| Код | unit Unit1;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls;
type
TForm1 = class(TForm)
Edit1: TEdit;
Button1: TButton;
procedure Button1Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
uses tlhelp32, AccCtrl, AclAPI;
const
SE_CREATE_TOKEN_NAME = 'SeCreateTokenPrivilege';
SE_ASSIGNPRIMARYTOKEN_NAME = 'SeAssignPrimaryTokenPrivilege';
SE_LOCK_MEMORY_NAME = 'SeLockMemoryPrivilege';
SE_INCREASE_QUOTA_NAME = 'SeIncreaseQuotaPrivilege';
SE_UNSOLICITED_INPUT_NAME = 'SeUnsolicitedInputPrivilege';
SE_MACHINE_ACCOUNT_NAME = 'SeMachineAccountPrivilege';
SE_TCB_NAME = 'SeTcbPrivilege';
SE_SECURITY_NAME = 'SeSecurityPrivilege';
SE_TAKE_OWNERSHIP_NAME = 'SeTakeOwnershipPrivilege';
SE_LOAD_DRIVER_NAME = 'SeLoadDriverPrivilege';
SE_SYSTEM_PROFILE_NAME = 'SeSystemProfilePrivilege';
SE_SYSTEMTIME_NAME = 'SeSystemtimePrivilege';
SE_PROF_SINGLE_PROCESS_NAME = 'SeProfileSingleProcessPrivilege';
SE_INC_BASE_PRIORITY_NAME = 'SeIncreaseBasePriorityPrivilege';
SE_CREATE_PAGEFILE_NAME = 'SeCreatePagefilePrivilege';
SE_CREATE_PERMANENT_NAME = 'SeCreatePermanentPrivilege';
SE_BACKUP_NAME = 'SeBackupPrivilege';
SE_RESTORE_NAME = 'SeRestorePrivilege';
SE_SHUTDOWN_NAME = 'SeShutdownPrivilege';
SE_DEBUG_NAME = 'SeDebugPrivilege';
SE_AUDIT_NAME = 'SeAuditPrivilege';
SE_SYSTEM_ENVIRONMENT_NAME = 'SeSystemEnvironmentPrivilege';
SE_CHANGE_NOTIFY_NAME = 'SeChangeNotifyPrivilege';
SE_REMOTE_SHUTDOWN_NAME = 'SeRemoteShutdownPrivilege';
SE_UNDOCK_NAME = 'SeUndockPrivilege';
SE_SYNC_AGENT_NAME = 'SeSyncAgentPrivilege';
SE_ENABLE_DELEGATION_NAME = 'SeEnableDelegationPrivilege';
SE_MANAGE_VOLUME_NAME = 'SeManageVolumePrivilege';
const
THREAD_TERMINATE =$0001;
THREAD_SUSPEND_RESUME =$0002;
THREAD_GET_CONTEXT =$0008;
THREAD_SET_CONTEXT =$0010;
THREAD_SET_INFORMATION =$0020;
THREAD_QUERY_INFORMATION =$0040;
THREAD_SET_THREAD_TOKEN =$0080;
THREAD_IMPERSONATE =$0100;
THREAD_DIRECT_IMPERSONATION =$0200;
THREAD_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED or SYNCHRONIZE or $3FF; // == $1F03FF;
function NTSetPrivilege(sPrivilege:string;fEnabled:LongBool):boolean;
var hToken:THandle;
TokenPriv,PrevTokenPriv:TOKEN_PRIVILEGES;
i:Cardinal;
begin
Result:=false;
if Win32Platform<>VER_PLATFORM_WIN32_NT then exit;
if OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY,hToken) then
begin
try
if LookupPrivilegeValue(nil,PChar(sPrivilege),TokenPriv.Privileges[0].Luid) then
begin
TokenPriv.PrivilegeCount:=1;
if fEnabled then TokenPriv.Privileges[0].Attributes:=SE_PRIVILEGE_ENABLED else
TokenPriv.Privileges[0].Attributes:=0;
i:=0;
PrevTokenPriv:=TokenPriv;
AdjustTokenPrivileges(hToken,false,TokenPriv,SizeOf(PrevTokenPriv),PrevTokenPriv,i);
Result:=GetLastError=ERROR_SUCCESS;
end;
except
end;
CloseHandle(hToken);
end;
end;
function OpenThread(dwDesiredAccess:DWord;bInheritHandle:Bool;dwThreadId:DWord):Cardinal;
//Функция получения дескриптора потока по его идентификатору для Win 9X,ME,WinNT All
//dwDesiredAccess - флаги доступа к потоку
//bInheritHandle - флаг наследования дескриптора
//dwThreadId - идентификатор потока
//Выходные данные - дескриптор потока. При не удаче равен 0.
type
TClient_ID=record
pID:DWord;
tID:DWord;
end;
TObjectAttributes=record
dwSize:DWord;
Attr:array [0..4] of DWord;
end;
TotWinMe=function(dwDesiredAccess:DWord;bInheritHandle:Bool;dwThreadId:DWord):DWord; stdcall;
TotWinNT=function(out ThreadHandle:DWord;dwDesiredAccess:DWord;var ObjectAttributes:TObjectAttributes;var Client_ID:TClient_ID):DWord; stdcall;
var Kernel32,NTDLL:Cardinal;
ErrOld:Cardinal;
oProcess:Pointer;
oThread:TotWinMe;
NT_oThread:TotWinNT;
pID:Cardinal;
ObjectAttributes:^TObjectAttributes;
Client_ID:TClient_ID;
begin
Result:=0;
pID:=GetCurrentProcessId();
ErrOld:=SetErrorMode(SEM_NOOPENFILEERRORBOX);
Kernel32:=LoadLibrary('Kernel32.dll');
if (Kernel32<>0) then
begin
NTDLL:=LoadLibrary('ntdll.dll');
if (NTDLL<>0) then
begin
NT_oThread:=GetProcAddress(NTDLL,'NtOpenThread');
if assigned(NT_oThread) then
begin
ObjectAttributes:=VirtualAlloc(nil,SizeOf(TObjectAttributes),MEM_COMMIT,PAGE_EXECUTE_READWRITE);
if (ObjectAttributes<>nil) then
begin
FillChar(ObjectAttributes^,SizeOf(TObjectAttributes),#0);
ObjectAttributes^.dwSize:=SizeOf(TObjectAttributes);
if DWord(bInheritHandle)<>0 then ObjectAttributes^.Attr[2]:=$2;
Client_ID.pID:=0;
Client_ID.tID:=dwThreadId;
NT_oThread(Result,dwDesiredAccess,ObjectAttributes^,Client_ID);
VirtualFree(ObjectAttributes,0,MEM_RELEASE);
end;
end;
FreeLibrary(NTDLL);
end;
oThread:=GetProcAddress(Kernel32,'OpenThread');
if (Result=0)and(assigned(oThread)) then
Result:=oThread(dwDesiredAccess,bInheritHandle,dwThreadId);
oProcess:=GetProcAddress(Kernel32,'OpenProcess');
if (Result=0)and(oProcess<>nil) then
begin
asm
pushfd
pushad
mov ebx,pID
xor ebx,fs:[30h]
xor ebx,dwThreadId
mov eax,oProcess
lea edi,[eax+24h]
mov eax,[edi]
cmp eax,0b9h
jnz @Error_W9X
mov oThread,edi
lea esi,[ebx+2]
push 2
push esi
call IsBadWritePtr
or eax,eax
jnz @Error_W9X
mov ecx,oThread
xchg eax,ebx
push dwThreadId
push bInheritHandle
push dwDesiredAccess
call ecx
mov Result,eax
@Error_W9X:
popad
popfd
end;
end;
FreeLibrary(Kernel32);
end;
SetErrorMode(ErrOld);
end;
procedure KillX_1(pID:DWord);
var lTID:TList;
i:integer;
ThrID:PDWord;
ot:DWord;
procedure ClFr(var l:TList);
var i:integer;
p:PDWord;
begin
try
for i:=l.Count-1 downto 0 do
begin
p:=l.Items[i];
if p<>nil then Dispose(p);
l.Delete(i);
end;
l.Free;
except
end;
end;
function GetThread32():TList;
var H:THandle;
Thread32:TThreadEntry32;
t_PID:PDWord;
begin
Result:=TList.Create;
if pID=0 then exit;
H:=CreateToolHelp32Snapshot(TH32CS_SNAPTHREAD,0);
if H<>INVALID_HANDLE_VALUE then
begin
Thread32.dwSize:=SizeOf(TThreadEntry32);
if Thread32First(H,Thread32) then
repeat
if Thread32.th32OwnerProcessID=pID then
begin
New(t_PID);
t_PID^:=Thread32.th32ThreadID;
Result.Add(t_PID);
end;
until (Thread32Next(H,Thread32)=false);
CloseHandle(H);
end;
end;
begin
try
lTID:=GetThread32();
for i:=0 to lTID.Count-1 do
begin
ThrID:=lTID.Items[i];
if ThrID<>nil then
begin
ot:=OpenThread(THREAD_TERMINATE,false,ThrID^);
if ot<>0 then
begin
TerminateThread(ot,0);
CloseHandle(ot);
end;
end;
end;
finally
ClFr(lTID);
end;
end;
procedure KillX_2(pID:DWord);
var op:DWord;
begin
if pID<>0 then
begin
op:=OpenProcess(THREAD_TERMINATE,false,pID);
if op<>0 then
begin
TerminateProcess(op,0);
CloseHandle(op);
end;
end;
end;
procedure TForm1.Button1Click(Sender: TObject);
var i:DWord;
begin
try
i:=DWord(StrToInt(Edit1.Text));
NTSetPrivilege(SE_DEBUG_NAME,true);
//KillX_1(i); //Вариант 1
KillX_2(i); //Вариант 2
except
end;
end;
end. |
PS: Все енто есть на форуме... очень печально что не умеете пользоваться поиском! |
именно к нужному мне процессу тот способ неподходит.
Тогда почему ты сказал что пример posl'a не работае? 
вопрос закрыт!!!