进程隐藏的Delphi代码(操作 PhysicalMemory

最新推荐文章于 2023-02-19 13:45:43 发布

iiprogram

最新推荐文章于 2023-02-19 13:45:43 发布

阅读量2.2k

点赞数

分类专栏： windows底层核心編程文章标签： delphi attributes function destructor object string

本文链接：https://blog.csdn.net/iiprogram/article/details/626328

版权

这是一个Delphi代码示例，展示了如何隐藏进程。通过加载ntdll.dll库，使用RtlInitUnicodeString和ZwOpenSection等函数，实现对PhysicalMemory的访问，从而在Windows 98和2000系统中隐藏进程。

摘要由CSDN通过智能技术生成

进程隐藏的Delphi代码

unit UnitHideProcess;

interface

uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls,
Forms, Dialogs, Registry, ComCtrls, StrUtils, StdCtrls,
ToolWin, Menus, ImgList, ActnList, IniFiles, CheckLst, FileCtrl, Aclapi,
Accctrl;

type
NTSTATUS=Longint;
USHORT =Byte;
PWSTR=PWidechar;
ULONG= Cardinal;
HANDLE=Pointer;
PVOID=Pointer;
PCWSTR=PWidechar;
PULONG=^ULONG ;
HMODULE=THANDLE;

const
STATUS_ACCESS_DENIED = $C0000022 ;
RSP_SIMPLE_SERVICE = $00000001;
RSP_UNREGISTER_SERVICE = $00000000 ;
type
_UNICODE_STRING= record
Length:USHORT ;
MaximumLength: USHORT;
Buffer:PWSTR;
end;
UNICODE_STRING= _UNICODE_STRING;
PUNICODE_STRING =^ _UNICODE_STRING ;

_OBJECT_ATTRIBUTES =record
Length:ULONG ;
RootDirectory:HANDLE;
ObjectName:PUNICODE_STRING;
Attributes:ULONG;
SecurityDescriptor:PVOID;
SecurityQualityOfService:PVOID ;
end;
OBJECT_ATTRIBUTES=_OBJECT_ATTRIBUTES ;
POBJECT_ATTRIBUTES=^_OBJECT_ATTRIBUTES;

ZWOPENSECTION=function(
SectionHandle:PInteger;
DesiredAccess:ACCESS_MASK;
ObjectAttributes :POBJECT_ATTRIBUTES
): NTSTATUS; stdcall;
RTLINITUNICODESTRING=procedure(
DestinationString:PUNICODE_STRING;
SourceString :PCWSTR
);stdcall;

TMyHideProcess=class
private
OSversion:Longint;
RtlInitUnicodeString:RTLINITUNICODESTRING ;
ZwOpenSection:ZWOPENSECTION;
g_hNtDLL: HMODULE;
g_pMapPhysicalMemory:PVOID;
g_hMPM :THANDLE ;
function InitNTDLL():bool;
procedure CloseNTDLL();
procedure SetPhyscialMemorySectionCanBeWrited( hSection:THANDLE) ;

最低0.47元/天解锁文章