[反取证] VB6文件覆写技术，二进制全0全1覆写（反取证技术）
由于Byte 0 的二进制是 0000 0000 ，而Byte 255 的二进制是 1111 1111 ，因此可以实现用字节进行文件二进制全0和全1填充，实现文件覆写的目的。进行35次的全0和全1填充，可有效的防范电子取证技术中的实验室数据恢复。
程序代码：Function Overwrite(FileName As String) '要覆写的文件
Dim x As Long, y As Long
Kill Left(FileName, InStrRev(FileName, "\")) & "0"
'二进制全0和全1覆写文件内容
For x = 1 To 35 '覆写35x2次
Dim sum As Long, n As Long, fxByte As Byte
n = 0
Open FileName For Binary Access Write As #1
For sum = 1 To FileLen(FileName)
n = n + 1
'MsgBox n '初始值为1
fxByte = 255
Put #1, n, fxByte '二进制全1覆写1 2 3 ....
Next sum
Close #1
n = 0
Open FileName For Binary Access Write As #1
For sum = 1 To FileLen(FileName)
n = n + 1
'MsgBox n '初始值为1
fxByte = 0
Put #1, n, fxByte '二进制全0覆写1 2 3 ....
Next sum
Close #1
DoEvents '释放系统控制权
Next
'覆写文件名
For y = 1 To 35 '覆写35x2次
If Dir(FileName) <> "" Then Name FileName As Left(FileName, InStrRev(FileName, "\")) & "0"
Name Left(FileName, InStrRev(FileName, "\")) & "0" As Left(FileName, InStrRev(FileName, "\")) & "1"
Name Left(FileName, InStrRev(FileName, "\")) & "1" As Left(FileName, InStrRev(FileName, "\")) & "0"
Next
Kill Left(FileName, InStrRev(FileName, "\")) & "0"
End Function
Private Sub Form_Load()
Me.Hide
Overwrite ("C:\Users\Admin\Desktop\1.php")
End Sub程序代码：Private Sub Form_Load() Dim x As Long, FileName As String FileName = "1.exe" '要覆写的文件 For x = 1 To 35 '覆写35x2次 Call qyfx(FileName) '二进制全1覆写 Call qlfx(FileName) '二进制全0覆写 DoEvents '释放系统控制权 Next MsgBox "任务完成！" End Sub Function qlfx(FileName) '二进制全0覆写1 2 3 .... Dim sum As Long, n As Long, fxByte As Byte n = 0 Open "1.exe" For Binary Access Write As #1 For sum = 1 To FileLen(FileName) n = n + 1 'MsgBox n '初始值为1 fxByte = 0 Put #1, n, fxByte '二进制全0覆写1 2 3 .... Next sum Close #1 End Function Function qyfx(FileName) '二进制全1覆写1 2 3 .... Dim sum As Long, n As Long, fxByte As Byte n = 0 Open "1.exe" For Binary Access Write As #1 For sum = 1 To FileLen(FileName) n = n + 1 'MsgBox n '初始值为1 fxByte = 255 Put #1, n, fxByte '二进制全1覆写1 2 3 .... Next sum Close #1 End Function
[此贴子已经被作者于2022-8-27 08:54编辑过]
