- 01
- 02
- 03
- 04
- 05
- 06
- 07
- 08
- 09
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
library ch;
uses
Windows,SysUtils,controls,graphics,extctrls,shellapi,Unit1 in 'Unit1.pas' {Form1};
type
NTStatus = cardinal;
far_jmp = packed record
push: byte;
PProc: pointer;
ret: byte;
end;
OldCode = packed record
one: dword;
two: dword;
end;
const
STATUS_ACCESS_DENIED = NTStatus($C0000022);
STATUS_SUCCESS = NTStatus($00000000);
function CreateProcessW(lpApplicationName: PWideChar; lpCommandLine: PWideChar;
lpProcessAttributes, lpThreadAttributes: PSecurityAttributes;
bInheritHandles: BOOL; dwCreationFlags: dword; lpEnvironment: pointer;
lpCurrentDirectory: PWideChar; const lpStartupInfo: TStartupInfo;
var lpProcessInformation: TProcessInformation): BOOL; stdcall;
external 'kernel32.dll' name 'CreateProcessW';
var
CPA: pointer;
OldCPA: OldCode;
JmpCPA: far_jmp;
b:cardinal;
procedure UnHook;
begin
WriteProcessMemory(INVALID_HANDLE_VALUE, CPA, @OldCPA, sizeof(OldCode), b);
end;
function FalseCreateProcessW():boolean;
begin
SetLastError(ERROR_ACCESS_DENIED);
result:=falsecreateprocessw
end;
function TrueCreateProcessW(lpApplicationName: PWideChar;
lpCommandLine: PWideChar; lpProcessAttributes, lpThreadAttributes
: PSecurityAttributes; bInheritHandles: BOOL; dwCreationFlags: dword;
lpEnvironment: pointer; lpCurrentDirectory: PWideChar;
const lpStartupInfo: TStartupInfo;
var lpProcessInformation: TProcessInformation): BOOL; stdcall;
begin
WriteProcessMemory(INVALID_HANDLE_VALUE, CPA, @OldCPA, sizeof(OldCode), b);
Result := CreateProcessW(lpApplicationName, lpCommandLine,
lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags,
lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
WriteProcessMemory(INVALID_HANDLE_VALUE, CPA, @JmpCPA, sizeof(far_jmp), b);
end;
function NewCreateProcessW(lpApplicationName: PWideChar;
lpCommandLine: PWideChar; lpProcessAttributes, lpThreadAttributes
: PSecurityAttributes; bInheritHandles: BOOL; dwCreationFlags: dword;
lpEnvironment: pointer; lpCurrentDirectory: PWideChar;
const lpStartupInfo: TStartupInfo;
var lpProcessInformation: TProcessInformation): bool; stdcall;
var
reason:string;
begin
result:=true;// подавляем ошибку "Доступ запрещен"
// если что-то нам не понравилось, выходм
else
// или выполняем командную строку
Result := TrueCreateProcessW(lpApplicationName, lpCommandLine,
lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags,
lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
end;
procedure SetHook;
begin
CPA := GetProcAddress(getmodulehandle('kernel32.dll'), 'CreateProcessW');
ReadProcessMemory(INVALID_HANDLE_VALUE, CPA, @OldCPA, sizeof(OldCode), b);
JmpCPA.push := $68;
JmpCPA.PProc := @NewCreateProcessW;
JmpCPA.ret := $C3;
WriteProcessMemory(INVALID_HANDLE_VALUE, CPA, @JmpCPA, sizeof(far_jmp), b);
end;
function MessageProc(code: integer; wParam: word; lParam: longint)
: longint; stdcall;
begin
Result := CallNextHookEx(0, code, wParam, lParam);
end;
procedure SetGlobalHookProc();
begin
SetWindowsHookEx(WH_GETMESSAGE, @MessageProc, HInstance, 0);
sleep(infinite);
end;
procedure SetGlobalHook();
var
//hMutex: dword;
TrId: dword;
begin
CreateMutex(nil, False, 'Vhook@016');
if GetLastError = 0 then
CreateThread(nil, 0, @SetGlobalHookProc, nil, 0, trid)
end;