正文

自定義文件和所有文件的區(qū)別（自定義文件什么意思）

發(fā)布時間：2023-03-05 05:37:43 稿源：創(chuàng)意嶺閱讀： 350 問大家

大家好！今天讓創(chuàng)意嶺的小編來大家介紹下關(guān)于自定義文件和所有文件的區(qū)別的問題，以下是小編對此問題的歸納整理，讓我們一起來看看吧。

創(chuàng)意嶺作為行業(yè)內(nèi)優(yōu)秀的企業(yè)，服務(wù)客戶遍布全球各地，相關(guān)業(yè)務(wù)請撥打電話：175-8598-2043，或添加微信：1454722008

本文目錄:

1、右鍵中出現(xiàn)了一個自定義文件夾，而且只有在一個打開的文件夾里面有，其他時候就沒有高分求解?。。。?！
2、關(guān)于自定義文件格式(VB)
3、金山毒霸自定義殺毒和普通的有何區(qū)別
4、WORD中保存和另存為的區(qū)別

自定義文件和所有文件的區(qū)別（自定義文件什么意思）

一、右鍵中出現(xiàn)了一個自定義文件夾，而且只有在一個打開的文件夾里面有，其他時候就沒有高分求解?。。。?！

無須擔(dān)心，不是電腦出問題。

這確實是系統(tǒng)自帶的功能，可以對文件夾進(jìn)行自定義，包括文件夾類型，更換文件夾圖標(biāo)等。

至于有時候有，有時候沒有是，因為你所處的文件夾不同，有的文件夾允許自定義，有的不允許。

比如說你進(jìn)C盤的Windows文件夾中點擊右鍵，就一定沒有“自定義”；但是你自己在桌面上新建一個文件夾，點擊打開后在右鍵單擊，就會有“自定義”這個選項。

二、關(guān)于自定義文件格式(VB)

Attribute VB_Name = "Module1"

Public Const PROCESS_VM_READ = &H10

Public Const TH32CS_SNAPPROCESS = &H2

Public Const MEM_COMMIT = 4096

Public Const PAGE_READWRITE = 4

Public Const PROCESS_CREATE_THREAD = (&H2)

Public Const PROCESS_VM_OPERATION = (&H8)

Public Const PROCESS_VM_WRITE = (&H20)

Public Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Long, ByVal lpBuffer As String, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long

Public Declare Function GetLastError Lib "kernel32" () As Long

Public Declare Function VirtualAllocEx Lib "kernel32" (ByVal hProcess As Long, ByVal lpAddress As Long, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As Long

Public Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Long, ByVal lpBuffer As String, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long

Public Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long

Public Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long

Public Declare Function Process32First Lib "kernel32" (ByVal hSnapshot As Long, lppe As PROCESSENTRY32) As Long

Public Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal dwFlags As Long, ByVal th42ProcessID As Long) As Long

Public Declare Function CreateRemoteThread Lib "kernel32" (ByVal hProcess As Long, ByVal lpThreadAttributes As Long, ByVal dwStackSize As Long, ByVal lpStartAddress As Long, ByVal lpParameter As Long, ByVal dwCreationFlags As Long, lpThreadId As Long) As Long

Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long

Public Declare Function Process32Next Lib "kernel32" (ByVal hSapshot As Long, lppe As PROCESSENTRY32) As Long

Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

Public Type PROCESSENTRY32

dwSize As Long

cntUseage As Long

th42ProcessID As Long

th42DefaultHeapID As Long

th42ModuleID As Long

cntThreads As Long

th42ParentProcessID As Long

pcPriClassBase As Long

swFlags As Long

szExeFile As String * 1024

End Type

Public Sub EnumAndInject()

Dim MySnapHandle As Long

Dim ProcessInfo As PROCESSENTRY32

Dim MyRemoteProcessId As Long

Dim MyDllFileLength As Long

Dim MyDllFileBuffer As Long

Dim MyReturn As Long

Dim MyStartAddr As Long

Dim MyResult As Long

Dim temp As Long

Dim DllFileName As String

MySnapHandle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)

ProcessInfo.dwSize = Len(ProcessInfo)

If Process32First(MySnapHandle, ProcessInfo) <> 0 Then

Debug.Print ProcessInfo.szExeFile

If InStr(LCase(ProcessInfo.szExeFile), "notepad.exe") > 0 Then

'遍歷進(jìn)程,查找notepad.exe

MyRemoteProcessId = OpenProcess(PROCESS_CREATE_THREAD + PROCESS_VM_OPERATION + PROCESS_VM_WRITE + PROCESS_VM_READ, False, ProcessInfo.th42ProcessID)

'打開進(jìn)程獲得notepad的句柄供后面的操作使用

'DllFileName = "C:\Program Files\Microsoft Visual Studio\VB98\DATAVIEW.DLL"

MyDllFileLength = Len(DllFileName) + 1

'學(xué)過C語言的朋友應(yīng)該知道字符串最后要一個ASCII 0標(biāo)志結(jié)尾，所以要加1

MyDllFileBuffer = VirtualAllocEx(MyRemoteProcessId, 0, MyDllFileLength, MEM_COMMIT, PAGE_READWRITE)

'在指定進(jìn)程里申請一塊內(nèi)存區(qū)域出來供我們存放字符串“c：\test.dll“

'傳string給api時，byval byref有區(qū)別，應(yīng)該使用byval，這樣會傳給api一個標(biāo)準(zhǔn)的C字符指針，不能byref，否則函數(shù)調(diào)用沒問題

'但是起不到預(yù)期效果,VirtualAllocEx返回的是申請到的內(nèi)存地址值.

MyReturn = WriteProcessMemory(MyRemoteProcessId, MyDllFileBuffer, DllFileName, MyDllFileLength, temp)

'向剛才申請的內(nèi)存中寫入dll文件路徑字符串

'順便說一下，很多api瀏覽器上的api聲明都是錯的，包括VB6自帶的也不例外，writeprocessmemory第二個參數(shù)要的是

'lpBaseAddress 但是這個值不能傳址得到,如果你按byref傳址,實際上傳的是MyDllFileBuffer變量的地址,而不是它里面存放的那個數(shù)字

'上面說了MyDllFileBuffer的數(shù)值才是WriteProcessMemory要的地址,所以聲明API的時候一定要byval,大家知道空著不寫就是默認(rèn)byref

'下面還有幾處不該傳址的參數(shù),只要搞清楚API函數(shù)要的到底是什么值才可以確定到底傳值還是傳址,API瀏覽器僅能供參考,還是要仔細(xì)閱讀MSDN

MyStartAddr = GetProcAddress(GetModuleHandle("Kernel32"), "LoadLibraryA")

'獲取loadlibrary函數(shù)的地址,這個函數(shù)可以載入指定的dll文件,那他的參數(shù)呢?就是我們剛才在notepad.exe進(jìn)程里寫入的“c：\test.dll“

'不過還得讓CreateRemoteThread告訴他.另外簡單的說一下windows下應(yīng)用程序的內(nèi)存管理,我也不很懂,呵呵,win32下的應(yīng)用程序

'的內(nèi)存區(qū)域是隔開的,每個程序有自己的一塊內(nèi)存不能直接訪問別的程序的內(nèi)存區(qū),當(dāng)然,這里調(diào)用的幾個系統(tǒng)函數(shù)有訪問別的程序內(nèi)存區(qū)域的特權(quán)

'而且每個應(yīng)用程序的內(nèi)存區(qū)域都映射到系統(tǒng)內(nèi)存區(qū)域里,也就是說在這里GetProcAddress得到的VB程序里L(fēng)oadLibraryA函數(shù)的入口地址和

'notepad程序里的LoadLibraryA函數(shù)地址是一致的(映射的作用),所以不必?fù)?dān)心.另外在VB寫的程序里

'要使用LoadLibraryA,notepad不是用vc寫的嗎?要注意根notepad沒關(guān)系,我們現(xiàn)在是在自己的VB程序里面找LoadLibraryA函數(shù)的入口.

'還有要注意函數(shù)大小寫，api函數(shù)和vb不一樣的。

MyResult = CreateRemoteThread(MyRemoteProcessId, 0, 0, MyStartAddr, MyDllFileBuffer, 0, temp)

'好了,現(xiàn)在該讓LoadLibrary載入“c：\test.dll“吧，現(xiàn)在CreateRemoteThread做的就是在notepad進(jìn)程中把控制權(quán)轉(zhuǎn)到LoadLibraryA的入口

'然后把notepad內(nèi)存區(qū)域中的“c：\test.dll“字符串當(dāng)作參數(shù)傳給LoadLibraryA。現(xiàn)在我們的dll文件就在notepad程序中運行了

'dll被注入notepad.exe以后會主動彈出對話框顯示出notepad.exe的進(jìn)程ID,表明注入成功.

End If

Loop While Process32Next(MySnapHandle, ProcessInfo) <> 0

End If

CloseHandle MySnapHandle

End Sub

Private Sub Form_Load()

EnumAndInject