
|
CloseHandle(hSnap);
|
|
return procId;
|
|
}
|
|
|
|
int wmain() {
|
|
DWORD tpid = GetPID("Malware.exe");
|
|
if (!tpid)
|
|
return -1;
|
|
|
|
HANDLE ProcessHandle = OpenProcess(PROCESS_VM_WRITE, 0, tpid);
|
|
if (!ProcessHandle)
|
|
return (-1);
|
|
|
|
PVOID NTDEAddr = GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtDelayExecution");
|
|
if (!NTDEAddr)
|
|
return(-1);
|
|
|
|
if (!WriteProcessMemory(ProcessHandle, NTDEAddr, patch, 1, 0))
|
|
return (-1);
|
|
|
|
system("pause");
|
|
return 0;
|
|
}
|