Como fechar uma Handle [Type] de um processo.exe [DELPHI]
17/07/2019
0
Olá pessoal,
Estou querendo finalizar uma determinada Handle (String) sem que o aplicativo feche!
Obs a imagem.
https://i.imgur.com/LHO5MMa.png
Quero finalizar essa Handle /Sessions\\\\BaseNamedObjects\\\\SM0: 13116:64 WilError_01
JÁ TENTEI ESSE MÉTODO MAIS NÃO ESTÁ MATANDO A HANDLE
Estou querendo finalizar uma determinada Handle (String) sem que o aplicativo feche!
Obs a imagem.
https://i.imgur.com/LHO5MMa.png
Quero finalizar essa Handle /Sessions\\\\BaseNamedObjects\\\\SM0: 13116:64 WilError_01
JÁ TENTEI ESSE MÉTODO MAIS NÃO ESTÁ MATANDO A HANDLE
const SystemHandleInformation = $10; STATUS_SUCCESS = $00000000; STATUS_BUFFER_OVERFLOW = $80000005; STATUS_INFO_LENGTH_MISMATCH = $C0000004; DefaulBUFFERSIZE = $100000; type OBJECT_INFORMATION_CLASS = (ObjectBasicInformation,ObjectNameInformation,ObjectTypeInformation,ObjectAllTypesInformation,ObjectHandleInformation ); SYSTEM_HANDLE=packed record uIdProcess:ULONG; ObjectType:UCHAR; Flags :UCHAR; Handle :Word; pObject :Pointer; GrantedAccess:ACCESS_MASK; end; PSYSTEM_HANDLE = ^SYSTEM_HANDLE; SYSTEM_HANDLE_ARRAY = Array[0..0] of SYSTEM_HANDLE; PSYSTEM_HANDLE_ARRAY= ^SYSTEM_HANDLE_ARRAY; SYSTEM_HANDLE_INFORMATION=packed record uCount:ULONG; Handles:SYSTEM_HANDLE_ARRAY; end; PSYSTEM_HANDLE_INFORMATION=^SYSTEM_HANDLE_INFORMATION; TNtQuerySystemInformation=function (SystemInformationClass:DWORD; SystemInformation:pointer; SystemInformationLength:DWORD; ReturnLength:PDWORD):THandle; stdcall; TNtQueryObject =function (ObjectHandle:cardinal; ObjectInformationClass:OBJECT_INFORMATION_CLASS; ObjectInformation:pointer; Length:ULONG;ResultLength:PDWORD):THandle;stdcall; UNICODE_STRING=packed record Length :Word; MaximumLength:Word; Buffer :PWideChar; end; OBJECT_NAME_INFORMATION=UNICODE_STRING; POBJECT_NAME_INFORMATION=^OBJECT_NAME_INFORMATION; Var NTQueryObject :TNtQueryObject; NTQuerySystemInformation:TNTQuerySystemInformation; function GetObjectInfo(hObject:cardinal; objInfoClass:OBJECT_INFORMATION_CLASS):LPWSTR; var pObjectInfo:POBJECT_NAME_INFORMATION; HDummy :THandle; dwSize :DWORD; begin Result:=nil; dwSize := sizeof(OBJECT_NAME_INFORMATION); pObjectInfo := AllocMem(dwSize); HDummy := NTQueryObject(hObject, objInfoClass, pObjectInfo,dwSize, @dwSize); if((HDummy = STATUS_BUFFER_OVERFLOW) or (HDummy = STATUS_INFO_LENGTH_MISMATCH)) then begin FreeMem(pObjectInfo); pObjectInfo := AllocMem(dwSize); HDummy := NTQueryObject(hObject, objInfoClass, pObjectInfo,dwSize, @dwSize); end; if((HDummy >= STATUS_SUCCESS) and (pObjectInfo.Buffer <> nil)) then begin Result := AllocMem(pObjectInfo.Length + sizeof(WCHAR)); CopyMemory(result, pObjectInfo.Buffer, pObjectInfo.Length); end; FreeMem(pObjectInfo); end; var sDummy : string; hProcess : THandle; hObject : THandle; ResultLength: DWORD; aBufferSize : DWORD; aIndex : Integer; pHandleInfo : PSYSTEM_HANDLE_INFORMATION; HDummy : THandle; lpwsName : PWideChar; lpwsType : PWideChar; lpszProcess : PAnsiChar; procedure TForm1.Button1Click(Sender: TObject); begin try NTQueryObject := GetProcAddress(GetModuleHandle(''NTDLL.DLL''), ''NtQueryObject''); NTQuerySystemInformation := GetProcAddress(GetModuleHandle(''NTDLL.DLL''), ''NtQuerySystemInformation''); if (@NTQuerySystemInformation<>nil) and (@NTQuerySystemInformation<>nil) then AbufferSize := DefaulBUFFERSIZE; pHandleInfo := AllocMem(AbufferSize); HDummy := NTQuerySystemInformation(DWORD(SystemHandleInformation), pHandleInfo,AbufferSize, @ResultLength); //Get the list of handles if(HDummy = STATUS_SUCCESS) then //If no error continue begin for aIndex:=0 to pHandleInfo^.uCount-1 do //iterate the list begin hProcess := OpenProcess(PROCESS_DUP_HANDLE or PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, FALSE, pHandleInfo.Handles[aIndex].uIdProcess); //open the process to get aditional info if(hProcess <> INVALID_HANDLE_VALUE) then //Check valid handle begin hObject := 0; if DuplicateHandle(hProcess, pHandleInfo.Handles[aIndex].Handle,GetCurrentProcess(), @hObject, STANDARD_RIGHTS_REQUIRED,FALSE, 0) then //Get a copy of the original handle begin lpwsName := GetObjectInfo(hObject, ObjectNameInformation); //Get the filename linked to the handle if (lpwsName <> nil) then begin lpwsType := GetObjectInfo(hObject, ObjectTypeInformation); lpszProcess := AllocMem(MAX_PATH); if GetModuleFileNameEx(hProcess, 0,lpszProcess, MAX_PATH)<>0 then //get the name of the process sDummy:=ExtractFileName(lpszProcess) else sDummy:= ''Mutant''; if lpwsName = ''/Sessions\\\\BaseNamedObjects\\\\SM0: 13116:64 WilError_01'' then begin ShowMessage(''Found And Killed''); CloseHandle(pHandleInfo.Handles[aIndex].Handle); end; FreeMem(lpwsName); FreeMem(lpwsType); FreeMem(lpszProcess); end; CloseHandle(hObject); end; CloseHandle(hProcess); end; end; end; finally FreeMem(pHandleInfo); end; end; end.
Eduardo
Curtir tópico
+ 0
Responder
Posts
Clique aqui para fazer login e interagir na Comunidade :)