winperf.pas

面对面 木马生成器 完整代码 程序仅提供测试学习 全局钩子查找句柄截获 使用ASP收信 收信地址明文（测试而已没加密） //本软件主要是截获账号和密码 带了个简单发信

// total space.) Display as is.  Display the quotient as "%".

  PERF_RAW_FRACTION =
            PERF_SIZE_DWORD or PERF_TYPE_COUNTER or PERF_COUNTER_FRACTION or
            PERF_DISPLAY_PERCENT;
  {$EXTERNALSYM PERF_RAW_FRACTION}

  PERF_LARGE_RAW_FRACTION =
            PERF_SIZE_LARGE or PERF_TYPE_COUNTER or PERF_COUNTER_FRACTION or
            PERF_DISPLAY_PERCENT;
  {$EXTERNALSYM PERF_LARGE_RAW_FRACTION}

// Indicates the data is a base for the preceding counter which should
// not be time averaged on display (such as free space over total space.)

  PERF_RAW_BASE =
            PERF_SIZE_DWORD or PERF_TYPE_COUNTER or PERF_COUNTER_BASE or
            PERF_DISPLAY_NOSHOW or
            $00000003;  // for compatibility with pre-beta versions
  {$EXTERNALSYM PERF_RAW_BASE}

  PERF_LARGE_RAW_BASE =
            PERF_SIZE_LARGE or PERF_TYPE_COUNTER or PERF_COUNTER_BASE or
            PERF_DISPLAY_NOSHOW;
  {$EXTERNALSYM PERF_LARGE_RAW_BASE}

// The data collected in this counter is actually the start time of the
// item being measured. For display, this data is subtracted from the
// sample time to yield the elapsed time as the difference between the two.
// In the definition below, the PerfTime field of the Object contains
// the sample time as indicated by the PERF_OBJECT_TIMER bit and the
// difference is scaled by the PerfFreq of the Object to convert the time
// units into seconds.

  PERF_ELAPSED_TIME =
            PERF_SIZE_LARGE or PERF_TYPE_COUNTER or PERF_COUNTER_ELAPSED or
            PERF_OBJECT_TIMER or PERF_DISPLAY_SECONDS;
  {$EXTERNALSYM PERF_ELAPSED_TIME}

//
//  The following counter type can be used with the preceding types to
//  define a range of values to be displayed in a histogram.
//

  PERF_COUNTER_HISTOGRAM_TYPE = $80000000; // Counter begins or ends a histogram
  {$EXTERNALSYM PERF_COUNTER_HISTOGRAM_TYPE}

//
//  This counter is used to display the difference from one sample
//  to the next. The counter value is a constantly increasing number
//  and the value displayed is the difference between the current
//  value and the previous value. Negative numbers are not allowed
//  which shouldn't be a problem as long as the counter value is
//  increasing or unchanged.
//

  PERF_COUNTER_DELTA =
            PERF_SIZE_DWORD or PERF_TYPE_COUNTER or PERF_COUNTER_VALUE or
            PERF_DELTA_COUNTER or PERF_DISPLAY_NO_SUFFIX;
  {$EXTERNALSYM PERF_COUNTER_DELTA}

  PERF_COUNTER_LARGE_DELTA =
            PERF_SIZE_LARGE or PERF_TYPE_COUNTER or PERF_COUNTER_VALUE or
            PERF_DELTA_COUNTER or PERF_DISPLAY_NO_SUFFIX;
  {$EXTERNALSYM PERF_COUNTER_LARGE_DELTA}

//
//  The precision counters are timers that consist of two counter values:
//      1) the count of elapsed time of the event being monitored
//      2) the "clock" time in the same units
//
//  the precition timers are used where the standard system timers are not
//  precise enough for accurate readings. It's assumed that the service
//  providing the data is also providing a timestamp at the same time which
//  will eliminate any error that may occur since some small and variable
//  time elapses between the time the system timestamp is captured and when
//  the data is collected from the performance DLL. Only in extreme cases
//  has this been observed to be problematic.
//
//  when using this type of timer, the definition of the
//      PERF_PRECISION_TIMESTAMP counter must immediately follow the
//      definition of the PERF_PRECISION_*_TIMER in the Object header
//
// The timer used has the same frequency as the System Performance Timer

  PERF_PRECISION_SYSTEM_TIMER =
        PERF_SIZE_LARGE or PERF_TYPE_COUNTER or PERF_COUNTER_PRECISION or
        PERF_TIMER_TICK or PERF_DELTA_COUNTER or PERF_DISPLAY_PERCENT;
  {$EXTERNALSYM PERF_PRECISION_SYSTEM_TIMER}

//
// The timer used has the same frequency as the 100 NanoSecond Timer

  PERF_PRECISION_100NS_TIMER =
        PERF_SIZE_LARGE or PERF_TYPE_COUNTER or PERF_COUNTER_PRECISION or
        PERF_TIMER_100NS or PERF_DELTA_COUNTER or PERF_DISPLAY_PERCENT;
  {$EXTERNALSYM PERF_PRECISION_100NS_TIMER}

//
// The timer used is of the frequency specified in the Object header's
//  PerfFreq field (PerfTime is ignored)

  PERF_PRECISION_OBJECT_TIMER =
        PERF_SIZE_LARGE or PERF_TYPE_COUNTER or PERF_COUNTER_PRECISION or
        PERF_OBJECT_TIMER or PERF_DELTA_COUNTER or PERF_DISPLAY_PERCENT;
  {$EXTERNALSYM PERF_PRECISION_OBJECT_TIMER}

//
// This is the timestamp to use in the computation of the timer specified
// in the previous description block

  PERF_PRECISION_TIMESTAMP = PERF_LARGE_RAW_BASE;
  {$EXTERNALSYM PERF_PRECISION_TIMESTAMP}

//
//  The following are used to determine the level of detail associated
//  with the counter.  The user will be setting the level of detail
//  that should be displayed at any given time.
//
//

  PERF_DETAIL_NOVICE         = 100; // The uninformed can understand it
  {$EXTERNALSYM PERF_DETAIL_NOVICE}
  PERF_DETAIL_ADVANCED       = 200; // For the advanced user
  {$EXTERNALSYM PERF_DETAIL_ADVANCED}
  PERF_DETAIL_EXPERT         = 300; // For the expert user
  {$EXTERNALSYM PERF_DETAIL_EXPERT}
  PERF_DETAIL_WIZARD         = 400; // For the system designer
  {$EXTERNALSYM PERF_DETAIL_WIZARD}

//
//
//  There is one of the following for each of the
//  PERF_OBJECT_TYPE.NumCounters.  The Unicode names in this structure MUST
//  come from a message file.
//
//

type
  PPerfCounterDefinition = ^TPerfCounterDefinition;
  _PERF_COUNTER_DEFINITION = record
    ByteLength: DWORD;                  // Length in bytes of this structure
    CounterNameTitleIndex: DWORD;       // Index of Counter name into
                                        // Title Database
    CounterNameTitle: LPWSTR;           // Initially NULL, for use by
                                        // analysis program to point to
                                        // retrieved title string
    CounterHelpTitleIndex: DWORD;       // Index of Counter Help into
                                        // Title Database
    CounterHelpTitle: LPWSTR;           // Initially NULL, for use by
                                        // analysis program to point to
                                        // retrieved title string
    DefaultScale: LONG;                 // Power of 10 by which to scale
                                        // chart line if vertical axis is 100
                                        // 0 ==> 1, 1 ==> 10, -1 ==>1/10, etc.
    DetailLevel: DWORD;                 // Counter level of detail (for
                                        // controlling display complexity)
    CounterType: DWORD;                 // Type of counter
    CounterSize: DWORD;                 // Size of counter in bytes
    CounterOffset: DWORD;               // Offset from the start of the
                                        // PERF_COUNTER_BLOCK to the first
                                        // byte of this counter
  end;
  {$EXTERNALSYM _PERF_COUNTER_DEFINITION}
  PERF_COUNTER_DEFINITION = _PERF_COUNTER_DEFINITION;
  {$EXTERNALSYM PERF_COUNTER_DEFINITION}
  PPERF_COUNTER_DEFINITION = ^PERF_COUNTER_DEFINITION;
  {$EXTERNALSYM PPERF_COUNTER_DEFINITION}
  TPerfCounterDefinition = _PERF_COUNTER_DEFINITION;

//
//
//  If (PERF_DATA_BLOCK.NumInstances >= 0) then there will be
//  PERF_DATA_BLOCK.NumInstances of a (PERF_INSTANCE_DEFINITION
//  followed by a PERF_COUNTER_BLOCK followed by the counter data fields)
//  for each instance.
//
//  If (PERF_DATA_BLOCK.NumInstances < 0) then the counter definition
//  strucutre above will be followed by only a PERF_COUNTER_BLOCK and the
//  counter data for that COUNTER.
//

const
  PERF_NO_UNIQUE_ID = -1;
  {$EXTERNALSYM PERF_NO_UNIQUE_ID}

type
  PPerfInstanceDefinition = ^TPerfInstanceDefinition;
  _PERF_INSTANCE_DEFINITION = record
    ByteLength: DWORD;                  // Length in bytes of this structure,
                                        // including the subsequent name
    ParentObjectTitleIndex: DWORD;      // Title Index to name of "parent"
                                        // object (e.g., if thread, then
                                        // process is parent object type);
                                        // if logical drive, the physical
                                        // drive is parent object type
    ParentObjectInstance: DWORD;        // Index to instance of parent object
                                        // type which is the parent of this
                                        // instance.
    UniqueID: LONG;                     // A unique ID used instead of
                                        // matching the name to identify
                                        // this instance, -1 = none
    NameOffset: DWORD;                  // Offset from beginning of
                                        // this struct to the Unicode name
                                        // of this instance
    NameLength: DWORD;                  // Length in bytes of name; 0 = none
                                        // this length includes the characters
                                        // in the string plus the size of the
                                        // terminating NULL char. It does not
                                        // include any additional pad bytes to
                                        // correct structure alignment
  end;
  {$EXTERNALSYM _PERF_INSTANCE_DEFINITION}
  PERF_INSTANCE_DEFINITION = _PERF_INSTANCE_DEFINITION;
  {$EXTERNALSYM PERF_INSTANCE_DEFINITION}
  PPERF_INSTANCE_DEFINITION = ^PERF_INSTANCE_DEFINITION;
  {$EXTERNALSYM PPERF_INSTANCE_DEFINITION}
  TPerfInstanceDefinition = _PERF_INSTANCE_DEFINITION;

//
//  If .ParentObjectName is 0, there
//  is no parent-child hierarchy for this object type.  Otherwise,
//   the .ParentObjectInstance is an index, starting at 0, into the
//  instances reported for the parent object type.  It is only
//  meaningful if .ParentObjectName is not 0.  The purpose of all this
//  is to permit reporting/summation of object instances like threads
//  within processes, and logical drives within physical drives.
//
//
//  The PERF_INSTANCE_DEFINITION will be followed by a PERF_COUNTER_BLOCK.
//

  PPerfCounterBlock = ^TPerfCounterBlock;
  _PERF_COUNTER_BLOCK = record
    ByteLength: DWORD;                  // Length in bytes of this structure,
                                        // including the following counters
  end;
  {$EXTERNALSYM _PERF_COUNTER_BLOCK}
  PERF_COUNTER_BLOCK = _PERF_COUNTER_BLOCK;
  {$EXTERNALSYM PERF_COUNTER_BLOCK}
  PPERF_COUNTER_BLOCK = ^PERF_COUNTER_BLOCK;
  {$EXTERNALSYM PPERF_COUNTER_BLOCK}
  TPerfCounterBlock = _PERF_COUNTER_BLOCK;

//
//  The PERF_COUNTER_BLOCK is followed by PERF_OBJECT_TYPE.NumCounters
//  number of counters.
//

//
// Support for New Extensible API starting with NT 5.0
//

const
  PERF_QUERY_OBJECTS = DWORD($80000000);
  {$EXTERNALSYM PERF_QUERY_OBJECTS}
  PERF_QUERY_GLOBAL  = DWORD($80000001);
  {$EXTERNALSYM PERF_QUERY_GLOBAL}
  PERF_QUERY_COSTLY  = DWORD($80000002);
  {$EXTERNALSYM PERF_QUERY_COSTLY}

//
//  function typedefs for extensible counter function prototypes
//

type
  PM_OPEN_PROC = function (Arg1: LPWSTR): DWORD; stdcall;
  {$EXTERNALSYM PM_OPEN_PROC}
  PM_COLLECT_PROC = function (Arg1: LPWSTR; Arg2: Pointer; Arg3, Arg4: LPDWORD): DWORD; stdcall;
  {$EXTERNALSYM PM_COLLECT_PROC}
  PM_CLOSE_PROC = function: DWORD; stdcall;
  {$EXTERNALSYM PM_CLOSE_PROC}
  PM_QUERY_PROC = function (Arg1: LPDWORD; Arg2: Pointer; Arg3, Arg4: LPDWORD): DWORD; stdcall;
  {$EXTERNALSYM PM_QUERY_PROC}

const
  MAX_PERF_OBJECTS_IN_QUERY_FUNCTION = LONG(8);
  {$EXTERNALSYM MAX_PERF_OBJECTS_IN_QUERY_FUNCTION}

implementation

end.