// 此程序参考了老侃(NowCan)的Rt98.cpp, 在此表示感谢, 虽然我还不认识他, 同时也感谢东兰兄帮忙查错,
program KernelThread_9x;
uses Windows;
// 建立内核线程
function CreateKernelThread(
lpThreadAttributes: Pointer;
dwStackSize: DWord;
lpStartAddress: TFNThreadStartRoutine;
lpParameter: Pointer;
dwCreationFlags: DWord;
var lpThreadId: DWord): THandle;
stdcall;
external 'Kernel32.dll' Name 'CreateKernelThread';
// 分配共享内存
function SharedMemoryAlloc(dwSize: DWord): Pointer;
stdcall;
external 'ComCtl32.dll' Index 71;
// 函数调用约定
type
PfnLoadLibrary = function (lpLibFileName: PChar): HModule;
stdcall;
PfnFreeLibrary = function (hLibModule: HModule): Bool;
stdcall;
PfnGetProcAddress = function (hModule: HModule;
lpProcName: PChar): FarProc;
stdcall;
PfnGetModuleFileName = function (hModule: HModule;
lpFilename: PChar;
nSize: DWord): DWord;
stdcall;
PfnMessageBox = function (hWnd: HWnd;
lpText, lpCaption: PChar;
uType: UInt): Integer;
stdcall;
// 线程参数结构
type
PThreadParam = ^TThreadParam;
TThreadParam = record
fnLoadLibrary: PfnLoadLibrary;
fnFreeLibrary: PfnFreeLibrary;
fnGetProcAddress: PfnGetProcAddress;
fnGetModuleFileName: PfnGetModuleFileName;
szModuleName, szProcName,
szText, szCaption: array[0..MAX_PATH] of Char;
end;
// 内核线程回调
function KernelThreadPro(var Param: TThreadParam): DWord;
stdcall;
var
hUser32: HModule;
fnMessageBox: PfnMessageBox;
begin
Result := 66;
// 装载DLL
hUser32 := Param.fnLoadLibrary(@Param.szModuleName);
if (hUser32 = 0) then
Exit;
// 定位API
fnMessageBox := Param.fnGetProcAddress(hUser32, @Param.szProcName);
if (@fnMessageBox = nil) then
Exit;
// 所处进程
Param.fnGetModuleFileName(0, @Param.szText[9], MAX_PATH - 9);
// 调用API
fnMessageBox(0, @Param.szText, @Param.szCaption, MB_TOPMOST);
// 卸载DLL
Param.fnFreeLibrary(hUser32);
end;
// 帮助计算长度
procedure AfterThreadPro();
begin
end;
// 程序入口
var
ThreadCodeSize: DWord;
ThreadCodePt: Pointer;
ThreadParam: TThreadParam;
ThreadParamPt: PThreadParam;
hKernel32: HModule;
hThread: THandle;
ThreadId: DWord;
begin
// 代码长度
ThreadCodeSize := DWord(@AfterThreadPro) - DWord(@KernelThreadPro);
// 分配内存
ThreadCodePt := SharedMemoryAlloc(ThreadCodeSize + SizeOf(TThreadParam) + 3);
if (ThreadCodePt = nil) then
begin
MessageBox(0, '分配共享内存失败!!', 'Error', MB_TOPMOST);
Exit;
end;
// 拷贝代码
if (WriteProcessMemory(GetCurrentProcess(), ThreadCodePt, @KernelThreadPro, ThreadCodeSize, PDWord(nil)^) = False) then
begin
MessageBox(0, '复制线程代码失败!!', 'Error', MB_TOPMOST);
Exit;
end;
// 线程参数
hKernel32 := GetModuleHandle('Kernel32.dll');
ThreadParam.fnLoadLibrary := GetProcAddress(hKernel32, 'LoadLibraryA');
ThreadParam.fnFreeLibrary := GetProcAddress(hKernel32, 'FreeLibrary');
ThreadParam.fnGetProcAddress := GetProcAddress(hKernel32, 'GetProcAddress');
ThreadParam.fnGetModuleFileName := GetProcAddress(hKernel32, 'GetModuleFileNameA');
ThreadParam.szModuleName := 'User32.dll';
ThreadParam.szProcName := 'MessageBoxA';
ThreadParam.szText := '所处进程 ';
ThreadParam.szCaption := ' KernelThread_9x';
// 拷贝参数
ThreadParamPt := PThreadParam(DWord(ThreadCodePt) + (ThreadCodeSize + 3) and (not 3));
if (WriteProcessMemory(GetCurrentProcess(), ThreadParamPt, @ThreadParam, SizeOf(TThreadParam), PDWord(nil)^) = False) then
begin
MessageBox(0, '复制线程参数失败!!', 'Error', MB_TOPMOST);
Exit;
end;
// 建立线程
hThread := CreateKernelThread(nil, 0, ThreadCodePt, ThreadParamPt, 0, ThreadId);
if (hThread = 0) then
MessageBox(0, '建立内核线程失败!!', 'Error', MB_TOPMOST) else
CloseHandle(hThread);
end.