注册 登录
编程论坛 汇编论坛

文件隐藏器 最新版(win32汇编)

zklhp 发布于 2009-07-20 20:14, 23598 次点击
更新了一下 就是用了非虫老大发的皮肤程序 果然效果好 呵呵

只有本站会员才能查看附件,请 登录
50 回复
#2
zklhp2009-07-20 20:15
利用SHChangeNotify欺骗Shell实现文件的隐藏 用到的知识点就是SHChangeNotify的用法

这个的函数的用法网上还真找不到什么好资料 帖一下MSDN上的罢

SHChangeNotify Function
Notifies the system of an event that an application has performed. An application should use this function if it performs an action that may affect the Shell.

Syntax


void SHChangeNotify(          LONG wEventId,
    UINT uFlags,
    LPCVOID dwItem1,
    LPCVOID dwItem2
);Parameters

wEventId
Describes the event that has occurred. Typically, only one event is specified at a time. If more than one event is specified, the values contained in the dwItem1 and dwItem2 parameters must be the same, respectively, for all specified events. This parameter can be one or more of the following values:

SHCNE_ALLEVENTS
All events have occurred.
SHCNE_ASSOCCHANGED
A file type association has changed. SHCNF_IDLIST must be specified in the uFlags parameter. dwItem1 and dwItem2 are not used and must be NULL.
SHCNE_ATTRIBUTES
The attributes of an item or folder have changed. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the item or folder that has changed. dwItem2 is not used and should be NULL.
SHCNE_CREATE
A nonfolder item has been created. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the item that was created. dwItem2 is not used and should be NULL.
SHCNE_DELETE
A nonfolder item has been deleted. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the item that was deleted. dwItem2 is not used and should be NULL.
SHCNE_DRIVEADD
A drive has been added. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the root of the drive that was added. dwItem2 is not used and should be NULL.
SHCNE_DRIVEADDGUI
A drive has been added and the Shell should create a new window for the drive. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the root of the drive that was added. dwItem2 is not used and should be NULL.
SHCNE_DRIVEREMOVED
A drive has been removed. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the root of the drive that was removed. dwItem2 is not used and should be NULL.
SHCNE_EXTENDED_EVENT
Not currently used.
SHCNE_FREESPACE
The amount of free space on a drive has changed. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the root of the drive on which the free space changed. dwItem2 is not used and should be NULL.
SHCNE_MEDIAINSERTED
Storage media has been inserted into a drive. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the root of the drive that contains the new media. dwItem2 is not used and should be NULL.
SHCNE_MEDIAREMOVED
Storage media has been removed from a drive. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the root of the drive from which the media was removed. dwItem2 is not used and should be NULL.
SHCNE_MKDIR
A folder has been created. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the folder that was created. dwItem2 is not used and should be NULL.
SHCNE_NETSHARE
A folder on the local computer is being shared via the network. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the folder that is being shared. dwItem2 is not used and should be NULL.
SHCNE_NETUNSHARE
A folder on the local computer is no longer being shared via the network. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the folder that is no longer being shared. dwItem2 is not used and should be NULL.
SHCNE_RENAMEFOLDER
The name of a folder has changed. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the previous pointer to an item identifier list (PIDL) or name of the folder. dwItem2 contains the new PIDL or name of the folder.
SHCNE_RENAMEITEM
The name of a nonfolder item has changed. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the previous PIDL or name of the item. dwItem2 contains the new PIDL or name of the item.
SHCNE_RMDIR
A folder has been removed. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the folder that was removed. dwItem2 is not used and should be NULL.
SHCNE_SERVERDISCONNECT
The computer has disconnected from a server. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the server from which the computer was disconnected. dwItem2 is not used and should be NULL.
SHCNE_UPDATEDIR
The contents of an existing folder have changed, but the folder still exists and has not been renamed. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the folder that has changed. dwItem2 is not used and should be NULL. If a folder has been created, deleted, or renamed, use SHCNE_MKDIR, SHCNE_RMDIR, or SHCNE_RENAMEFOLDER, respectively.
SHCNE_UPDATEIMAGE
An image in the system image list has changed. SHCNF_DWORD must be specified in uFlags.
Windows NT/2000/XP: dwItem2 contains the index in the system image list that has changed. dwItem1 is not used and should be NULL.

Windows 95/98: dwItem1 contains the index in the system image list that has changed. dwItem2 is not used and should be NULL.

SHCNE_UPDATEITEM
An existing item (a folder or a nonfolder) has changed, but the item still exists and has not been renamed. SHCNF_IDLIST or SHCNF_PATH must be specified in uFlags. dwItem1 contains the item that has changed. dwItem2 is not used and should be NULL. If a nonfolder item has been created, deleted, or renamed, use SHCNE_CREATE, SHCNE_DELETE, or SHCNE_RENAMEITEM, respectively, instead.
SHCNE_DISKEVENTS
Specifies a combination of all of the disk event identifiers.
SHCNE_GLOBALEVENTS
Specifies a combination of all of the global event identifiers.
SHCNE_INTERRUPT
The specified event occurred as a result of a system interrupt. As this value modifies other event values, it cannot be used alone.
uFlags
Flags that, when combined bitwise with SHCNF_TYPE, indicate the meaning of the dwItem1 and dwItem2 parameters. The uFlags parameter must be one of the following values.
SHCNF_DWORD
The dwItem1 and dwItem2 parameters are DWORD values.
SHCNF_IDLIST
dwItem1 and dwItem2 are the addresses of ITEMIDLIST structures that represent the item(s) affected by the change. Each ITEMIDLIST must be relative to the desktop folder.
SHCNF_PATH
dwItem1 and dwItem2 are the addresses of null-terminated strings of maximum length MAX_PATH that contain the full path names of the items affected by the change.
SHCNF_PRINTER
dwItem1 and dwItem2 are the addresses of null-terminated strings that represent the friendly names of the printer(s) affected by the change.
SHCNF_FLUSH
The function should not return until the notification has been delivered to all affected components. As this flag modifies other data-type flags, it cannot by used by itself.
SHCNF_FLUSHNOWAIT
The function should begin delivering notifications to all affected components but should return as soon as the notification process has begun. As this flag modifies other data-type flags, it cannot by used by itself. This flag includes SHCNF_FLUSH.
SHCNF_NOTIFYRECURSIVE
Notify clients registered for all children.
dwItem1
[in] Optional. First event-dependent value.
dwItem2
[in] Optional. Second event-dependent value.
Return Value

No return value.

Remarks

Applications that register new handlers of any type must call SHChangeNotify with the SHCNE_ASSOCCHANGED flag to instruct the Shell to invalidate the cache and search for new handlers.

Windows 95/98/Me: SHChangeNotify is supported by the Microsoft Layer for Unicode (MSLU). To use MSLU, you must add certain files to your application, as outlined in Microsoft Layer for Unicode on Windows Me/98/95 Systems.

Function Information

Minimum DLL Version shell32.dll version 4.0 or later
Custom Implementation No
Header shlobj.h
Import library shell32.lib
Minimum operating systems Windows NT 4.0, Windows 95

又改了一下 用了那个USkin 果然不错~ 谢谢非虫老大分享

本程序允许转载 但请保留作者版权信息!!!!!!!

                                    by zklhp
                                    2009.7.20
#3
zklhp2009-07-20 20:16
自己看罢 图传不上去~~

这机子有问题啊 怎么画图保存的文件论坛说不对啊~
#4
学技术的2009-07-20 20:20
我个界面太酷了...
我想知道那个 树 的滚动条是怎么重绘的..
#5
静夜思2009-07-20 20:21
如果是位图转换成jpg或gif格式试试,或者把图片以附件的形式发到我的邮箱,邮箱我以用短信发送给你
#6
zklhp2009-07-20 20:24
以下是引用静夜思在2009-7-20 20:21的发言:

如果是位图转换成jpg或gif格式试试,或者把图片以附件的形式发到我的邮箱,邮箱我以用短信发送给你



就是着两个 png也试了 不行~
#7
zklhp2009-07-20 20:26
以下是引用静夜思在2009-7-20 20:21的发言:

如果是位图转换成jpg或gif格式试试,或者把图片以附件的形式发到我的邮箱,邮箱我以用短信发送给你


谢谢老大关心啊~
#8
zklhp2009-07-21 13:17
只有本站会员才能查看附件,请 登录


上次是电脑的问题 传不上图~
#9
春色三分2009-07-24 13:56
疑问???只能够隐藏,不能够取消隐藏吗?那样被隐藏的文件岂不是拿不出来啦?
#10
zklhp2009-07-24 16:06
以下是引用春色三分在2009-7-24 13:56的发言:

疑问???只能够隐藏,不能够取消隐藏吗?那样被隐藏的文件岂不是拿不出来啦?


退出就是了~~

这个问题提的好 没想到啊 谢谢您批评~
#11
春色三分2009-07-24 17:42
貌似退出也不行,还有就是,一个很有趣的现象:我把一个放在桌面的文件隐藏,然后在刷新的一瞬间,会看到原来隐藏的文件。
#12
zklhp2009-07-24 19:33
以下是引用春色三分在2009-7-24 17:42的发言:

貌似退出也不行,还有就是,一个很有趣的现象:我把一个放在桌面的文件隐藏,然后在刷新的一瞬间,会看到原来隐藏的文件。


退出了肯定就不隐藏了

这个只是欺骗shell 一刷新当然又有了 呵呵
#13
xiaosaner32009-09-30 18:13
只是欺骗shell,那也不实用啊.嘿嘿
#14
韦春敢2010-01-29 05:15
牛B不吃草!!!!
#15
bluecer2010-02-28 22:13
欺骗shell啊,貌似很深奥。学习学习....
#16
bluecer2010-02-28 22:21
SHChangeNotify是系统函数啊,长见识了。
#17
ltyjyufo2010-04-04 22:12
   都是高手。。。。
#18
lijinbo2010-04-07 15:51
xie xie
#19
诗空2010-05-05 23:03
还是不太明白,怎么取消隐藏呢?
#20
aixiouli2010-09-04 01:11
好复杂。不会英文
#21
死神之蝶·2010-10-25 14:40
lz把会变的源码亮出来呀
#22
clefnote2011-02-27 21:29
不错值得学习。
#23
jptiancai2011-08-15 20:49
试了试,效果不错
  楼上说怎么取消隐藏,点window键+s即可现实主窗口
     另外点帮助也可以
#24
ren9701222011-09-04 09:34
非虫出品,必属精品。
#25
终落月冷2011-11-22 23:11
看看,不懂
#26
QUESTION7892012-02-05 16:27
做的不错
#27
admin_xyz2012-06-30 13:23
哈哈,设500ms的话刷新后能快速打开的。。。。。笑晕.....
#28
热情小青年2012-06-30 16:40
我是新手,看不明白啊?怎么用啊?
#29
yuma2012-07-16 19:28
以下是引用zklhp在2009-7-20 20:14:04的发言:

更新了一下 就是用了非虫老大发的皮肤程序 果然效果好 呵呵
 


程序有bug:
1。程序通过定时给文件添加隐藏、系统 属性 来实现文件的隐藏。
2。在被隐藏文件的目录下复制文件时,文件会显示出来。
3。运行批处理结束后,文件会显示出来。


该软件克星是:
批处理:
:do
echo 正在清除所有属性中……
attrib -r  -a -s -h /s /d
goto do

运行该处理时,不断按F5刷新,被隐藏文件无处藏身。
#30
zklhp2012-07-16 19:50
上面也说了 本来就是欺骗 障眼法而已 肯定有办法现行啦

多谢批评
#31
zklhp2012-07-16 19:57
程序的原理是Shell欺骗 所以 只要是进行刷新操作的 都能让文件出来

本来就是个demo 演示一下一种文件隐藏的方法而已
#32
yuma2012-07-16 20:08
以下这个程序可以 定时清除当前目录所有的属性,并不停的刷新。

简直是你那个程序的克星啊。

自己写了个VBS。
只有本站会员才能查看附件,请 登录
#33
zklhp2012-07-16 20:10
程序代码:


    var fso, fldr, folder;
    fso = new ActiveXObject("Scripting.FileSystemObject");
    var WshShell=new ActiveXObject("WScript.Shell");
    var answer=WshShell.popup("是不是将本目录中的所有文件夹的属性设为普通",100,"请选择",4);
    if (answer==7)
    {
        WScript.Echo("谢谢您的使用\r\nBy zklhp    Email:zklhp@ QQ:493165744");
        WScript.Quit(0);
    }

    folder = fso.GetFolder(WshShell.CurrentDirectory);
    fc = new Enumerator(folder.SubFolders);
    for (; !fc.atEnd(); fc.moveNext())
    {
        folder = fso.GetFolder(fc.item());
        folder.Attributes = 32;
    }

    WScript.Echo("运行成功 谢谢您的使用\r\nBy zklhp    Email:zklhp@ QQ:493165744");



我还写过这种东西呢 这玩意一抓一大把
#34
yuma2012-07-16 20:16
清除所有属性很容易,看下面这个BAT:
程序代码:
@echo off
echo --------------------------------------------------------------------
@echo.      
echo          警告:本批处理将清除当前目录文件和文件夹的所有属性
echo.
echo --------------------------------------------------------------------
@echo.
echo 1.是否清除?如果不,请手动关闭该批处理。如果是:
pause
@echo.
echo 正在清除所有属性中……
attrib -r  -a -s -h /s /d
@echo.
echo 清除属性成功!
echo --------------------------------------------------------------------
echo 2.添加RECYCLER文件夹系统隐藏属性?如果不,请手动关闭该批处理。如果是:
pause
attrib +s +h RECYCLER
@echo.
echo 给RECYCLER添加属性成功!
@echo.
pause

#35
yuma2012-07-16 20:18
请你选择要隐藏哪个文件
BAT:
程序代码:
@ECHO off
:start
cls
color 0A
echo 注:此程序对0字节文件无效!
echo.
set /p file=请输入需要深度隐藏文件按回车键(q=退出):
if "%file%"=="q" exit
if not exist "%file%" goto  start
attrib +R +A +S +H %file%


 
#36
yuma2012-07-16 20:54
以下是引用zklhp在2012-7-16 20:10:51的发言:

 
 
    var fso, fldr, folder;
    fso = new ActiveXObject("Scripting.FileSystemObject");
    var WshShell=new ActiveXObject("WScript.Shell");
    var answer=WshShell.popup("是不是将本目录中的所有文件夹的属性设为普通",100,"请选择",4);
    if (answer==7)
    {
        WScript.Echo("谢谢您的使用\r\nBy zklhp    Email:zklhp@    QQ:493165744");
        WScript.Quit(0);
    }
 
    folder = fso.GetFolder(WshShell.CurrentDirectory);
    fc = new Enumerator(folder.SubFolders);
    for (; !fc.atEnd(); fc.moveNext())
    {
        folder = fso.GetFolder(fc.item());
        folder.Attributes = 32;
    }
 
    WScript.Echo("运行成功 谢谢您的使用\r\nBy zklhp    Email:zklhp@    QQ:493165744");
 


我还写过这种东西呢 这玩意一抓一大把

该VBS存在语法错误,运行失败。
#37
水哥2012-08-11 19:33
楼主的程序三个知识点 1:热键  2:定时器 3:SHChangeNotify的应用
#38
zklhp2012-08-11 19:55
以下是引用yuma在2012-7-16 20:54:01的发言:


该VBS存在语法错误,运行失败。

这不是vbs当然会运行失败了 这是jscript
#39
shengzhidao2012-12-01 23:35
谢谢谢谢谢谢
#40
小菜B2013-03-12 15:23
很有趣的软件啊!赞一个
#41
dreamfuture2013-06-05 16:18
好吧LZ你赢了。。。
#42
hjxlj2014-02-14 22:51
这个想不顶都难啊
#43
fyyizu2014-02-26 13:01
09-14 有43楼
#44
AVCORP2014-03-18 19:13
新手刚来。感觉这里大牛好多啊。刚学汇编,看不懂啊。
#45
鸥翔鱼游2014-04-19 16:42
#46
鸥翔鱼游2014-04-19 16:44
还有我想请问一下 升级是怎么样升级的 现在是新手上路 怎么样能升级到下一个等级呢
#47
ch13005049682014-05-05 22:23
回复 2 楼 zklhp
这是什么???
#48
蚯蚓翔龙2015-04-10 20:22
不错,很新奇,学习下
#49
随风的飞叶2015-10-09 10:59
现在分数为0了,怎么弄专家分啊。
#50
随风的飞叶2015-10-09 11:03
原来可用分和专家分是不同的。
#51
Alar302016-02-02 14:47
嘿嘿
谢谢了哈
1