Delphi-DLL注入（Delphi - DLL injection）.docVIP

Delphi-DLL注入（Delphi - DLL injection） Delphi - DLL injection 2008-08-05 backs there are many kinds of remote DLL injection method, is used by a lot of Trojan virus hidden process approach, because through the program to load the DLL is not shown in task manager. Here are a way of established using CreateRemoteThread remote thread injecting DLL. First of all, we have to improve their permissions, because of the distance into the inevitable to access to the target process of memory space, if not enough system permissions, will not be able to do anything. The following is the function is used to enhance we want permission to use. The function EnableDebugPriv: Boolean; var HToken: THandle; Tp: TTokenPrivileges; Rl: Cardinal; The begin Result: = false; / / open process token ring TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY OpenProcessToken (GetCurrentProcess (), HToken); / / get the unique ID of the process If lookupton evalue (nil, SeDebugPrivilege, tp. Privileges [0]. Luid) then The begin Tp. PrivilegeCount: = 1; Tp. Privileges [0]. Attributes: = SE_PRIVILEGE_ENABLED; / / adjust permissions Result: = AdjustTokenPrivileges (hToken, false, tp, SizeOf (tp), nil, rl); The end; The end; A brief introduction to two apis for OpenProcessToken () and AdjustTokenPrivileges () : OpenProcessToken () : gets a handle to the process access token. The function OpenProcessToken ( ProcessHandle: THandle; / / modify the process handle of the access permission DesiredAccess: DWORD; / / specify the type of operation you are going to perform Var TokenHandle: the access token pointer returned by THandle / / ) : BOOL; AdjustTokenPrivileges () : permissions to adjust the process. The function of AdjustTokenPrivileges ( TokenHandle: THandle; / / access token handle DisableAllPrivileges: BOOL; / / the decision is to make the authorization change or to Disable all permissions Const NewState because: TTokenPrivileges; {specifies the permissions to modify, is a pointer to the TOKEN_PRIVILEGES structure,