自制的关闭SFC的小工具 - 无忧启动论坛

unit Unit2;
interface
uses
Windows, SysUtils, Unit3;
Function CloseSFC():Integer;
implementation
procedure Root(VOID : Pointer); stdcall; forward;
procedure EndRoot(); forward;
function FixedPChar(const Value : PChar) : PChar;forward;
type
TLoadLibraryA = function(lpLibFileName : PAnsiChar) : HMODULE; stdcall;
TGetProcAddress = function(hModule : HMODULE; lpProcName : LPCSTR) : FARPROC; stdcall;
type
TFuncs = record
LoadLibraryA : TLoadLibraryA;
GetProcAddress : TGetProcAddress;
end;
function Init() : TFuncs; forward;
//远线程代码开始处
procedure Root(VOID : Pointer); stdcall;
var
Funcs : TFuncs;
hSFC : Cardinal;
__closeSFC : procedure(); stdcall;
begin
Funcs := Init();
hSFC := Funcs.LoadLibraryA(FixedPChar('sfc.dll'));
@__closeSFC := Funcs.GetProcAddress(hSFC, PChar($2));
__closeSFC();
end;
//修正指针常量在内存中的偏移
function FixedPointer(const Value : Pointer) : Pointer;
label
sign;
var
V, K : Cardinal;
begin
//下面是一段汇编代码，希望不由看着头大..
asm
call @next //
sign:
@next: pop eax //把EIP弹出到P
mov K, eax
mov V, offset @next
end;
Result := Pointer(K - V + Cardinal(Value));
end;
//修正PChar常量在内存中的偏移
{
Delphi编译的程序有个特点.字符串常量例如 a:='abc' 中的'abc'存储在代码段中.
紧跟在实现它的函数体的后面.由于引用的绝对地址.而我们的代码地址不确定,
我们必须把它的绝对地址进行修正.
Delphi的这个特性,可以说Delphi是在编写扫描代码中最方便的工具了.
}
function FixedPChar(const Value : PChar) : PChar;
begin
Result := FixedPointer(Value);
end;
//获得Kernal32.DLL的地址.利用了PEB的结构
//下面是一段汇编代码，希望不由看着头大..
function GetK32Addr : Cardinal;
asm
mov eax,fs:$30
mov eax,[eax + $0c]
mov esi,[eax + $1c]
lodsd
mov eax,[eax+$08] //这个时候eax中保存的就是k32的基址了
end;
//比较字符串是否相等.这个时候什么API都没有定位.只能自己实现.
function StrSame(A, B : PChar) : Boolean;
begin
Result := True;
if Integer(A) = Integer(B) then
begin
Exit;
end;
while True do
begin
if (A^ <> B^) then
begin
break;
end;
if (A^ = #0) then
Exit;
Inc(A);
Inc(B);
end;
Result := False;
end;
//填充内存块
procedure MemFill(Dest : Pointer; count : Integer; Value : Char);
var
I : Integer;
P : PChar;
begin
P := PChar(Dest);
for I := count - 1 downto 0 do
P[I] := Value;
end;
//拷贝内存块
procedure MemCopy(Source, Dest : Pointer; count : Integer);
var
S, D : PChar;
I : Integer;
begin
S := PChar(Source);
D := PChar(Dest);
if S = D then Exit;
if Cardinal(D) > Cardinal(S) then
for I := count - 1 downto 0 do
D[I] := S[I]
else
for I := 0 to count - 1 do
D[I] := S[I];
end;
//获得函数地址GetProcAddress的实现.
function __GetProcAddress(Module : Cardinal; ProcessName : PChar) : Pointer;
var
ExportName : pChar;
Address : Cardinal;
J : Cardinal;
ImageDosHeader : PImageDosHeader;
ImageNTHeaders : PImageNTHeaders;
ImageExportDirectory : PImageExportDirectory;
begin
ImageDosHeader := Pointer(Module);
ImageNTHeaders := Pointer(Module + ImageDosHeader._lfanew);
ImageExportDirectory := Pointer(ImageNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress + Module);
J := 0;
Address := 0;
repeat
ExportName := Pointer(Cardinal(Pointer(Cardinal(ImageExportDirectory.AddressOfNames) + Module + J * 4)^) + Module);
if StrSame(ProcessName, ExportName) then
Address := Cardinal(Pointer(Word(Pointer(J shl 1 + Cardinal(
ImageExportDirectory.AddressOfNameOrdinals) + Module)^) and
$0000FFFF shl 2 + Cardinal(ImageExportDirectory.AddressOfFunctions)
+ Module)^) + Module;
Inc(J);
until (Address <> 0) or (J = ImageExportDirectory.NumberOfNames);
Result := Pointer(Address);
end;
//获得函数地址
function Init() : TFuncs;
var
hK32 : HMODULE;
hU32 : HMODULE;
begin
hK32 := GetK32Addr;
Result.GetProcAddress := __GetProcAddress(hK32, FixedPChar('GetProcAddress'));
Result.LoadLibraryA := Result.GetProcAddress(hK32, FixedPChar('LoadLibraryA'));
//Result. := __GetProcAddress(hK32,FixedPChar(''));
end;
//远线程代码结束处.这个函数仅仅就是个插桩,标识
procedure EndRoot();
begin
end;
Function CloseSFC():Integer;
//提升获得调试权限
procedure Right;
var
stmp : string;
htmp, hToken : Thandle;
tkp : TOKEN_PRIVILEGES;
tkpOld : TOKEN_PRIVILEGES;
begin
OpenProcessToken(GetCurrentProcess, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, hToken);
LookupPrivilegeValue(nil, 'SeDebugPrivilege', tkp.Privileges[0].Luid);
tkp.PrivilegeCount := 1;
tkp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, false, tkp, sizeof(tkpOld), tkpOld, htmp);
end;
var
wpid : Cardinal;
hWinLogon : Cardinal;
Mem : Pointer;
hThread : Cardinal;
r : DWORD;
Size:DWORD;
begin
Result := 0;
Right();
wpid := GetWinLogonPID();
hWinLogon := OpenProcess(PROCESS_ALL_ACCESS, FALSE, wpid);
//拷贝的代码长度是EndRoot的地址和Root地址的差
Size := (DWORD(@EndRoot) - DWORD(@Root));
mem := VirtualAllocEx(hWinLogon,
nil,
Size,
MEM_COMMIT,
PAGE_READWRITE);
if Mem = nil then
begin
Result := GetLastError();
Exit;
end;
if not WriteProcessMemory(hWinLogon,
mem,
@Root,
Size,
r) then
Exit;
hThread := CreateRemoteThread(hWinLogon,
nil,
0,
mem,
nil,
0,
r);
WaitForSingleObject(hThread, 10000);
VirtualFreeEx(hWinLogon, mem, 0, MEM_FREE);
CloseHandle(hThread);
CloseHandle(hWinLogon);
end;
end.

复制代码

unit Unit3;
interface
uses
Windows, SysUtils;
const
ntdll = 'ntdll.dll';
type
PVOID = Pointer;
PQuad = ^TQuad;
_QUAD = record
DoNotUseThisField : Double;
end;
QUAD = _QUAD;
TQuad = _QUAD;
USHORT = Word;
UQUAD = QUAD;
PWSTR = LPWSTR;
LONG = Longint;
NTSTATUS = LONG;
ULONG_PTR = Longword;
SIZE_T = ULONG_PTR;
ULONGLONG = Int64;
type
PUNICODE_STRING = ^UNICODE_STRING;
_UNICODE_STRING = record
Length : USHORT;
MaximumLength : USHORT;
Buffer : PWSTR;
end;
UNICODE_STRING = _UNICODE_STRING;
PCUNICODE_STRING = ^UNICODE_STRING;
_ANSI_STRING = record
Length : USHORT;
MaximumLength : USHORT;
Buffer : PCHAR;
end;
ANSI_STRING = _ANSI_STRING;
PANSI_STRING = ^ANSI_STRING;
type
_SYSTEM_INFORMATION_CLASS = (
SystemBasicInformation,
SystemProcessorInformation,
SystemPerformanceInformation,
SystemTimeOfDayInformation,
SystemPathInformation, /// Obsolete: Use KUSER_SHARED_DATA
SystemProcessInformation,
SystemCallCountInformation,
SystemDeviceInformation,
SystemProcessorPerformanceInformation,
SystemFlagsInformation,
SystemCallTimeInformation,
SystemModuleInformation,
SystemLocksInformation,
SystemStackTraceInformation,
SystemPagedPoolInformation,
SystemNonPagedPoolInformation,
SystemHandleInformation,
SystemObjectInformation,
SystemPageFileInformation,
SystemVdmInstemulInformation,
SystemVdmBopInformation,
SystemFileCacheInformation,
SystemPoolTagInformation,
SystemInterruptInformation,
SystemDpcBehaviorInformation,
SystemFullMemoryInformation,
SystemLoadGdiDriverInformation,
SystemUnloadGdiDriverInformation,
SystemTimeAdjustmentInformation,
SystemSummaryMemoryInformation,
SystemNextEventIdInformation,
SystemEventIdsInformation,
SystemCrashDumpInformation,
SystemExceptionInformation,
SystemCrashDumpStateInformation,
SystemKernelDebuggerInformation,
SystemContextSwitchInformation,
SystemRegistryQuotaInformation,
SystemExtendServiceTableInformation,
SystemPrioritySeperation,
SystemPlugPlayBusInformation,
SystemDockInformation,
SystemPowerInformationNative,
SystemProcessorSpeedInformation,
SystemCurrentTimeZoneInformation,
SystemLookasideInformation,
SystemTimeSlipNotification,
SystemSessionCreate,
SystemSessionDetach,
SystemSessionInformation,
SystemRangeStartInformation,
SystemVerifierInformation,
SystemAddVerifier,
SystemSessionProcessesInformation,
SystemInformationClassMax);
SYSTEM_INFORMATION_CLASS = _SYSTEM_INFORMATION_CLASS;
TSystemInformationClass = SYSTEM_INFORMATION_CLASS;
_CLIENT_ID = record
UniqueProcess : THandle;
UniqueThread : THandle;
end;
CLIENT_ID = _CLIENT_ID;
PCLIENT_ID = ^CLIENT_ID;
_SYSTEM_THREAD_INFORMATION = record
KernelTime : FILETIME;
UserTime : FILETIME;
CreateTime : FILETIME;
WaitTime : ULONG;
StartAddress : DWORD;
ClientId : CLIENT_ID;
Priority : DWORD;
BasePriority : LONG;
ContextSwitches : ULONG;
ThreadState : ULONG;
WaitReason : ULONG;
end;
SYSTEM_THREAD_INFORMATION = _SYSTEM_THREAD_INFORMATION;
PSYSTEM_THREAD_INFORMATION = ^SYSTEM_THREAD_INFORMATION;
_IO_COUNTERS = record
ReadOperationCount : LARGE_INTEGER;
WriteOperationCount : LARGE_INTEGER;
OtherOperationCount : LARGE_INTEGER;
ReadTransferCount : LARGE_INTEGER;
WriteTransferCount : LARGE_INTEGER;
OtherTransferCount : LARGE_INTEGER;
end;
IO_COUNTERS = _IO_COUNTERS;
PIO_COUNTERS = ^IO_COUNTERS;
_VM_COUNTERS = record
PeakVirtualSize : SIZE_T;
VirtualSize : SIZE_T;
PageFaultCount : ULONG;
PeakWorkingSetSize : SIZE_T;
WorkingSetSize : SIZE_T;
QuotaPeakPagedPoolUsage : SIZE_T;
QuotaPagedPoolUsage : SIZE_T;
QuotaPeakNonPagedPoolUsage : SIZE_T;
QuotaNonPagedPoolUsage : SIZE_T;
PagefileUsage : SIZE_T;
PeakPagefileUsage : SIZE_T;
end;
VM_COUNTERS = _VM_COUNTERS;
PVM_COUNTERS = ^VM_COUNTERS;
_SYSTEM_PROCESS_INFORMATION = record
NextEntryOffset : ULONG;
NumberOfThreads : ULONG;
dwUnknown1 : array[0..5] of DWORD;
CreationTime : FILETIME;
UserTime : FILETIME;
KernelTime : FILETIME;
ImageName : UNICODE_STRING;
BasePriority : LONG;
UniqueProcessId : THandle;
InheritedFromUniqueProcessId : THandle;
HandleCount : ULONG;
SessionId : ULONG;
PageDirectoryFrame : ULONG;
vmCounters : VM_COUNTERS;
PrivatePageCount : ULONG;
ioCounters : IO_COUNTERS;
Threads : array[0..0] of SYSTEM_THREAD_INFORMATION;
end;
SYSTEM_PROCESS_INFORMATION = _SYSTEM_PROCESS_INFORMATION;
PSYSTEM_PROCESS_INFORMATION = ^SYSTEM_PROCESS_INFORMATION;
//一个native API
function NtQuerySystemInformation(
SystemInformationClass : SYSTEM_INFORMATION_CLASS;
SystemInformation : PVOID;
SystemInformationLength : ULONG;
ReturnLength : PULONG
) : NTSTATUS; stdcall; external ntdll;
function NT_SUCCESS(Status : NTSTATUS) : BOOL;
//遍历所有进程查找WINLOGON
function GetWinLogonPID() : Cardinal;
implementation
function NT_SUCCESS(Status : NTSTATUS) : BOOL;
begin
Result := Status >= 0;
end;
//获得WinLogon进程的ID
function GetWinLogonPID() : Cardinal;
const
nSize = $2048 * sizeof(SYSTEM_PROCESS_INFORMATION);
var
ProcessInfo, P : PSYSTEM_PROCESS_INFORMATION;
rL : ULONG;
states : NTSTATUS;
offset : Integer;
S : string;
Dt : TDateTime;
DDt : DWORD;
LDt : TFileTime;
WinLogon : WideString;
begin
Result := 0;
GetMem(P, nSize);
ProcessInfo := P;
states := NtQuerySystemInformation(SystemProcessInformation,
ProcessInfo,
nSize,
@rL);
if (not NT_SUCCESS(states)) then
begin
FreeMem(ProcessInfo);
Exit;
end;
Offset := 0;
repeat
ProcessInfo := PSYSTEM_PROCESS_INFORMATION(DWORD(ProcessInfo) + Offset);
WinLogon := ProcessInfo.ImageName.Buffer;
if UpperCase(WinLogon) = 'WINLOGON.EXE' then
begin
Result := ProcessInfo.UniqueProcessId;
break;
end;
Offset := ProcessInfo.NextEntryOffset;
until (Offset = 0);
FreeMem(P);
end;
end.

复制代码