unit1.dfm

一个经典的Delphi远程注入

object Form3: TForm3
  Left = 0
  Top = 0
  BorderStyle = bsDialog
  Caption = 'DLL'#27880#20837#20363#31243
  ClientHeight = 299
  ClientWidth = 463
  Color = clBtnFace
  Font.Charset = DEFAULT_CHARSET
  Font.Color = clWindowText
  Font.Height = -11
  Font.Name = 'Tahoma'
  Font.Style = []
  OldCreateOrder = False
  Position = poDesktopCenter
  PixelsPerInch = 96
  TextHeight = 13
  object Label1: TLabel
    Left = 8
    Top = 243
    Width = 60
    Height = 13
    Caption = #30446#26631#36827#31243#65306
  end
  object Button1: TButton
    Left = 129
    Top = 267
    Width = 161
    Height = 25
    Caption = #27880#20837'DLL'#21040#36827#31243#20013
    TabOrder = 0
    OnClick = Button1Click
  end
  object Button2: TButton
    Left = 296
    Top = 267
    Width = 160
    Height = 25
    Caption = #21462#28040#27880#20837
    TabOrder = 1
    OnClick = Button2Click
  end
  object Memo1: TMemo
    Left = 8
    Top = 8
    Width = 447
    Height = 218
    Font.Charset = ANSI_CHARSET
    Font.Color = clWindowText
    Font.Height = -14
    Font.Name = #23435#20307
    Font.Style = []
    Lines.Strings = (
      #36828#31243#27880#20837'DLL'#26041#27861#26377#24456#22810#31181#65292#20063#26159#24456#22810#26408#39532#30149#27602#25152#20351#29992#30340#38544#34255#36827#31243#30340
      #26041#27861#65292#22240#20026#36890#36807#31243#24207#21152#36733#30340'DLL'#22312#36827#31243#31649#29702#22120#26159#27809#26377#26174#31034#30340#65294#36825#37324#20171
      #32461#19968#31181#29992' CreateRemoteThread '#36828#31243#24314#31435#32447#31243#30340#26041#24335#27880#20837'DLL'#65294
      ''
      #39318#20808#65292#25105#20204#35201#25552#21319#33258#24049#30340#26435#38480#65292#22240#20026#36828#31243#27880#20837#24517#19981#21487#20813#30340#35201#35775#38382#21040#30446
      #26631#36827#31243#30340#20869#23384#31354#38388#65292#22914#26524#27809#26377#36275#22815#30340#31995#32479#26435#38480#65292#23558#26080#27861#20316#20219#20309#20107#65294#19979
      #38754#26159#36825#20010#20989#25968#26159#29992#26469#25552#21319#25105#20204#24819#35201#30340#26435#38480#29992#30340#65294
      ''
      'function EnableDebugPriv : Boolean;'
      'var'
      '  hToken : THANDLE;'
      '  tp : TTokenPrivileges;'
      '  rl : Cardinal;'
      'begin'
      '  result := false;'
      ''
      '  //'#25171#24320#36827#31243#20196#29260#29615
      '  OpenProcessToken(GetCurrentProcess(), '
      'TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, hToken);'
      ''
      '  //'#33719#24471#36827#31243#26412#22320#21807#19968'ID'
      '  if LookupPrivilegeValue(nil, '#39'SeDebugPrivilege'#39', '
      'tp.Privileges[0].Luid) then'
      '  begin'
      '    tp.PrivilegeCount := 1;'
      '    tp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;'
      '    //'#35843#25972#26435#38480
      '    result := AdjustTokenPrivileges(hToken, False, tp, '
      'sizeof(tp), nil, rl);'
      '  end;'
      'end;'
      ''
      #20851#20110' OpenProcessToken() '#21644' AdjustTokenPrivileges() '#20004#20010' API '
      #30340#31616#21333#20171#32461#65306
      ''
      'OpenProcessToken()'#65306#33719#24471#36827#31243#35775#38382#20196#29260#30340#21477#26564#65294
      '  function OpenProcessToken('
      '    ProcessHandle: THandle; //'#35201#20462#25913#35775#38382#26435#38480#30340#36827#31243#21477#26564
      '    DesiredAccess: DWORD; //'#25351#23450#20320#35201#36827#34892#30340#25805#20316#31867#22411
      '    var TokenHandle: THandle'
      '  ): BOOL; //'#36820#22238#30340#35775#38382#20196#29260#25351#38024
      ''
      'AdjustTokenPrivileges() '#65306#35843#25972#36827#31243#30340#26435#38480#65294
      '  function AdjustTokenPrivileges('
      '    TokenHandle: THandle;  // '#35775#38382#20196#29260#30340#21477#26564
      '    DisableAllPrivileges: BOOL; // '#20915#23450#26159#36827#34892#26435#38480#20462#25913#36824#26159#38500
      #33021#65288'Disable'#65289#25152#26377#26435#38480
      '    const NewState: TTokenPrivileges;  // '#25351#26126#35201#20462#25913#30340#26435#38480','
      #26159#19968#20010#25351#21521'TOKEN_PRIVILEGES'#32467#26500#30340#25351#38024#65292#35813#32467#26500#21253#21547#19968#20010#25968#32452#65292#25968
      #25454#32452#30340#27599#20010#39033#25351#26126#20102#26435#38480#30340#31867#22411#21644#35201#36827#34892#30340#25805#20316';'
      '    BufferLength: DWORD;  //'#32467#26500'PreviousState'#30340#38271#24230','#22914#26524
      'PreviousState'#20026#31354#65292#35813#21442#25968#24212#20026' 0'
      '    var PreviousState: TTokenPrivileges; // '#25351#21521
      'TOKEN_PRIVILEGES'#32467#26500#30340#25351#38024#65292#23384#25918#20462#25913#21069#30340#35775#38382#26435#38480#30340#20449#24687
      '    var ReturnLength: DWORD //'#23454#38469'PreviousState'#32467#26500#36820#22238#30340#22823
      #23567
      '  ) : BOOL;'
      ''
      #36828#31243#27880#20837'DLL'#20854#23454#26159#36890#36807' CreateRemoteThread '#24314#31435#19968#20010#36828#31243#32447#31243#35843
      #29992' LoadLibrary '#20989#25968#26469#21152#36733#25105#20204#25351#23450#30340'DLL'#65292#21487#26159#22914#20309#33021#35753#36828#31243#32447#31243
      #30693#36947#25105#35201#21152#36733'DLL'#21602#65292#35201#30693#36947#22312'Win32'#31995#32479#19979#65292#27599#20010#36827#31243#37117#25317#26377#33258#24049#30340
      '4G'#34394#25311#22320#22336#31354#38388#65292#21508#20010#36827#31243#20043#38388#37117#26159#30456#20114#29420#31435#30340#12290#25152#25105#20204#38656#35201#22312#36828#31243
      #36827#31243#30340#20869#23384#31354#38388#37324#30003#35831#19968#22359#20869#23384#31354#38388#65292#20889#20837#25105#20204#30340#38656#35201#27880#20837#30340' DLL '
      #30340#36335#24452#65294' '#38656#35201#29992#21040#30340' API '#20989#25968#26377#65306
      ''
      'OpenProcess()'#65306#25171#24320#30446#26631#36827#31243#65292#24471#21040#30446#26631#36827#31243#30340#25805#20316#26435#38480#65292#35814#32454#21442
      #30475'MSDN'
      '  function OpenProcess('
      '    dwDesiredAccess: DWORD;  // '#24076#26395#33719#24471#30340#35775#38382#26435#38480
      '    bInheritHandle: BOOL;  // '#25351#26126#26159#21542#24076#26395#25152#33719#24471#30340#21477#26564#21487#20197#32487
      #25215
      '    dwProcessId: DWORD // '#35201#35775#38382#30340#36827#31243'ID'
      '  ): THandle; '
      ''
      'VirtualAllocEx()'#65306#29992#20110#22312#30446#26631#36827#31243#20869#23384#31354#38388#20013#30003#35831#20869#23384#31354#38388#20197#20889#20837
      'DLL'#30340#25991#20214#21517
      '  function VirtualAllocEx('
      '    hProcess: THandle;  // '#30003#35831#20869#23384#25152#22312#30340#36827#31243#21477#26564
      '    lpAddress: Pointer;  // '#20445#30041#39029#38754#30340#20869#23384#22320#22336#65307#19968#33324#29992'nil'#33258
      #21160#20998#37197
      '    dwSize,  // '#27442#20998#37197#30340#20869#23384#22823#23567#65292#23383#33410#21333#20301#65307#27880#24847#23454#38469#20998' '#37197#30340
      #20869#23384#22823#23567#26159#39029#20869#23384#22823#23567#30340#25972#25968#20493
      '    flAllocationType: DWORD; '
      '    flProtect: DWORD'
      '  ): Pointer; '
      ''
      'WriteProcessMemory()'#65306#24448#30003#35831#21040#30340#31354#38388#20013#20889#20837'DLL'#30340#25991#20214#21517
      '  function WriteProcessMemory('
      '    hProcess: THandle;  //'#35201#20889#20837#20869#23384#25968#25454#30340#30446#26631#36827#31243#21477#26564
      '    const lpBaseAddress: Pointer; //'#35201#20889#20837#30340#30446#26631#36827#31243#30340#20869#23384#25351
      #38024', '#38656#20197' VirtualAllocEx() '#26469#30003#35831
      '    lpBuffer: Pointer; //'#35201#20889#20837#30340#25968#25454
      '    nSize: DWORD; //'#20889#20837#25968#25454#30340#22823#23567
      '    var lpNumberOfBytesWritten: DWORD //'#23454#38469#20889#20837#30340#22823#23567
      '  ): BOOL; '
      ''
      #28982#21518#23601#21487#20197#35843#29992' CreateRemoteThread '#24314#31435#36828#31243#32447#31243#35843#29992' '
      'LoadLibrary '#20989#25968#26469#21152#36733#25105#20204#25351#23450#30340'DLL'#65294
      ''
      'CreateRemoteThread()'#12288'//'#22312#19968#20010#36828#31243#36827#31243#20013#24314#31435#32447#31243
      '  function CreateRemoteThread('
      '    hProcess: THandle;  //'#36828#31243#36827#31243#30340#21477#26564
      '    lpThreadAttributes: Pointer; //'#32447#31243#23433#20840#25551#36848#23383#65292#25351#21521
      'SECURITY_ATTRIBUTES'#32467#26500#30340#25351#38024
      '    dwStackSize: DWORD;  //'#32447#31243#26632#22823#23567#65292#20197#23383#33410#34920#31034
      '    lpStartAddress: TFNThreadStartRoutine;  // '#19968#20010
      'TFNThreadStartRoutine'#31867#22411#30340#25351#38024#65292#25351#21521#22312#36828#31243#36827#31243#20013#25191#34892#30340#20989#25968
      #22320#22336
      '    lpParameter: Pointer; //'#20256#20837#21442#25968#30340#25351#38024
      '    dwCreationFlags: DWORD;  //'#21019#24314#32447#31243#30340#20854#23427#26631#24535
      '    var lpThreadId: DWORD //'#32447#31243#36523#20221#26631#24535#65292#22914#26524#20026'0, '#21017#19981#36820#22238
      '  ): THandle; '
      ''
      #25972#20010#36828#31243#27880#20837'DLL'#30340#20855#20307#23454#29616#20195#30721#22914#19979#65306
      ''
      'function InjectDll(const DllFullPath : string; const '
      'dwRemoteProcessId : Cardinal): boolean;'
      'var'
      '  hRemoteProcess, hRemoteThread: THANDLE;'
      '  pszLibFileRemote : Pointer;'