winperf.pas

面对面 木马生成器 完整代码 程序仅提供测试学习 全局钩子查找句柄截获 使用ASP收信 收信地址明文（测试而已没加密） //本软件主要是截获账号和密码 带了个简单发信

{******************************************************************}
{                                                       	   }
{       Borland Delphi Runtime Library                  	   }
{       Performance Data Helper Messages interface unit            }
{ 								   }
{ Portions created by Microsoft are 				   }
{ Copyright (C) 1995-1999 Microsoft Corporation. 		   }
{ All Rights Reserved. 						   }
{ 								   }
{ The original file is: WinPerf.pas, released 3 Dec 1999. 	   }
{ The original Pascal code is: WinPerf.pas, released 3 Dec 1999.   }
{ The initial developer of the Pascal code is Marcel van Brakel    }
{ ([e-mail]).                      			   }
{ 								   }
{ Portions created by Marcel van Brakel are			   }
{ Copyright (C) 1999 Marcel van Brakel.				   }
{ 								   }
{ Obtained through:                               	           }
{ Joint Endeavour of Delphi Innovators (Project JEDI)              }
{								   }
{ You may retrieve the latest version of this file at the Project  }
{ JEDI home page, located at http://delphi-jedi.org                }
{								   }
{ The contents of this file are used with permission, subject to   }
{ the Mozilla Public License Version 1.1 (the "License"); you may  }
{ not use this file except in compliance with the License. You may }
{ obtain a copy of the License at                                  }
{ http://www.mozilla.org/NPL/NPL-1_1Final.html 	                   }
{                                                                  }
{ Software distributed under the License is distributed on an 	   }
{ "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or   }
{ implied. See the License for the specific language governing     }
{ rights and limitations under the License. 			   }
{ 								   }
{******************************************************************}

unit WinPerf;

interface

uses
  Windows;

type LONG = Longint;

//  Header file for the Performance Monitor data.
//
//  This file contains the definitions of the data structures returned
//  by the Configuration Registry in response to a request for
//  performance data.  This file is used by both the Configuration
//  Registry and the Performance Monitor to define their interface.
//  The complete interface is described here, except for the name
//  of the node to query in the registry.  It is
//
//                 HKEY_PERFORMANCE_DATA.
//
//  By querying that node with a subkey of "Global" the caller will
//  retrieve the structures described here.
//
//  There is no need to RegOpenKey() the reserved handle HKEY_PERFORMANCE_DATA,
//  but the caller should RegCloseKey() the handle so that network transports
//  and drivers can be removed or installed (which cannot happen while
//  they are open for monitoring.)  Remote requests must first
//  RegConnectRegistry().

//  Data structure definitions.

//  In order for data to be returned through the Configuration Registry
//  in a system-independent fashion, it must be self-describing.

//  In the following, all offsets are in bytes.

//
//  Data is returned through the Configuration Registry in a
//  a data block which begins with a _PERF_DATA_BLOCK structure.
//

const
  PERF_DATA_VERSION  = 1;
  {$EXTERNALSYM PERF_DATA_VERSION}
  PERF_DATA_REVISION = 1;
  {$EXTERNALSYM PERF_DATA_REVISION}

type
  PPerfDataBlock = ^TPerfDataBlock;
  _PERF_DATA_BLOCK = record
    Signature: array [0..3] of WCHAR;   // Signature: Unicode "PERF"
    LittleEndian: DWORD;                // 0 = Big Endian, 1 = Little Endian
    Version: DWORD;                     // Version of these data structures
                                        // starting at 1
    Revision: DWORD;                    // Revision of these data structures
                                        // starting at 0 for each Version
    TotalByteLength: DWORD;             // Total length of data block
    HeaderLength: DWORD;                // Length of this structure
    NumObjectTypes: DWORD;              // Number of types of objects
                                        // being reported
    DefaultObject: LONG;                // Object Title Index of default
                                        // object to display when data from
                                        // this system is retrieved (-1 =
                                        // none, but this is not expected to
                                        // be used)
    SystemTime: SYSTEMTIME;             // Time at the system under
                                        // measurement
    PerfTime: LARGE_INTEGER;            // Performance counter value
                                        // at the system under measurement
    PerfFreq: LARGE_INTEGER;            // Performance counter frequency
                                        // at the system under measurement
    PerfTime100nSec: LARGE_INTEGER;     // Performance counter time in 100 nsec
                                        // units at the system under measurement
    SystemNameLength: DWORD;            // Length of the system name
    SystemNameOffset: DWORD;            // Offset, from beginning of this
                                        // structure, to name of system
                                        // being measured
  end;
  {$EXTERNALSYM _PERF_DATA_BLOCK}
  PERF_DATA_BLOCK = _PERF_DATA_BLOCK;
  {$EXTERNALSYM PERF_DATA_BLOCK}
  PPERF_DATA_BLOCK = ^PERF_DATA_BLOCK;
  {$EXTERNALSYM PPERF_DATA_BLOCK}
  TPerfDataBlock = _PERF_DATA_BLOCK;

//
//  The _PERF_DATA_BLOCK structure is followed by NumObjectTypes of
//  data sections, one for each type of object measured.  Each object
//  type section begins with a _PERF_OBJECT_TYPE structure.
//

  PPerfObjectType = ^TPerfObjectType;
  _PERF_OBJECT_TYPE = record
    TotalByteLength: DWORD;             // Length of this object definition
                                        // including this structure, the
                                        // counter definitions, and the
                                        // instance definitions and the
                                        // counter blocks for each instance:
                                        // This is the offset from this
                                        // structure to the next object, if
                                        // any
    DefinitionLength: DWORD;            // Length of object definition,
                                        // which includes this structure
                                        // and the counter definition
                                        // structures for this object: this
                                        // is the offset of the first
                                        // instance or of the counters
                                        // for this object if there is
                                        // no instance
    HeaderLength: DWORD;                // Length of this structure: this
                                        // is the offset to the first
                                        // counter definition for this
                                        // object
    ObjectNameTitleIndex: DWORD;        // Index to name in Title Database
    ObjectNameTitle: LPWSTR;            // Initially NULL, for use by
                                        // analysis program to point to
                                        // retrieved title string
    ObjectHelpTitleIndex: DWORD;        // Index to Help in Title Database
    ObjectHelpTitle: LPWSTR;            // Initially NULL, for use by
                                        // analysis program to point to
                                        // retrieved title string
    DetailLevel: DWORD;                 // Object level of detail (for
                                        // controlling display complexity);
                                        // will be min of detail levels
                                        // for all this object's counters
    NumCounters: DWORD;                 // Number of counters in each
                                        // counter block (one counter
                                        // block per instance)
    DefaultCounter: LONG;               // Default counter to display when
                                        // this object is selected, index
                                        // starting at 0 (-1 = none, but
                                        // this is not expected to be used)
    NumInstances: LONG;                 // Number of object instances
                                        // for which counters are being
                                        // returned from the system under
                                        // measurement. If the object defined
                                        // will never have any instance data
                                        // structures (PERF_INSTANCE_DEFINITION)
                                        // then this value should be -1, if the
                                        // object can have 0 or more instances,
                                        // but has none present, then this
                                        // should be 0, otherwise this field
                                        // contains the number of instances of
                                        // this counter.
    CodePage: DWORD;                    // 0 if instance strings are in
                                        // UNICODE, else the Code Page of
                                        // the instance names
    PerfTime: LARGE_INTEGER;            // Sample Time in "Object" units
    PerfFreq: LARGE_INTEGER;            // Frequency of "Object" units in
                                        // counts per second.
  end;
  {$EXTERNALSYM _PERF_OBJECT_TYPE}
  PERF_OBJECT_TYPE = _PERF_OBJECT_TYPE;
  {$EXTERNALSYM PERF_OBJECT_TYPE}
  PPERF_OBJECT_TYPE = ^PERF_OBJECT_TYPE;
  {$EXTERNALSYM PPERF_OBJECT_TYPE}
  TPerfObjectType = _PERF_OBJECT_TYPE;

const
  PERF_NO_INSTANCES = -1;               // no instances (see NumInstances above)
  {$EXTERNALSYM PERF_NO_INSTANCES}

//
// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
//
//  PERF_COUNTER_DEFINITION.CounterType field values
//
//
//        Counter ID Field Definition:
//
//   3      2        2    2    2        1        1    1
//   1      8        4    2    0        6        2    0    8                0
//  +--------+--------+----+----+--------+--------+----+----+----------------+
//  |Display |Calculation  |Time|Counter |        |Ctr |Size|                |
//  |Flags   |Modifiers    |Base|SubType |Reserved|Type|Fld |   Reserved     |
//  +--------+--------+----+----+--------+--------+----+----+----------------+
//
//
//  The counter type is the "or" of the following values as described below
//
//  select one of the following to indicate the counter's data size
//

  PERF_SIZE_DWORD         = $00000000;
  {$EXTERNALSYM PERF_SIZE_DWORD}
  PERF_SIZE_LARGE         = $00000100;
  {$EXTERNALSYM PERF_SIZE_LARGE}
  PERF_SIZE_ZERO          = $00000200;      // for Zero Length Fields
  {$EXTERNALSYM PERF_SIZE_ZERO}
  PERF_SIZE_VARIABLE_LEN  = $00000300;      // length is in CounterLength Fields
                                            //  of Counter Definition struct
  {$EXTERNALSYM PERF_SIZE_VARIABLE_LEN}

//
//  select one of the following values to indicate the counter field usage
//

  PERF_TYPE_NUMBER        = $00000000;      // a number (not a counter)
  {$EXTERNALSYM PERF_TYPE_NUMBER}
  PERF_TYPE_COUNTER       = $00000400;      // an increasing numeric Value
  {$EXTERNALSYM PERF_TYPE_COUNTER}
  PERF_TYPE_TEXT          = $00000800;      // a text Fields
  {$EXTERNALSYM PERF_TYPE_TEXT}
  PERF_TYPE_ZERO          = $00000C00;      // displays a zero
  {$EXTERNALSYM PERF_TYPE_ZERO}

//
//  If the PERF_TYPE_NUMBER field was selected, then select one of the
//  following to describe the Number
//

  PERF_NUMBER_HEX         = $00000000;     // display as HEX Value
  {$EXTERNALSYM PERF_NUMBER_HEX}
  PERF_NUMBER_DECIMAL     = $00010000;     // display as a decimal integer
  {$EXTERNALSYM PERF_NUMBER_DECIMAL}
  PERF_NUMBER_DEC_1000    = $00020000;     // display as a decimal/1000
  {$EXTERNALSYM PERF_NUMBER_DEC_1000}

//
//  If the PERF_TYPE_COUNTER value was selected then select one of the
//  following to indicate the type of counter
//

  PERF_COUNTER_VALUE      = $00000000;     // display counter Value
  {$EXTERNALSYM PERF_COUNTER_VALUE}
  PERF_COUNTER_RATE       = $00010000;     // divide ctr / delta time
  {$EXTERNALSYM PERF_COUNTER_RATE}
  PERF_COUNTER_FRACTION   = $00020000;     // divide ctr / base
  {$EXTERNALSYM PERF_COUNTER_FRACTION}
  PERF_COUNTER_BASE       = $00030000;     // base value used in fractions
  {$EXTERNALSYM PERF_COUNTER_BASE}
  PERF_COUNTER_ELAPSED    = $00040000;     // subtract counter from current time
  {$EXTERNALSYM PERF_COUNTER_ELAPSED}
  PERF_COUNTER_QUEUELEN   = $00050000;     // Use Queuelen processing func.
  {$EXTERNALSYM PERF_COUNTER_QUEUELEN}
  PERF_COUNTER_HISTOGRAM  = $00060000;     // Counter begins or ends a histogram
  {$EXTERNALSYM PERF_COUNTER_HISTOGRAM}
  PERF_COUNTER_PRECISION  = $00070000;     // divide ctr / private clock
  {$EXTERNALSYM PERF_COUNTER_PRECISION}

//
//  If the PERF_TYPE_TEXT value was selected, then select one of the
//  following to indicate the type of TEXT data.
//

  PERF_TEXT_UNICODE       = $00000000;     // type of text in text Fields
  {$EXTERNALSYM PERF_TEXT_UNICODE}
  PERF_TEXT_ASCII         = $00010000;     // ASCII using the CodePage Fields