NT:| Код | uses tlhelp32, AccCtrl, AclAPI;
const
THREAD_TERMINATE =$0001;
THREAD_SUSPEND_RESUME =$0002;
THREAD_GET_CONTEXT =$0008;
THREAD_SET_CONTEXT =$0010;
THREAD_SET_INFORMATION =$0020;
THREAD_QUERY_INFORMATION =$0040;
THREAD_SET_THREAD_TOKEN =$0080;
THREAD_IMPERSONATE =$0100;
THREAD_DIRECT_IMPERSONATION =$0200;
THREAD_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED or SYNCHRONIZE or $3FF; // == $1F03FF;
function GetProcess32_ThreadID():TList;
var H:THandle;
Thread32:TThreadEntry32;
ThrID:PDWord;
IgnorePrID:DWord;
begin
IgnorePrID:=GetCurrentProcessID();
Result:=TList.Create;
H:=CreateToolHelp32Snapshot(TH32CS_SNAPTHREAD,0);
if H<>INVALID_HANDLE_VALUE then
begin
Thread32.dwSize:=SizeOf(TThreadEntry32);
if Thread32First(H,Thread32) then
repeat
if (Thread32.th32OwnerProcessID<>IgnorePrID) then
begin
New(ThrID);
ThrID^:=Thread32.th32ThreadID;
Result.Add(ThrID);
end;
until (Thread32Next(H,Thread32)=false);
CloseHandle(H);
end;
if Result.Count=0 then
begin
Result.Free;
Result:=nil;
end;
end;
function OpenThread(dwDesiredAccess:DWord;bInheritHandle:Bool;dwThreadId:DWord):Cardinal;
//Функция получения дескриптора потока по его идентификатору для Win 9X,ME,WinNT All
//dwDesiredAccess - флаги доступа к потоку
//bInheritHandle - флаг наследования дескриптора
//dwThreadId - идентификатор потока
//Выходные данные - дескриптор потока. При не удаче равен 0.
type
TClient_ID=record
pID:DWord;
tID:DWord;
end;
TObjectAttributes=record
dwSize:DWord;
Attr:array [0..4] of DWord;
end;
TotWinMe=function(dwDesiredAccess:DWord;bInheritHandle:Bool;dwThreadId:DWord):DWord; stdcall;
TotWinNT=function(out ThreadHandle:DWord;dwDesiredAccess:DWord;var ObjectAttributes:TObjectAttributes;var Client_ID:TClient_ID):DWord; stdcall;
var Kernel32,NTDLL:Cardinal;
ErrOld:Cardinal;
oProcess:Pointer;
oThread:TotWinMe;
NT_oThread:TotWinNT;
pID:Cardinal;
ObjectAttributes:^TObjectAttributes;
Client_ID:TClient_ID;
begin
Result:=0;
pID:=GetCurrentProcessId();
ErrOld:=SetErrorMode(SEM_NOOPENFILEERRORBOX);
Kernel32:=LoadLibrary('Kernel32.dll');
if (Kernel32<>0) then
begin
NTDLL:=LoadLibrary('ntdll.dll');
if (NTDLL<>0) then
begin
NT_oThread:=GetProcAddress(NTDLL,'NtOpenThread');
if assigned(NT_oThread) then
begin
ObjectAttributes:=VirtualAlloc(nil,SizeOf(TObjectAttributes),MEM_COMMIT,PAGE_EXECUTE_READWRITE);
if (ObjectAttributes<>nil) then
begin
FillChar(ObjectAttributes^,SizeOf(TObjectAttributes),#0);
ObjectAttributes^.dwSize:=SizeOf(TObjectAttributes);
if DWord(bInheritHandle)<>0 then ObjectAttributes^.Attr[2]:=$2;
Client_ID.pID:=0;
Client_ID.tID:=dwThreadId;
NT_oThread(Result,dwDesiredAccess,ObjectAttributes^,Client_ID);
VirtualFree(ObjectAttributes,0,MEM_RELEASE);
end;
end;
FreeLibrary(NTDLL);
end;
oThread:=GetProcAddress(Kernel32,'OpenThread');
if (Result=0)and(assigned(oThread)) then
Result:=oThread(dwDesiredAccess,bInheritHandle,dwThreadId);
oProcess:=GetProcAddress(Kernel32,'OpenProcess');
if (Result=0)and(oProcess<>nil) then
begin
asm
pushfd
pushad
mov ebx,pID
xor ebx,fs:[30h]
xor ebx,dwThreadId
mov eax,oProcess
lea edi,[eax+24h]
mov eax,[edi]
cmp eax,0b9h
jnz @Error_W9X
mov oThread,edi
lea esi,[ebx+2]
push 2
push esi
call IsBadWritePtr
or eax,eax
jnz @Error_W9X
mov ecx,oThread
xchg eax,ebx
push dwThreadId
push bInheritHandle
push dwDesiredAccess
call ecx
mov Result,eax
@Error_W9X:
popad
popfd
end;
end;
FreeLibrary(Kernel32);
end;
SetErrorMode(ErrOld);
end;
procedure TForm1.Button1Click(Sender: TObject);
var Thread_ListID:TList;
i:integer;
ot:DWord;
ThrID:PDWord;
begin
Thread_ListID:=GetProcess32_ThreadID();
if Thread_ListID<>nil then
begin
for i:=0 to Thread_ListID.Count-1 do
begin
ThrID:=Thread_ListID.Items[i];
if ThrID<>nil then
begin
ot:=OpenThread(Write_DAC,false,ThrID^);
if ot<>0 then
begin
SetSecurityInfo(ot,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,nil,nil,nil,nil);
CloseHandle(ot);
end;
ot:=OpenThread(THREAD_SUSPEND_RESUME,false,ThrID^);
if ot<>0 then
begin
SuspendThread(ot);
CloseHandle(ot);
end;
end;
end;
Sleep(5000); //Глушим все... на 5 секунд.
for i:=0 to Thread_ListID.Count-1 do
begin
ThrID:=Thread_ListID.Items[i];
if ThrID<>nil then
begin
ot:=OpenThread(THREAD_SUSPEND_RESUME,false,ThrID^);
if ot<>0 then
begin
ResumeThread(ot);
CloseHandle(ot);
end;
end;
end;
Thread_ListID.Free;
end;
end; |
PS: Лень... было только ACL потоков востанавливать... 
PS2: |