type fr_jmp = packed record PuhsOp: byte; PushArg: pointer; RetOp: byte; end;
OldCode = packed record One: dword; two: word; end;
var AdrCreateProcessA: pointer; OldCrp: OldCode; JmpCrProcA: fr_jmp;
Function OpenThread(dwDesiredAccess: dword; bInheritHandle: bool; dwThreadId: dword):dword; stdcall; external 'kernel32.dll';
Procedure StopThreads; var h, CurrTh, ThrHandle, CurrPr: dword; Thread: TThreadEntry32; begin CurrTh := GetCurrentThreadId; CurrPr := GetCurrentProcessId; h := CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); if h <> INVALID_HANDLE_VALUE then begin Thread.dwSize := SizeOf(TThreadEntry32); if Thread32First(h, Thread) then repeat if (Thread.th32ThreadID <> CurrTh) and (Thread.th32OwnerProcessID = CurrPr) then begin ThrHandle := OpenThread(THREAD_SUSPEND_RESUME, false, Thread.th32ThreadID); if ThrHandle>0 then begin SuspendThread(ThrHandle); CloseHandle(ThrHandle); end; end; until not Thread32Next(h, Thread); CloseHandle(h); end; end;
Procedure RunThreads; var h, CurrTh, ThrHandle, CurrPr: dword; Thread: TThreadEntry32; begin CurrTh := GetCurrentThreadId; CurrPr := GetCurrentProcessId; h := CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); if h <> INVALID_HANDLE_VALUE then begin Thread.dwSize := SizeOf(TThreadEntry32); if Thread32First(h, Thread) then repeat if (Thread.th32ThreadID <> CurrTh) and (Thread.th32OwnerProcessID = CurrPr) then begin ThrHandle := OpenThread(THREAD_SUSPEND_RESUME, false, Thread.th32ThreadID); if ThrHandle>0 then begin ResumeThread(ThrHandle); CloseHandle(ThrHandle); end; end; until not Thread32Next(h, Thread); CloseHandle(h); end; end;
function TrueCreateProcessA(lpApplicationName: PChar; lpCommandLine: PChar; lpProcessAttributes, lpThreadAttributes: PSecurityAttributes; bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer; lpCurrentDirectory: PChar; const l pStartupInfo: TStartupInfo; var lpProcessInformation: TProcessInformation): BOOL; begin //снятие перехвата WriteProcessMemory(CurrProc, AdrCreateProcessA, @OldCrp, SizeOf(OldCode), Writen); //вызов функции result := CreateProcess(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags or CREATE_SUSPENDED, lpEnvironment, nil, lpStartupInfo, lpProcessInformation); //установка перехвата WriteProcessMemory(CurrProc, AdrCreateProcessA, @JmpCrProcA, SizeOf(far_jmp), Writen); end;
function NewCreateProcessA(lpApplicationName: PChar; lpCommandLine: PChar; lpProcessAttributes, lpThreadAttributes: PSecurityAttributes; bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer; lpCurrentDirectory: PChar; const lpStartupInfo: TStartupInfo; var lpProcessInformation: TProcessInformation): BOOL; stdcall; begin /////////////////////////////////////// ///обработчик CreateProcessA/// ////////////////////////////////////// end;
Procedure SetHook; var HKernel32, HUser32: dword; begin CurrProc := GetCurrentProcess; //получение адреса CreateProcessA AdrCreateProcessA := GetProcAddress(GetModuleHandle(’kernel32.dll’), ’CreateProcessA’); //инициализация структуры перехвата CreateProcessA JmpCrProcA.PuhsOp := $68; JmpCrProcA.PushArg := @NewCreateProcessA; JmpCrProcA.RetOp := $C3; //сохраняем старое начало функции ReadProcessMemory(CurrProc, AdrCreateProcessA, @OldCrp, SizeOf(OldCode), bw); //записываем новое начало CreateProcessA WriteProcessMemory(CurrProc, AdrCreateProcessA, @JmpCrProcA, SizeOf(far_jmp), Writen); end;
begin //останавливаем побочные нити StopThreads; //устанавливаем перехват SetHook; //запускаем нити RunThreads; end.
