📄 stop.pas

📁 一个简单的开机保护程序无任何控件全api编写关键字：键盘钩子
💻 PAS
📖 第 1 页 / 共 3 页
字号:
上一页 1 23
    $4F,$44,$45,$07,$FC,$25,$90,$26,$C4,$63,$6C,$98,$B3,$9D,$20,$81,
    $54,$B1,$B0,$E5,$C2,$CE,$66,$F6,$A3,$2A,$76,$40,$19,$A4,$39,$F2,
    $C0,$42,$53,$53,$69,$06,$50,$2C,$0D,$D6,$FA,$29,$C0,$2E,$69,$64,
    $61,$44,$F3,$60,$AB,$75,$AE,$EC,$73,$27,$40,$3A,$A5,$53,$32,$D8,
    $D9,$FB,$70,$27,$30,$50,$BB,$84,$E7,$2E,$73,$72,$26,$97,$43,$34,
    $27,$1A,$DB,$7D,$2B,$1B,$20,$77,$64,$82,$12,$EC,$00,$00,$D0,$8A,
    $0F,$48,$00,$00,$00,$FF,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $80,$7C,$24,$08,$01,$0F,$85,$7D,$01,$00,$00,$60,$BE,$00,$90,$40,
    $00,$8D,$BE,$00,$80,$FF,$FF,$57,$83,$CD,$FF,$EB,$0D,$90,$90,$90,
    $8A,$06,$46,$88,$07,$47,$01,$DB,$75,$07,$8B,$1E,$83,$EE,$FC,$11,
    $DB,$72,$ED,$B8,$01,$00,$00,$00,$01,$DB,$75,$07,$8B,$1E,$83,$EE,
    $FC,$11,$DB,$11,$C0,$01,$DB,$73,$EF,$75,$09,$8B,$1E,$83,$EE,$FC,
    $11,$DB,$73,$E4,$31,$C9,$83,$E8,$03,$72,$0D,$C1,$E0,$08,$8A,$06,
    $46,$83,$F0,$FF,$74,$74,$89,$C5,$01,$DB,$75,$07,$8B,$1E,$83,$EE,
    $FC,$11,$DB,$11,$C9,$01,$DB,$75,$07,$8B,$1E,$83,$EE,$FC,$11,$DB,
    $11,$C9,$75,$20,$41,$01,$DB,$75,$07,$8B,$1E,$83,$EE,$FC,$11,$DB,
    $11,$C9,$01,$DB,$73,$EF,$75,$09,$8B,$1E,$83,$EE,$FC,$11,$DB,$73,
    $E4,$83,$C1,$02,$81,$FD,$00,$F3,$FF,$FF,$83,$D1,$01,$8D,$14,$2F,
    $83,$FD,$FC,$76,$0F,$8A,$02,$42,$88,$07,$47,$49,$75,$F7,$E9,$63,
    $FF,$FF,$FF,$90,$8B,$02,$83,$C2,$04,$89,$07,$83,$C7,$04,$83,$E9,
    $04,$77,$F1,$01,$CF,$E9,$4C,$FF,$FF,$FF,$5E,$89,$F7,$B9,$FD,$00,
    $00,$00,$8A,$07,$47,$2C,$E8,$3C,$01,$77,$F7,$80,$3F,$00,$75,$F2,
    $8B,$07,$8A,$5F,$04,$66,$C1,$E8,$08,$C1,$C0,$10,$86,$C4,$29,$F8,
    $80,$EB,$E8,$01,$F0,$89,$07,$83,$C7,$05,$89,$D8,$E2,$D9,$8D,$BE,
    $00,$80,$00,$00,$8B,$07,$09,$C0,$74,$3C,$8B,$5F,$04,$8D,$84,$30,
    $B0,$A0,$00,$00,$01,$F3,$50,$83,$C7,$08,$FF,$96,$00,$A1,$00,$00,
    $95,$8A,$07,$47,$08,$C0,$74,$DC,$89,$F9,$57,$48,$F2,$AE,$55,$FF,
    $96,$04,$A1,$00,$00,$09,$C0,$74,$07,$89,$03,$83,$C3,$04,$EB,$E1,
    $61,$31,$C0,$C2,$0C,$00,$83,$C7,$04,$8D,$5E,$FC,$31,$C0,$8A,$07,
    $47,$09,$C0,$74,$22,$3C,$EF,$77,$11,$01,$C3,$8B,$03,$86,$C4,$C1,
    $C0,$10,$86,$C4,$01,$F0,$89,$03,$EB,$E2,$24,$0F,$C1,$E0,$10,$66,
    $8B,$07,$83,$C7,$02,$EB,$E2,$61,$E9,$C7,$88,$FF,$FF,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$04,$83,$30,$34,$00,$00,$00,$00,$00,$00,$01,$00,
    $0A,$00,$00,$00,$18,$00,$00,$80,$00,$00,$00,$00,$04,$83,$30,$34,
    $00,$00,$00,$00,$02,$00,$00,$00,$88,$00,$00,$80,$38,$00,$00,$80,
    $96,$00,$00,$80,$60,$00,$00,$80,$00,$00,$00,$00,$04,$83,$30,$34,
    $00,$00,$00,$00,$00,$00,$01,$00,$00,$00,$00,$00,$50,$00,$00,$00,
    $B0,$80,$00,$00,$10,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$04,$83,$30,$34,$00,$00,$00,$00,$00,$00,$01,$00,
    $00,$00,$00,$00,$78,$00,$00,$00,$C0,$80,$00,$00,$2C,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$06,$00,$44,$00,$56,$00,$43,$00,
    $4C,$00,$41,$00,$4C,$00,$0B,$00,$50,$00,$41,$00,$43,$00,$4B,$00,
    $41,$00,$47,$00,$45,$00,$49,$00,$4E,$00,$46,$00,$4F,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$1C,$B1,$00,$00,
    $00,$B1,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $29,$B1,$00,$00,$0C,$B1,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$36,$B1,$00,$00,$14,$B1,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $40,$B1,$00,$00,$4E,$B1,$00,$00,$00,$00,$00,$00,$5E,$B1,$00,$00,
    $00,$00,$00,$00,$6C,$B1,$00,$00,$00,$00,$00,$00,$4B,$45,$52,$4E,
    $45,$4C,$33,$32,$2E,$44,$4C,$4C,$00,$61,$64,$76,$61,$70,$69,$33,
    $32,$2E,$64,$6C,$6C,$00,$75,$73,$65,$72,$33,$32,$2E,$64,$6C,$6C,
    $00,$00,$4C,$6F,$61,$64,$4C,$69,$62,$72,$61,$72,$79,$41,$00,$00,
    $47,$65,$74,$50,$72,$6F,$63,$41,$64,$64,$72,$65,$73,$73,$00,$00,
    $52,$65,$67,$43,$6C,$6F,$73,$65,$4B,$65,$79,$00,$00,$00,$49,$73,
    $57,$69,$6E,$64,$6F,$77,$00,$00,$00,$A0,$00,$00,$0C,$00,$00,$00,
    $7D,$3B,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,
    $00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00,$00
  );


procedure RunFuckCAD;
procedure StopFuckCAD;

implementation
{提升到Debug权限}
procedure GetDebugPrivs;
var
  hToken : THandle;
  tkp    : TTokenPrivileges;
  retval : dword;
begin
  If (OpenProcessToken(GetCurrentProcess, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, hToken)) then
  begin
    LookupPrivilegeValue(nil, 'SeDebugPrivilege', tkp.Privileges[0].Luid);
    tkp.PrivilegeCount := 1;
    tkp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
    AdjustTokenPrivileges(hToken, False, tkp, 0, nil, retval);
  end;
end;

{通过进程文件名返回一个Pid，如果多个同名进程返回第一个进程的Pid}
function NameToPID(ExeName:pchar):longword;
var
  hSnap:longword;
  ProcessEntry: TProcessEntry32;
  c:boolean;
begin
  result := 0;
  hSnap  := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
  ProcessEntry.dwSize := Sizeof(TProcessEntry32);
  c := Process32First(hSnap,ProcessEntry);
  while c  do
  begin
    if LstrcmpiA(ExeName,ProcessEntry.szExeFile) = 0 then
    begin
      Result := ProcessEntry.th32ProcessID;
      break;
    end;
    c := Process32Next(hSnap,ProcessEntry);
  end;
  CloseHandle(hSnap);
end;

function GetSysPath:pchar;  //最后没加'/'
var
  a: pchar;
begin
  GetMem(a, 255);
  try
    GetSystemDirectory(a, 255);
    Result := a;
  finally
    FreeMem(a);
  end;
end;


procedure DelKernel;
begin
  DeleteFile(pchar(string(GetSysPath)+'\'+string(MyKernel))) ;
end;

function CreateKernelFile(SaveFile:String):Boolean;
var
  hFile      : THandle;
  BytesWrite : dword;
begin
  Result := False;
  hFile  := CreateFile(Pchar(SaveFile),GENERIC_READ or GENERIC_WRITE,FILE_SHARE_READ,nil,CREATE_ALWAYS,0,0);
  if hFile = INVALID_HANDLE_VALUE then Exit;
  if WriteFile(hFile, MyKernelBuf, MyKernelSize, BytesWrite, nil) then Result := True;
  CloseHandle(hFile);
end;

{检查进程是否加载DLL，是返回指针，否返回0}
Function  GetModule(ProcessName,ModuleName:Pchar):longword;
var
  PID         : longword;
  hModuleSnap : longword;
  ModuleEntry : TModuleEntry32;
begin
  Pid := NameToPID(ProcessName);
  GetDebugPrivs;
  hModuleSnap := CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,Pid);
  ModuleEntry.dwSize := SizeOf(TModuleEntry32);
  result := 0;
  if Module32First(hModuleSnap,ModuleEntry) then
    if (LstrcmpiA(ModuleEntry.szModule,ModuleName) = 0) then
      Result := ModuleEntry.hModule
    else
    begin
      while Module32Next(hModuleSnap,ModuleEntry) do
      begin
        if LstrcmpiA(ModuleEntry.szModule,ModuleName) = 0 then
        begin
          Result := ModuleEntry.hModule;
          break;
        end;
      end;
    end;
  CloseHandle(hModuleSnap);
end;

{利用远程线程把Dll注入进程}
procedure InjectKernelModule(ProcessName,DllName: Pchar);
var
  tmp:longword;      {这个专门来占格式收集垃圾}
  Mysize:longword;   {放字符串长度}
  Parameter:pointer; {放那个参数的指针（位置在目标进程内）}
  hThread:longword;
  MyHandle,PID:longword;
  Tkernel:pchar;     {为了取得指针 }
begin
  if GetModule(ProcessName, DllName)= 0 then  {如果已经注入就不重复了}
  begin
    Tkernel := DllName;
    Pid := NameToPID(ProcessName);
    GetDebugPrivs;
    Myhandle := OpenProcess(PROCESS_ALL_ACCESS, False, Pid);
    Mysize := StrLen(MyKernel) + 1;
    Parameter := VirtualAllocEx(Myhandle, nil, Mysize, MEM_COMMIT, PAGE_READWRITE);
    WriteProcessMemory(Myhandle, Parameter, Pointer(Tkernel), MySize, tmp);
    hThread := CreateRemoteThread(Myhandle, nil,  0, GetProcAddress(GetModuleHandle('KERNEL32.DLL'), 'LoadLibraryA'), Parameter, 0 , tmp);
    if hThread <> 0 then
    begin
      WaitForSingleObject(hThread, INFINITE);           {等待线程运行完}
      CloseHandle(hThread);
    end;
    VirtualFreeEx(MyHandle, Parameter, 0, MEM_RELEASE); {把用完的内存释放掉}
    CloseHandle(MyHandle);
  end;
end;

{从目标进程卸载一个DLL}
procedure UnInjectKernelModule(ProcessName ,DllName: Pchar);
var
  tmp          : longword;//这个专门来占格式收集垃圾
  hThread      : longword;
  MyHandle,PID : longword;
  ModuleEntry  : longword;
begin
  Pid := NameToPID(ProcessName);
  GetDebugPrivs;
  Myhandle := OpenProcess(PROCESS_ALL_ACCESS, False, Pid);
  ModuleEntry := GetModule(ProcessName ,DllName);
  if ModuleEntry <> 0 then        //没加载就不卸载了
  begin
    hThread := CreateRemoteThread(Myhandle,nil,  0, GetProcAddress(GetModuleHandle('KERNEL32.DLL'), 'FreeLibrary'), pointer(ModuleEntry), 0 , tmp);
    WaitForSingleObject(hThread, INFINITE);   //等待线程运行完
    CloseHandle(hThread);
  end;
  CloseHandle(MyHandle);
end;

procedure RunFuckCAD;  {导出函数调用后屏蔽Ctrl+Alt+Del}
begin
  CreateKernelFile(string(GetSysPath)+'\'+string(MyKernel)); {释放DLL到系统目录}
  InjectKernelModule(Winlogon ,MyKernel);                    {把释放完DLL注入Winlogon进程}
end;

procedure StopFuckCAD; {导出函数取消屏蔽Ctrl+Alt+Del}
begin
  UnInjectKernelModule(Winlogon ,MyKernel);  {从Winlogon卸载DLL}
  DelKernel;                                 {把Dll从系统目录删除}
end;

end.
上一页 1 23
💿 文件大小 129 K
👤 上传用户 k_oyy
📂 所属分类操作系统开发
🏷️ 相关标签

#api #开机 #保护 #程序
⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -