1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
| library hook;
uses
windows,
sysutils,
uallDisasm,
uallDisasmEx,
uallHook,
uallKernel,
uallProcess,
uallProtect,
uallUtil,
uallTableHook,
uallRelocHook,
JwaWinNt,
JwaWinType,
JwaNtStatus,
PsApi,
TlHelp32,
classes;
var
oldNtCreateProcess, NextNtCreateProcess: function(ProcessHandle: PHANDLE;
DesiredAccess: ACCESS_MASK;
ObjectAttributes: POBJECT_ATTRIBUTES;
InheritFromProcessHandle: HANDLE;
InheritHandles: ByteBool;
SectionHandle: HANDLE;
DebutPort: HANDLE;
ExceptionPort: HANDLE): NTSTATUS; stdcall;
oldNtCreateProcessEx, NextNtCreateProcessEx: function(ProcessHandle: PHANDLE;
DesiredAccess: ACCESS_MASK;
ObjectAttributes: POBJECT_ATTRIBUTES;
InheritFromProcessHandle: HANDLE;
InheritHandles: ByteBool;
SectionHandle: HANDLE;
DebutPort: HANDLE;
ExceptionPort: HANDLE): NTSTATUS; stdcall;
function myNtCreateProcess(ProcessHandle: PHANDLE;
DesiredAccess: ACCESS_MASK;
ObjectAttributes: Pointer;
InheritFromProcessHandle: Cardinal;
InheritHandles: ByteBool;
SectionHandle: Cardinal;
DebutPort: Cardinal;
ExceptionPort: Cardinal): Cardinal; stdcall;
begin
MessageBox(0, 'ntcreate', 'hallo', MB_ICONINFORMATION);
result := NextNtCreateProcess(ProcessHandle,
DesiredAccess,
ObjectAttributes,
InheritFromProcessHandle,
InheritHandles,
SectionHandle,
DebutPort,
ExceptionPort);
end;
function myNtCreateProcessEx(ProcessHandle: PHANDLE;
DesiredAccess: ACCESS_MASK;
const ObjectAttributes: POBJECT_ATTRIBUTES;
InheritFromProcessHandle: HANDLE;
InheritHandles: ByteBool;
SectionHandle: HANDLE;
DebutPort: HANDLE;
ExceptionPort: HANDLE): NTSTATUS; stdcall;
const STATUS_ACCESS_DENIED = $C0000022;
begin
MessageBox(0, 'ntcreateex', PCHAR(ProcessHandle), MB_ICONINFORMATION);
result := NextNtCreateProcessEx(ProcessHandle,
DesiredAccess,
ObjectAttributes,
InheritFromProcessHandle,
InheritHandles,
SectionHandle,
DebutPort,
ExceptionPort);
end;
procedure injectmain;
var mynt: integer;
begin
mynt := GetModuleHandle('ntdll.dll');
if my > 0 then
begin
@oldNtCreateProcess := GetProcAddress(mynt,'NtCreateProcess');
if @oldNtCreateProcess <> nil then
uallHook.HookCode(@oldNtCreateProcess,@myNtCreateProcess,@nextNtCreateProcess);
@oldNtCreateProcessEx := GetProcAddress(mynt,'NtCreateProcessEx');
if @oldNtCreateProcessEx <> nil then
uallHook.HookCode(@oldNtCreateProcessEx,@myNtCreateProcessEx,@nextNtCreateProcessEx);
end;
end;
procedure uninjectmain;
begin
uallHook.UnhookCode(@nextNtCreateProcess);
uallHook.UnhookCode(@nextNtCreateProcessEx);
end;
procedure dllmain(dwReason: integer);
begin
case dwreason of
DLL_PROCESS_ATTACH:
injectmain;
DLL_PROCESS_DETACH:
uninjectmain;
end;
end;
begin
DLLProc := @DLLMain;
DLLMain(1);
end. |
Gausi
