jwawinbase.pas

delphi NT本地API单元 用delphi写rootkit方便了。

function FreeModule(hLibModule: HMODULE): BOOL;
{$EXTERNALSYM FreeModule}
function MakeProcInstance(lpProc: FARPROC; hInstance: HINSTANCE): FARPROC;
{$EXTERNALSYM MakeProcInstance}
procedure FreeProcInstance(lpProc: FARPROC);
{$EXTERNALSYM FreeProcInstance}

// Global Memory Flags

const
  GMEM_FIXED          = $0000;
  {$EXTERNALSYM GMEM_FIXED}
  GMEM_MOVEABLE       = $0002;
  {$EXTERNALSYM GMEM_MOVEABLE}
  GMEM_NOCOMPACT      = $0010;
  {$EXTERNALSYM GMEM_NOCOMPACT}
  GMEM_NODISCARD      = $0020;
  {$EXTERNALSYM GMEM_NODISCARD}
  GMEM_ZEROINIT       = $0040;
  {$EXTERNALSYM GMEM_ZEROINIT}
  GMEM_MODIFY         = $0080;
  {$EXTERNALSYM GMEM_MODIFY}
  GMEM_DISCARDABLE    = $0100;
  {$EXTERNALSYM GMEM_DISCARDABLE}
  GMEM_NOT_BANKED     = $1000;
  {$EXTERNALSYM GMEM_NOT_BANKED}
  GMEM_SHARE          = $2000;
  {$EXTERNALSYM GMEM_SHARE}
  GMEM_DDESHARE       = $2000;
  {$EXTERNALSYM GMEM_DDESHARE}
  GMEM_NOTIFY         = $4000;
  {$EXTERNALSYM GMEM_NOTIFY}
  GMEM_LOWER          = GMEM_NOT_BANKED;
  {$EXTERNALSYM GMEM_LOWER}
  GMEM_VALID_FLAGS    = $7F72;
  {$EXTERNALSYM GMEM_VALID_FLAGS}
  GMEM_INVALID_HANDLE = $8000;
  {$EXTERNALSYM GMEM_INVALID_HANDLE}

  GHND = (GMEM_MOVEABLE or GMEM_ZEROINIT);
  {$EXTERNALSYM GHND}
  GPTR = (GMEM_FIXED or GMEM_ZEROINIT);
  {$EXTERNALSYM GPTR}

function GlobalLRUNewest(h: HANDLE): HANDLE;
{$EXTERNALSYM GlobalLRUNewest}
function GlobalLRUOldest(h: HANDLE): HANDLE;
{$EXTERNALSYM GlobalLRUOldest}
function GlobalDiscard(h: HANDLE): HANDLE;
{$EXTERNALSYM GlobalDiscard}

// Flags returned by GlobalFlags (in addition to GMEM_DISCARDABLE)

const
  GMEM_DISCARDED = $4000;
  {$EXTERNALSYM GMEM_DISCARDED}
  GMEM_LOCKCOUNT = $00FF;
  {$EXTERNALSYM GMEM_LOCKCOUNT}

type
  LPMEMORYSTATUS = ^MEMORYSTATUS;
  {$EXTERNALSYM LPMEMORYSTATUS}
  _MEMORYSTATUS = record
    dwLength: DWORD;
    dwMemoryLoad: DWORD;
    dwTotalPhys: SIZE_T;
    dwAvailPhys: SIZE_T;
    dwTotalPageFile: SIZE_T;
    dwAvailPageFile: SIZE_T;
    dwTotalVirtual: SIZE_T;
    dwAvailVirtual: SIZE_T;
  end;
  {$EXTERNALSYM _MEMORYSTATUS}
  MEMORYSTATUS = _MEMORYSTATUS;
  {$EXTERNALSYM MEMORYSTATUS}
  TMemoryStatus = MEMORYSTATUS;
  PMemoryStatus = LPMEMORYSTATUS;

// Local Memory Flags

const
  LMEM_FIXED          = $0000;
  {$EXTERNALSYM LMEM_FIXED}
  LMEM_MOVEABLE       = $0002;
  {$EXTERNALSYM LMEM_MOVEABLE}
  LMEM_NOCOMPACT      = $0010;
  {$EXTERNALSYM LMEM_NOCOMPACT}
  LMEM_NODISCARD      = $0020;
  {$EXTERNALSYM LMEM_NODISCARD}
  LMEM_ZEROINIT       = $0040;
  {$EXTERNALSYM LMEM_ZEROINIT}
  LMEM_MODIFY         = $0080;
  {$EXTERNALSYM LMEM_MODIFY}
  LMEM_DISCARDABLE    = $0F00;
  {$EXTERNALSYM LMEM_DISCARDABLE}
  LMEM_VALID_FLAGS    = $0F72;
  {$EXTERNALSYM LMEM_VALID_FLAGS}
  LMEM_INVALID_HANDLE = $8000;
  {$EXTERNALSYM LMEM_INVALID_HANDLE}

  LHND = (LMEM_MOVEABLE or LMEM_ZEROINIT);
  {$EXTERNALSYM LHND}
  LPTR = (LMEM_FIXED or LMEM_ZEROINIT);
  {$EXTERNALSYM LPTR}

  NONZEROLHND = (LMEM_MOVEABLE);
  {$EXTERNALSYM NONZEROLHND}
  NONZEROLPTR = (LMEM_FIXED);
  {$EXTERNALSYM NONZEROLPTR}

function LocalDiscard(h: HLOCAL): HLOCAL;
{$EXTERNALSYM LocalDiscard}

// Flags returned by LocalFlags (in addition to LMEM_DISCARDABLE)

const
  LMEM_DISCARDED = $4000;
  {$EXTERNALSYM LMEM_DISCARDED}
  LMEM_LOCKCOUNT = $00FF;
  {$EXTERNALSYM LMEM_LOCKCOUNT}

//
// dwCreationFlag values
//

  DEBUG_PROCESS           = $00000001;
  {$EXTERNALSYM DEBUG_PROCESS}
  DEBUG_ONLY_THIS_PROCESS = $00000002;
  {$EXTERNALSYM DEBUG_ONLY_THIS_PROCESS}

  CREATE_SUSPENDED = $00000004;
  {$EXTERNALSYM CREATE_SUSPENDED}

  DETACHED_PROCESS = $00000008;
  {$EXTERNALSYM DETACHED_PROCESS}

  CREATE_NEW_CONSOLE = $00000010;
  {$EXTERNALSYM CREATE_NEW_CONSOLE}

  NORMAL_PRIORITY_CLASS   = $00000020;
  {$EXTERNALSYM NORMAL_PRIORITY_CLASS}
  IDLE_PRIORITY_CLASS     = $00000040;
  {$EXTERNALSYM IDLE_PRIORITY_CLASS}
  HIGH_PRIORITY_CLASS     = $00000080;
  {$EXTERNALSYM HIGH_PRIORITY_CLASS}
  REALTIME_PRIORITY_CLASS = $00000100;
  {$EXTERNALSYM REALTIME_PRIORITY_CLASS}

  CREATE_NEW_PROCESS_GROUP   = $00000200;
  {$EXTERNALSYM CREATE_NEW_PROCESS_GROUP}
  CREATE_UNICODE_ENVIRONMENT = $00000400;
  {$EXTERNALSYM CREATE_UNICODE_ENVIRONMENT}

  CREATE_SEPARATE_WOW_VDM = $00000800;
  {$EXTERNALSYM CREATE_SEPARATE_WOW_VDM}
  CREATE_SHARED_WOW_VDM   = $00001000;
  {$EXTERNALSYM CREATE_SHARED_WOW_VDM}
  CREATE_FORCEDOS         = $00002000;
  {$EXTERNALSYM CREATE_FORCEDOS}

  BELOW_NORMAL_PRIORITY_CLASS = $00004000;
  {$EXTERNALSYM BELOW_NORMAL_PRIORITY_CLASS}
  ABOVE_NORMAL_PRIORITY_CLASS = $00008000;
  {$EXTERNALSYM ABOVE_NORMAL_PRIORITY_CLASS}
  STACK_SIZE_PARAM_IS_A_RESERVATION = $00010000;
  {$EXTERNALSYM STACK_SIZE_PARAM_IS_A_RESERVATION}

  CREATE_BREAKAWAY_FROM_JOB = $01000000;
  {$EXTERNALSYM CREATE_BREAKAWAY_FROM_JOB}
  CREATE_PRESERVE_CODE_AUTHZ_LEVEL = $02000000;
  {$EXTERNALSYM CREATE_PRESERVE_CODE_AUTHZ_LEVEL}

  CREATE_DEFAULT_ERROR_MODE = $04000000;
  {$EXTERNALSYM CREATE_DEFAULT_ERROR_MODE}
  CREATE_NO_WINDOW          = $08000000;
  {$EXTERNALSYM CREATE_NO_WINDOW}

  PROFILE_USER   = $10000000;
  {$EXTERNALSYM PROFILE_USER}
  PROFILE_KERNEL = $20000000;
  {$EXTERNALSYM PROFILE_KERNEL}
  PROFILE_SERVER = $40000000;
  {$EXTERNALSYM PROFILE_SERVER}

  CREATE_IGNORE_SYSTEM_DEFAULT = DWORD($80000000);
  {$EXTERNALSYM CREATE_IGNORE_SYSTEM_DEFAULT}

  THREAD_PRIORITY_LOWEST       = THREAD_BASE_PRIORITY_MIN;
  {$EXTERNALSYM THREAD_PRIORITY_LOWEST}
  THREAD_PRIORITY_BELOW_NORMAL = (THREAD_PRIORITY_LOWEST+1);
  {$EXTERNALSYM THREAD_PRIORITY_BELOW_NORMAL}
  THREAD_PRIORITY_NORMAL       = 0;
  {$EXTERNALSYM THREAD_PRIORITY_NORMAL}
  THREAD_PRIORITY_HIGHEST      = THREAD_BASE_PRIORITY_MAX;
  {$EXTERNALSYM THREAD_PRIORITY_HIGHEST}
  THREAD_PRIORITY_ABOVE_NORMAL = (THREAD_PRIORITY_HIGHEST-1);
  {$EXTERNALSYM THREAD_PRIORITY_ABOVE_NORMAL}
  THREAD_PRIORITY_ERROR_RETURN = (MAXLONG);
  {$EXTERNALSYM THREAD_PRIORITY_ERROR_RETURN}

  THREAD_PRIORITY_TIME_CRITICAL = THREAD_BASE_PRIORITY_LOWRT;
  {$EXTERNALSYM THREAD_PRIORITY_TIME_CRITICAL}
  THREAD_PRIORITY_IDLE          = THREAD_BASE_PRIORITY_IDLE;
  {$EXTERNALSYM THREAD_PRIORITY_IDLE}

//
// Debug APIs
//

  EXCEPTION_DEBUG_EVENT      = 1;
  {$EXTERNALSYM EXCEPTION_DEBUG_EVENT}
  CREATE_THREAD_DEBUG_EVENT  = 2;
  {$EXTERNALSYM CREATE_THREAD_DEBUG_EVENT}
  CREATE_PROCESS_DEBUG_EVENT = 3;
  {$EXTERNALSYM CREATE_PROCESS_DEBUG_EVENT}
  EXIT_THREAD_DEBUG_EVENT    = 4;
  {$EXTERNALSYM EXIT_THREAD_DEBUG_EVENT}
  EXIT_PROCESS_DEBUG_EVENT   = 5;
  {$EXTERNALSYM EXIT_PROCESS_DEBUG_EVENT}
  LOAD_DLL_DEBUG_EVENT       = 6;
  {$EXTERNALSYM LOAD_DLL_DEBUG_EVENT}
  UNLOAD_DLL_DEBUG_EVENT     = 7;
  {$EXTERNALSYM UNLOAD_DLL_DEBUG_EVENT}
  OUTPUT_DEBUG_STRING_EVENT  = 8;
  {$EXTERNALSYM OUTPUT_DEBUG_STRING_EVENT}
  RIP_EVENT                  = 9;
  {$EXTERNALSYM RIP_EVENT}

type
  LPEXCEPTION_DEBUG_INFO = ^EXCEPTION_DEBUG_INFO;
  {$EXTERNALSYM LPEXCEPTION_DEBUG_INFO}
  _EXCEPTION_DEBUG_INFO = record
    ExceptionRecord: EXCEPTION_RECORD;
    dwFirstChance: DWORD;
  end;
  {$EXTERNALSYM _EXCEPTION_DEBUG_INFO}
  EXCEPTION_DEBUG_INFO = _EXCEPTION_DEBUG_INFO;
  {$EXTERNALSYM EXCEPTION_DEBUG_INFO}
  TExceptionDebugInfo = EXCEPTION_DEBUG_INFO;
  PExceptionDebugInfo = LPEXCEPTION_DEBUG_INFO;

  LPCREATE_THREAD_DEBUG_INFO = ^CREATE_THREAD_DEBUG_INFO;
  {$EXTERNALSYM LPCREATE_THREAD_DEBUG_INFO}
  _CREATE_THREAD_DEBUG_INFO = record
    hThread: HANDLE;
    lpThreadLocalBase: LPVOID;
    lpStartAddress: LPTHREAD_START_ROUTINE;
  end;
  {$EXTERNALSYM _CREATE_THREAD_DEBUG_INFO}
  CREATE_THREAD_DEBUG_INFO = _CREATE_THREAD_DEBUG_INFO;
  {$EXTERNALSYM CREATE_THREAD_DEBUG_INFO}
  TCreateThreadDebugInfo = CREATE_THREAD_DEBUG_INFO;
  PCreateThreadDebugInfo = LPCREATE_THREAD_DEBUG_INFO;

  LPCREATE_PROCESS_DEBUG_INFO = ^CREATE_PROCESS_DEBUG_INFO;
  {$EXTERNALSYM LPCREATE_PROCESS_DEBUG_INFO}
  _CREATE_PROCESS_DEBUG_INFO = record
    hFile: HANDLE;
    hProcess: HANDLE;
    hThread: HANDLE;
    lpBaseOfImage: LPVOID;
    dwDebugInfoFileOffset: DWORD;
    nDebugInfoSize: DWORD;
    lpThreadLocalBase: LPVOID;
    lpStartAddress: LPTHREAD_START_ROUTINE;
    lpImageName: LPVOID;
    fUnicode: Word;
  end;
  {$EXTERNALSYM _CREATE_PROCESS_DEBUG_INFO}
  CREATE_PROCESS_DEBUG_INFO = _CREATE_PROCESS_DEBUG_INFO;
  {$EXTERNALSYM CREATE_PROCESS_DEBUG_INFO}
  TCreateProcessDebugInfo = CREATE_PROCESS_DEBUG_INFO;
  PCreateProcessDebugInfo = LPCREATE_PROCESS_DEBUG_INFO;

  LPEXIT_THREAD_DEBUG_INFO = ^EXIT_THREAD_DEBUG_INFO;
  {$EXTERNALSYM LPEXIT_THREAD_DEBUG_INFO}
  _EXIT_THREAD_DEBUG_INFO = record
    dwExitCode: DWORD;
  end;
  {$EXTERNALSYM _EXIT_THREAD_DEBUG_INFO}
  EXIT_THREAD_DEBUG_INFO = _EXIT_THREAD_DEBUG_INFO;
  {$EXTERNALSYM EXIT_THREAD_DEBUG_INFO}
  TExitThreadDebugInfo = EXIT_THREAD_DEBUG_INFO;
  PExitThreadDebugInfo = LPEXIT_THREAD_DEBUG_INFO;

  LPEXIT_PROCESS_DEBUG_INFO = ^EXIT_PROCESS_DEBUG_INFO;
  {$EXTERNALSYM LPEXIT_PROCESS_DEBUG_INFO}
  _EXIT_PROCESS_DEBUG_INFO = record
    dwExitCode: DWORD;
  end;
  {$EXTERNALSYM _EXIT_PROCESS_DEBUG_INFO}
  EXIT_PROCESS_DEBUG_INFO = _EXIT_PROCESS_DEBUG_INFO;
  {$EXTERNALSYM EXIT_PROCESS_DEBUG_INFO}
  TExitProcessDebugInfo = EXIT_PROCESS_DEBUG_INFO;
  PExitProcessDebugInfo = LPEXIT_PROCESS_DEBUG_INFO;

  LPLOAD_DLL_DEBUG_INFO = ^LOAD_DLL_DEBUG_INFO;
  {$EXTERNALSYM LPLOAD_DLL_DEBUG_INFO}
  _LOAD_DLL_DEBUG_INFO = record
    hFile: HANDLE;
    lpBaseOfDll: LPVOID;
    dwDebugInfoFileOffset: DWORD;
    nDebugInfoSize: DWORD;
    lpImageName: LPVOID;
    fUnicode: Word;
  end;
  {$EXTERNALSYM _LOAD_DLL_DEBUG_INFO}
  LOAD_DLL_DEBUG_INFO = _LOAD_DLL_DEBUG_INFO;
  {$EXTERNALSYM LOAD_DLL_DEBUG_INFO}
  TLoadDllDebugInfo = LOAD_DLL_DEBUG_INFO;
  PLoadDllDebugInfo = LPLOAD_DLL_DEBUG_INFO;

  LPUNLOAD_DLL_DEBUG_INFO = ^UNLOAD_DLL_DEBUG_INFO;
  {$EXTERNALSYM LPUNLOAD_DLL_DEBUG_INFO}
  _UNLOAD_DLL_DEBUG_INFO = record
    lpBaseOfDll: LPVOID;
  end;
  {$EXTERNALSYM _UNLOAD_DLL_DEBUG_INFO}
  UNLOAD_DLL_DEBUG_INFO = _UNLOAD_DLL_DEBUG_INFO;
  {$EXTERNALSYM UNLOAD_DLL_DEBUG_INFO}
  TUnloadDllDebugInfo = UNLOAD_DLL_DEBUG_INFO;
  PUnloadDllDebugInfo = LPUNLOAD_DLL_DEBUG_INFO;

  LPOUTPUT_DEBUG_STRING_INFO = ^OUTPUT_DEBUG_STRING_INFO;
  {$EXTERNALSYM LPOUTPUT_DEBUG_STRING_INFO}
  _OUTPUT_DEBUG_STRING_INFO = record
    lpDebugStringData: LPSTR;
    fUnicode: Word;
    nDebugStringLength: Word;
  end;
  {$EXTERNALSYM _OUTPUT_DEBUG_STRING_INFO}
  OUTPUT_DEBUG_STRING_INFO = _OUTPUT_DEBUG_STRING_INFO;
  {$EXTERNALSYM OUTPUT_DEBUG_STRING_INFO}
  TOutputDebugStringInfo = OUTPUT_DEBUG_STRING_INFO;
  POutputDebugStringInfo = LPOUTPUT_DEBUG_STRING_INFO;

  LPRIP_INFO = ^RIP_INFO;
  {$EXTERNALSYM LPRIP_INFO}
  _RIP_INFO = record
    dwError: DWORD;
    dwType: DWORD;
  end;
  {$EXTERNALSYM _RIP_INFO}
  RIP_INFO = _RIP_INFO;
  {$EXTERNALSYM RIP_INFO}
  TRipInfo = RIP_INFO;
  PRipInfo = LPRIP_INFO;

  LPDEBUG_EVENT = ^DEBUG_EVENT;
  {$EXTERNALSYM LPDEBUG_EVENT}
  _DEBUG_EVENT = record
    dwDebugEventCode: DWORD;
    dwProcessId: DWORD;
    dwThreadId: DWORD;
    case Integer of
      0: (Exception: EXCEPTION_DEBUG_INFO);
      1: (CreateThread: CREATE_THREAD_DEBUG_INFO);
      2: (CreateProcessInfo: CREATE_PROCESS_DEBUG_INFO);
      3: (ExitThread: EXIT_THREAD_DEBUG_INFO);
      4: (ExitProcess: EXIT_PROCESS_DEBUG_INFO);
      5: (LoadDll: LOAD_DLL_DEBUG_INFO);
      6: (UnloadDll: UNLOAD_DLL_DEBUG_INFO);
      7: (DebugString: OUTPUT_DEBUG_STRING_INFO);
      8: (RipInfo: RIP_INFO);
  end;
  {$EXTERNALSYM _DEBUG_EVENT}
  DEBUG_EVENT = _DEBUG_EVENT;
  {$EXTERNALSYM DEBUG_EVENT}
  TDebugEvent = DEBUG_EVENT;
  PDebugEvent = LPDEBUG_EVENT;

  LPCONTEXT = PCONTEXT;
  {$EXTERNALSYM LPCONTEXT}
  LPEXCEPTION_RECORD = PEXCEPTION_RECORD;
  {$EXTERNALSYM LPEXCEPTION_RECORD}
  LPEXCEPTION_POINTERS = PEXCEPTION_POINTERS;
  {$EXTERNALSYM LPEXCEPTION_POINTERS}

const
  DRIVE_UNKNOWN     = 0;
  {$EXTERNALSYM DRIVE_UNKNOWN}
  DRIVE_NO_ROOT_DIR = 1;
  {$EXTERNALSYM DRIVE_NO_ROOT_DIR}
  DRIVE_REMOVABLE   = 2;
  {$EXTERNALSYM DRIVE_REMOVABLE}
  DRIVE_FIXED       = 3;
  {$EXTERNALSYM DRIVE_FIXED}
  DRIVE_REMOTE      = 4;
  {$EXTERNALSYM DRIVE_REMOTE}
  DRIVE_CDROM       = 5;
  {$EXTERNALSYM DRIVE_CDROM}
  DRIVE_RAMDISK     = 6;
  {$EXTERNALSYM DRIVE_RAMDISK}

function GetFreeSpace(w: WORD): DWORD;
{$EXTERNALSYM GetFreeSpace}

const
  FILE_TYPE_UNKNOWN = $0000;
  {$EXTERNALSYM FILE_TYPE_UNKNOWN}
  FILE_TYPE_DISK    = $0001;
  {$EXTERNALSYM FILE_TYPE_DISK}
  FILE_TYPE_CHAR    = $0002;
  {$EXTERNALSYM FILE_TYPE_CHAR}
  FILE_TYPE_PIPE    = $0003;