我把lilor说的原码贴上来,大家参考,很不错。
program SelfModify;
uses
Windows,
Classes,
Sysutils,
TlHelp32,
Forms,
Unit1 in 'Unit1.pas' {Form1};
{$R *.RES}
Var
s: string;
a: byte;
Handle: THandle;
Found: boolean;
Lppe: TProcessEntry32;
begin
s:='';
a:=1;
while ParamStr(a)<>'' do
begin
s:=s+ParamStr(a)+' ';
inc(a);
end;
if s<>'' then
begin
Handle:=CreateToolhelp32Snapshot(TH32CS_SNAPALL,0);
lppe.dwSize:=Sizeof(TProcessEntry32);
Found:=Process32First(Handle,Lppe);
while Found do
begin
if pos(Lppe.szExeFile,s)<>0 then
TerminateProcess(OpenProcess(PROCESS_ALL_ACCESS, True,
Lppe.th32ProcessID),0);
Found:= Process32Next(Handle,Lppe);
end;
CloseHandle(Handle);
while FileExists(s) do DeleteFile(s);
CopyFile(PChar(ParamStr(0)),PChar(s),True);
winexec(PChar(s),SW_SHOW);
exit;
end;
Application.Initialize;
Application.CreateForm(TForm1, Form1);
Application.Run;
end.
{ 单元 }
unit Unit1;
interface
uses
Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
ComCtrls, StdCtrls;
type
TForm1 = class(TForm)
Button1: TButton;
StatusBar1: TStatusBar;
procedure FormCreate(Sender: TObject);
procedure Button1Click(Sender: TObject);
procedure FormClose(Sender: TObject; var Action: TCloseAction);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
TempName: string;
implementation
{$R *.DFM}
procedure TForm1.FormCreate(Sender: TObject);
var
Sr: TSearchRec;
size : Longint;
begin
FindFirst(ParamStr(0),$27,Sr);
size:=Sr.Size;
FindClose(Sr);
StatusBar1.SimpleText:='本程序大小为 '+IntToStr(size)+' 字节';
end;
procedure TForm1.Button1Click(Sender: TObject);
var
Dir: PChar;
Ch: Array[0..3] of Char;
Stream1,Stream2: TMemoryStream;
begin
GetMem(Dir,254);
GetTempPath(254, Dir);
TempName:=StrPas(Dir)+'o.o.0.o.o.exe';
CopyFile(PChar(ParamStr(0)),PChar(TempName),False);
Stream1:=TMemoryStream.Create;
Stream2:=TMemoryStream.Create;
Stream1.LoadFromFile(TempName);
//在尾部加入4个随机字节
Randomize;
Ch[0]:=Chr(Random(256));
Ch[1]:=Chr(Random(256));
Ch[2]:=Chr(Random(256));
Ch[3]:=Chr(Random(256));
Stream1.Seek(0,soFromEnd);
Stream1.Write(Ch,4);
//修改偏移48的一个字节,记录程序运行次数
Stream1.Seek(0,soFromBeginning);
Stream2.CopyFrom(Stream1,48);
Stream1.Seek(48,soFromBeginning);
Stream1.Read(Ch,1);
Ch[0]:=Chr(1+Ord(Ch[0]));
Stream2.Write(Ch,1);
Stream1.Seek(49,soFromBeginning);
Stream2.CopyFrom(Stream1,Stream1.Size-49);
Stream2.SaveToFile(TempName);
Stream1.Free;
Stream2.Free;
FreeMem(Dir);
Close;
end;
procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction);
begin
WinExec(PChar(TempName+' '+ParamStr(0)), SW_SHOWNORMAL);
end;
end.