文章作者：asm
信息来源：邪恶八进制信息安全团队
此工具由原来本人写的一个＂web安全扫描器＂演化而来，但是却比＂web安全扫描器＂更好，并且加入了目录监视的功能，性能也稳定。希望大家喜欢 ：）
工具类别：开源程序
编写环境：masm32
更新内容：采用线程扫描，程序不假死；用户自己添加特征库；代码大幅度优化
此1.2版因为有胆量和本人班主任叫骂了一架,居然修正了1.1版一个bug,并且将误报概率减至1%。同时因为朋友的要求，加入了详细的检测报告；修改了文件的察看方式，直接调用了记事本来察看，比较方便
本程序使用win32asm编写，自然继承了其速度快的特点，比同类程序效率高。
******************************************************
;程序编写by Asm
;日期：2007-3-28日凌晨
;出处：
http://www.wolfexp.net/（红狼安全小组）
;注意事项：如欲转载，请保持本程序的完整，并注明：
;转载自 红狼安全小组(
http://www.wolfexp.net/)
;******************************************************
.386
.model flat, stdcall
option casemap :none
include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib
include shell32.inc
includelib shell32.lib
include comctl32.inc
includelib comctl32.lib
includelib advapi32.lib
include advapi32.inc
_ChenLook proto :DWORD
_ChangeNotification proto :DWORD,:DWORD,:LPSTR
_GetOpenDirectoryName proto :LPSTR
_StopDelFile proto :DWORD
_ProcessFile proto :DWORD,:DWORD
EnumINI proto :DWORD
_EnablePrivilege proto :DWORD,:DWORD
_ProcessDel proto :DWORD
include data.asm
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;打开目录对话框
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
GetOpenDirectoryName proc
pushad
invoke RtlZeroMemory,addr binfo,sizeof binfo
mov binfo.ulFlags,BIF_RETURNFSANCESTORS or BIF_RETURNONLYFSDIRS
invoke SHBrowseForFolder,addr binfo
invoke SHGetPathFromIDList,eax,addr szPath
popad
ret
GetOpenDirectoryName endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 处理找到的文件
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ProcessFile proc _lpszFile,_ServerKey
local @hFile,@dwFileSize,@hMapFile,@lpMemory
pushad
invoke CreateFile,_lpszFile,GENERIC_READ,\ ;打开找到的文件
FILE_SHARE_READ or FILE_SHARE_WRITE,NULL,\
OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,NULL
.if eax != INVALID_HANDLE_VALUE
mov @hFile,eax
invoke GetFileSize,eax,NULL
mov @dwFileSize,eax
.if eax
invoke CreateFileMapping,@hFile,\
NULL,PAGE_READONLY,0,0,NULL
.if eax
mov @hMapFile,eax
invoke MapViewOfFile,eax,\
FILE_MAP_READ,0,0,0
.if eax
mov @lpMemory,eax
invoke lstrlen,_ServerKey
dec eax
mov ecx, @dwFileSize ;保存文件长度
sub ecx,eax; 子字符串长度减 1
mov esi, @lpMemory ;保存共享句柄
inc eax
@@:
mov edi,_ServerKey;保存要检测的特征码
push ecx
push esi
mov ecx,eax ; 子字符串长度 不能超过40字节，否则出错
repe cmpsb ;这里对比，如果不符合，就继续
pop esi
pop ecx
je @f
inc esi
loop @b
@@:
.if ecx != 0 ;找到了特征码
;invoke SendDlgItemMessage,hWinMain,1006,LB_ADDSTRING,0,_lpszFile
invoke RtlZeroMemory,addr szLog,sizeof szLog
invoke wsprintf,addr szLog,addr szLogFile,_lpszFile,_ServerKey
invoke SendDlgItemMessage,hWinMain,IDC_List,LB_ADDSTRING,0,addr szLog
invoke lstrlen,_ServerKey
invoke RtlZeroMemory,_ServerKey,eax
popad
.endif
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;这里是共享映像的句柄结束
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
invoke UnmapViewOfFile,@lpMemory ;这里是读取共享映像的句柄结束
.endif
;********************************************************************
invoke CloseHandle,@hMapFile ;这里是打开共享映像的句柄结束
.endif
.endif
invoke CloseHandle,@hFile
.endif
mov eax , TRUE
ret
_ProcessFile endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
EnumINI proc _FileToEnum
local @szBuffer[1256]:byte
pushad
;********************************************************************
; 读取 Section 列表并循环处理
;********************************************************************
invoke GetPrivateProfileSectionNames,addr szBuffer1,\
sizeof szBuffer1,addr szProfileName
xor eax,eax
mov ebx,offset szBuffer1
.while byte ptr [ebx]
;********************************************************************
; 读取 Key 列表并循环显示
;********************************************************************
invoke GetPrivateProfileSection,ebx,addr szBuffer2,\
sizeof szBuffer2,addr szProfileName
invoke _ProcessFile,_FileToEnum,addr szBuffer2;根据枚举的特征码对找到的文件进行处理
invoke lstrlen,ebx
add ebx,eax
inc ebx
.endw
popad
ret
EnumINI endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_GetPosition proc
local @szBuffer[512]:byte
pushad
;********************************************************************
; 将当前路径和 ini 文件名组合起来
;********************************************************************
invoke GetCurrentDirectory,MAX_PATH,addr szProfileName
mov ebx,offset szProfileName
invoke lstrlen,ebx
mov ecx,offset szFileName
.if byte ptr [ebx+eax-1] == '\'
inc ecx
.endif
invoke lstrcat,ebx,ecx
;********************************************************************
; 读存放在 ini 文件中的数据
;********************************************************************
invoke GetPrivateProfileInt,addr szSecPos,\
0,50,addr szProfileName
push eax
invoke GetPrivateProfileInt,addr szSecPos,\
0,50,addr szProfileName
pop ecx
invoke SetWindowPos,hWinMain,HWND_TOP,ecx,eax,0,0,SWP_NOSIZE
popad
ret
_GetPosition endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_FindFile proc _lpszPath
local @stFindFile:WIN32_FIND_DATA
local @hFindFile
local @szPath[MAX_PATH]:byte ;用来存放“路径\”
local @szSearch[MAX_PATH]:byte ;用来存放“路径\*.*”
local @szFindFile[1025]:byte ;用来存放“路径\找到的文件”
local hWnd
pushad
invoke RtlZeroMemory,addr @szPath,sizeof @szPath
invoke RtlZeroMemory,addr @szSearch,sizeof @szSearch
invoke lstrcpy,addr @szPath,_lpszPath
;********************************************************************
; 在路径后面加上\*.*
;********************************************************************
@@:
invoke lstrlen,addr @szPath
lea esi,@szPath
add esi,eax
xor eax,eax
mov al,'\'
.if byte ptr [esi-1] != al
mov word ptr [esi],ax
.endif
invoke lstrcpy,addr @szSearch,addr @szPath
invoke lstrcat,addr @szSearch,addr szFilter
;********************************************************************
; 寻找文件
;********************************************************************
invoke FindFirstFile,addr @szSearch,addr @stFindFile
.if eax != INVALID_HANDLE_VALUE
mov @hFindFile,eax
.repeat
; invoke RtlZeroMemory,addr @szFindFile,sizeof @szFindFile
invoke SendMessage, hProgress, PBM_SETPOS,30, 0
invoke lstrcpy,addr @szFindFile,addr @szPath
invoke lstrcat,addr @szFindFile,addr @stFindFile.cFileName
.if @stFindFile.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY ;找到的是目录吗？
.if @stFindFile.cFileName != '.'
inc dwFolderCount
invoke _FindFile,addr @szFindFile ;如果找到的是目录，就递归继续找
.endif
.else
invoke SendMessage, hProgress, PBM_SETPOS,50, 0
invoke _GetPosition
invoke EnumINI,addr @szFindFile
invoke SendMessage, hProgress, PBM_SETPOS,70, 0
.endif
invoke FindNextFile,@hFindFile,addr @stFindFile
.until eax == FALSE
invoke FindClose,@hFindFile
.endif
popad
invoke SendMessage, hProgress, PBM_SETPOS,100, 0
ret
_FindFile endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ChenLook proc _FileLook
local stStartUp:STARTUPINFO
local stProcInfo:PROCESS_INFORMATION
invoke RtlZeroMemory,addr szLookFile,sizeof szLookFile
invoke lstrcat,addr szLookFile,addr szName
invoke lstrcat,addr szLookFile,_FileLook
invoke GetStartupInfo,addr stStartUp
invoke CreateProcess,NULL,addr szLookFile,NULL,NULL,NULL,\
NORMAL_PRIORITY_CLASS,NULL,NULL,addr stStartUp,addr stProcInfo
ret
_ChenLook endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_GetOpenDirectoryName proc _Path
pushad
invoke RtlZeroMemory,addr binfo,sizeof binfo
mov binfo.ulFlags,BIF_RETURNFSANCESTORS or BIF_RETURNONLYFSDIRS
invoke SHBrowseForFolder,addr binfo
invoke SHGetPathFromIDList,eax,_Path
popad
ret
_GetOpenDirectoryName endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;目录监视函数
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ChangeNotification proc _Windows,_FileNameFor,asm
invoke FindResource,NULL,asm,RT_RCDATA;查找ＡＳＭ资源
mov hRsrc,eax
invoke SizeofResource,NULL,hRsrc; 获取资源长度
mov dwSize,eax
invoke LoadResource,NULL,hRsrc;装载资源
mov hResData,eax
invoke GlobalAlloc,GPTR,dwSize;给数据分配内存
mov lpData,eax
invoke LockResource,hResData;锁定它
mov lpRes,eax
invoke CreateFile,_FileNameFor,GENERIC_WRITE,FILE_SHARE_READ,\
NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL ;打开文件
.if eax != NULL
mov hFile,eax
invoke WriteFile,hFile,lpRes,dwSize,addr dwSizeWritten,NULL;把二进制写进去
invoke CloseHandle,hRsrc
invoke CloseHandle,hResData
invoke CloseHandle,hFile
invoke GlobalFree,lpData
.endif
invoke CreateFile,_FileNameFor,GENERIC_READ or GENERIC_WRITE,\ ;打开它
FILE_SHARE_READ or FILE_SHARE_WRITE,NULL,OPEN_EXISTING, \
FILE_ATTRIBUTE_NORMAL,NULL
.if eax!=INVALID_HANDLE_VALUE
mov hFile, eax ;保存句柄
invoke CreateFileMapping,hFile,NULL,PAGE_READWRITE,0,0,NULL ;建立内存共享
.if eax!=NULL
mov hMapView,eax ;保存句柄
invoke MapViewOfFile,hMapView,FILE_MAP_WRITE,0,0,NULL ;读取内存共享
.if eax!=NULL
mov pMapView,eax ;保存句柄
xor edi,edi
mov edi,pMapView ;获取初始地址
add edi,00092eh
invoke lstrcpy,edi,_Windows;修改，等关闭句柄，系统自动保存
.endif
invoke UnmapViewOfFile,pMapView ;解除文件映射
.endif
invoke CloseHandle,hMapView ;关闭内存映射文件
.endif
invoke CloseHandle,hFile ;关闭文件
ret
_ChangeNotification endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_StopDelFile proc _DelFile
invoke RtlZeroMemory,addr stProcess,sizeof stProcess;清空内存
mov stProcess.dwSize,sizeof stProcess
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,addr stProcess
mov hSnapShot,eax
invoke Process32First,hSnapShot,addr stProcess
.while eax
invoke CompareString,LOCALE_USER_DEFAULT,NORM_IGNORECASE,_DelFile,-1,addr stProcess.szExeFile,-1
.if eax==2
push stProcess.th32ProcessID
pop Pid
.endif
invoke Process32Next,hSnapShot,addr stProcess
.endw
invoke OpenProcess,PROCESS_TERMINATE,FALSE,Pid
.if eax
mov ebx,eax
invoke TerminateProcess,ebx,-1
invoke CloseHandle,ebx
.endif
invoke Sleep,1000
invoke GetCurrentDirectory,200,addr szCurrent
invoke lstrcat,addr szCurrent1,addr szCurrent
invoke lstrcat,addr szCurrent1,addr szXie
invoke lstrcat,addr szCurrent1,addr szJ2
invoke DeleteFile,addr szCurrent1
ret
_StopDelFile endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_EnablePrivilege proc szPriv:DWORD, bFlags:DWORD
LOCAL hToken
LOCAL tkp : TOKEN_PRIVILEGES
invoke GetCurrentProcess ;GetCurrentProcess获得当前进程的HANDLE
mov edx, eax
invoke OpenProcessToken, edx, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, addr hToken ;获取进程访问令牌
invoke LookupPrivilegeValue, NULL,szPriv, addr tkp.Privileges.Luid;一个权限对应的LUID值
mov tkp.PrivilegeCount, 1
xor eax, eax
.if bFlags
mov eax, SE_PRIVILEGE_ENABLED
.endif
mov tkp.Privileges.Attributes, eax
invoke AdjustTokenPrivileges, hToken, FALSE, addr tkp, 0, 0, 0 ;对这个访问令牌进行修改
push eax
invoke CloseHandle, hToken
pop eax
ret
_EnablePrivilege endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_Process proc
invoke RtlZeroMemory,addr stProcess,sizeof stProcess;清空内存
invoke SendDlgItemMessage,hWinProce,IDC_22,LB_RESETCONTENT,0,0
mov stProcess.dwSize,sizeof stProcess
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,addr stProcess
mov hSnapShot,eax
invoke Process32First,hSnapShot,addr stProcess
.while eax
invoke SendDlgItemMessage,hWinProce,IDC_22,LB_ADDSTRING,0,addr stProcess.szExeFile
push stProcess.th32ProcessID
pop closepid
invoke Process32Next,hSnapShot,addr stProcess
.endw
ret
_Process endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ProcessDel proc _ProName
invoke RtlZeroMemory,addr stProcess,sizeof stProcess;清空内存
mov stProcess.dwSize,sizeof stProcess
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,addr stProcess
mov hSnapShot,eax
invoke Process32First,hSnapShot,addr stProcess
.while eax
invoke CompareString,LOCALE_USER_DEFAULT,NORM_IGNORECASE,_ProName,-1,addr stProcess.szExeFile,-1
.if eax==2
push stProcess.th32ProcessID
pop closepid
.endif
invoke Process32Next,hSnapShot,addr stProcess
.endw
invoke OpenProcess,PROCESS_TERMINATE,FALSE,closepid
.if eax
mov ebx,eax
invoke TerminateProcess,ebx,-1
.endif
ret
_ProcessDel endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ProcDlg proc uses ebx edi esi hWnd,wMsg,wParam,lParam
mov eax,wMsg
.if eax == WM_CLOSE
invoke EndDialog,hWnd,NULL
.elseif eax == WM_INITDIALOG
invoke LoadIcon,hInstance,ICO_MAIN
invoke SendMessage,hWnd,WM_SETICON,ICON_BIG,eax
.elseif eax == WM_COMMAND
mov eax,wParam
.if eax == IDC_15
invoke _GetOpenDirectoryName,addr szDirectory
invoke SetDlgItemText,hWnd,IDC_11,addr szDirectory
invoke GetDlgItemText,hWnd,IDC_11,addr szName1,MAX_PATH
.elseif eax == IDC_16
invoke _GetOpenDirectoryName,addr szDirectory1
invoke SetDlgItemText,hWnd,IDC_12,addr szDirectory1
invoke GetDlgItemText,hWnd,IDC_12,addr szName2,MAX_PATH
.elseif eax == IDC_17
invoke _GetOpenDirectoryName,addr szDirectory2
invoke SetDlgItemText,hWnd,IDC_13,addr szDirectory2
invoke GetDlgItemText,hWnd,IDC_13,addr szName3,MAX_PATH
.elseif eax == IDC_18
invoke _GetOpenDirectoryName,addr szDirectory3
invoke SetDlgItemText,hWnd,IDC_14,addr szDirectory3
invoke GetDlgItemText,hWnd,IDC_14,addr szName4,MAX_PATH
.elseif eax == IDC_19
invoke lstrlen,addr szName1
.if eax!=NULL
invoke _ChangeNotification,addr szName1,addr szJ2,ASM2
invoke ShellExecute,0,0,addr szJ2,0,0,SW_SHOW
.endif
invoke lstrlen,addr szName2
.if eax!=NULL
invoke _ChangeNotification,addr szName2,addr szJ3,ASM3
invoke ShellExecute,0,0,addr szJ3,0,0,SW_SHOW
.endif
invoke lstrlen,addr szName3
.if eax!=NULL
invoke _ChangeNotification,addr szName3,addr szJ4,ASM4
invoke ShellExecute,0,0,addr szJ4,0,0,SW_SHOW
.endif
invoke lstrlen,addr szName4
.if eax!=NULL
invoke _ChangeNotification,addr szName4,addr szJ5,ASM5
invoke ShellExecute,0,0,addr szJ5,0,0,SW_SHOW
.endif
.elseif eax == IDC_20
invoke _StopDelFile,addr szJ2
invoke _StopDelFile,addr szJ3
invoke _StopDelFile,addr szJ4
invoke _StopDelFile,addr szJ5
invoke MessageBox,NULL,addr stop,addr szti,MB_ICONINFORMATION
.endif
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret
_ProcDlg endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ProcLook proc uses ebx edi esi hWinMain1,wMsg,wParam,lParam
local @szBuffer[MAX_PATH]:BYTE
mov eax,wMsg
.if eax == WM_CLOSE
invoke EndDialog,hWinMain1,NULL
.elseif eax == WM_INITDIALOG
invoke LoadIcon,hInstance,ICO_MAIN
invoke SendMessage,hWinMain1,WM_SETICON,ICON_BIG,eax
invoke _EnablePrivilege,addr szSeDebugPrivilege,TRUE
.elseif eax == WM_COMMAND
mov eax,wParam
push hWinMain1
pop hWinProce
.if eax == IDC_23
invoke CreateThread,NULL,0,addr _Process,NULL,0,addr ThreadId2
.elseif eax == IDC_24
invoke GetDlgItemText,hWinMain1,IDC_25,addr szProcess,sizeof szProcess
invoke lstrlen,addr szProcess
.if eax==NULL
invoke MessageBox,hWinMain1,addr szError,NULL,MB_ICONSTOP
.elseif
invoke _ProcessDel,addr szProcess
.endif
.endif
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret
_ProcLook endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ProcDlgMain proc uses ebx edi esi hWnd,wMsg,wParam,lParam
local @dwTemp,@szBuffer[MAX_PATH]:BYTE
local @szBuffer1[128]:byte
local @szTextBuff[2048]:byte
local @stFindFile:WIN32_FIND_DATA
mov eax,wMsg
.if eax == WM_CLOSE
invoke EndDialog,hWnd,NULL
.elseif eax == WM_INITDIALOG
invoke LoadIcon,hInstance,ICO_MAIN
invoke SendMessage,hWnd,WM_SETICON,ICON_BIG,eax
invoke GetDlgItem, hWnd, IDC_PROGRESS
mov hProgress, eax
.elseif eax == WM_COMMAND
mov eax,wParam
push hWnd
pop hWinMain
.if eax == IDC_Look
invoke GetDlgItemText,hWnd,IDC_Directory,addr @szBuffer,MAX_PATH
call GetOpenDirectoryName
invoke SetDlgItemText,hWnd,IDC_Directory,addr szPath
.elseif eax == IDOK
invoke GetDlgItemText,hWnd,IDC_Directory,addr szPath,MAX_PATH
invoke lstrlen,addr szPath
.if eax == NULL
invoke MessageBox,NULL,addr szErorr1,NULL,MB_ICONSTOP
.elseif
invoke SendDlgItemMessage,hWnd,IDC_List,LB_RESETCONTENT,0,0
invoke CreateThread,NULL,0,addr _FindFile,addr szPath,0,addr ThreadId1
invoke SendMessage, hProgress, PBM_SETPOS,100, 0
.endif
;*****************************************************************
.elseif eax == IDC_Check
invoke GetDlgItemText,hWnd,IDC_KeYi,addr szFileLook,MAX_PATH
invoke FindFirstFile,addr szFileLook,addr @stFindFile
.if eax == INVALID_HANDLE_VALUE
invoke MessageBox,NULL,addr szErorr,NULL,MB_ICONSTOP
.elseif
invoke CreateThread,NULL,0,addr _ChenLook,addr szFileLook,0,addr ThreadId
.endif
.elseif eax == IDC_Del
invoke GetDlgItemText,hWnd,IDC_KeYi,addr szFileLook,MAX_PATH
invoke FindFirstFile,addr szFileLook,addr @stFindFile
.if eax == INVALID_HANDLE_VALUE
invoke MessageBox,NULL,addr szErorr,NULL,MB_ICONSTOP
.elseif
invoke DeleteFile,addr szFileLook
invoke MessageBox,hWnd,addr szChengGong,addr szti,MB_ICONINFORMATION
.endif
.elseif ax == IDC_List
shr eax,16
.if ax == LBN_SELCHANGE
;********************************************************************
; 将鼠标点击结果显示在文本框中
;********************************************************************
invoke SendMessage,lParam,LB_GETCURSEL,0,0
lea ecx,@szBuffer
invoke SendMessage,lParam,LB_GETTEXT,eax,ecx
invoke SetDlgItemText,hWnd,IDC_24,addr @szBuffer
.endif
.elseif eax == IDC_Out
invoke MessageBox,NULL,addr szabout,addr szSay,MB_ICONINFORMATION
.elseif eax == IDC_JianShi
invoke DialogBoxParam,hInstance,DLG_EDIT,NULL,offset _ProcDlg,NULL
.elseif eax == IDC_ShuoMing
invoke MessageBox,hWnd,addr Shuo,addr Ming,MB_ICONINFORMATION
.elseif eax == IDC_21
invoke DialogBoxParam,hInstance,DLG_LOOK,NULL,offset _ProcLook,NULL
.endif
;********************************************************************
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret
_ProcDlgMain endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
start:
invoke GetModuleHandle,NULL
mov hInstance,eax
invoke DialogBoxParam,hInstance,DLG_MAIN,NULL,offset _ProcDlgMain,NULL
invoke ExitProcess,NULL
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
end start
;**************************************************************************
用户可以自己在ini文件自己添加特征库，比如：
[29]
shellexecute
[30]
<%execute request
