delphi在ring3阻止文件删除(8圈桌面广告图标生成原理)
8圈网管计费系统，最近在桌面生成图标，直接删除会提示服务和应用管理程序已经打开，无法删除，8圈计费系统先生成url快捷图标，然后打开这个快捷方式取得句柄，再使用DuplicateHandle复制句柄丢给系统进程services.exe，达到占用文件，删除8圈桌面图标就不行了!8圈桌面图标阻止删除的方法关键地方就是使用了DuplicateHandle这个API，看看下面的代码! 12345678910111213141516171819202122232425262728293031323334353637383940414243function EnabledDebugPrivilege(const bEnabled: Boolean): Boolean;//提权varhToken: THandle;tp: TOKEN_PRIVILEGES;a: DWORD;constSE_DEBUG_NAME = 'SeDebugPrivilege';beginResult := False;if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, hToken)) thenbegintp.PrivilegeCount := 1;LookupPrivilegeValue(nil, SE_DEBUG_NAME, tp.Privileges[0].Luid);if bEnabled thentp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLEDelsetp.Privileges[0].Attributes := 0;a := 0;AdjustTokenPrivileges(hToken, False, tp, SizeOf(tp), nil, a);Result := GetLastError = ERROR_SUCCESS;CloseHandle(hToken);end;end; function DupFile(FileName:String;PID:Cardinal):Boolean;varhFile,hProcess,hTarget:THandle;beginResult := False;EnabledDebugPrivilege(True);hProcess := OpenProcess(PROCESS_DUP_HANDLE, False, PID);Tryif hProcess <> 0 thenbeginhFile := CreateFile(PChar(FileName), GENERIC_READ, 0, nil, Create_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);if hFile = INVALID_HANDLE_VALUE then Exit;Result := DuplicateHandle(GetCurrentProcess(), hFile, hProcess, @hTarget,0, False, DUPLICATE_SAME_ACCESS or DUPLICATE_CLOSE_SOURCE);end;FinallyCloseHandle(hProcess);End;end; 8圈在桌面生成图标就是利用上面的原理!实际改一下就是这样 123456789101112131415161718192021222324252627282930313233343536procedure TForm1.btn2Click(Sender: TObject); function GetPid(ExeFileName: string): THandle; //根据进程名返回进程PID const PROCESS_TERMINATE = $0001; var ContinueLoop: BOOL; FSnapshotHandle: THandle; FProcessEntry32: TProcessEntry32; begin Result := 0; FSnapshotHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); FProcessEntry32.dwSize := SizeOf(FProcessEntry32); ContinueLoop := Process32First(FSnapshotHandle, FProcessEntry32); while Integer(ContinueLoop) <> 0 do begin if ((UpperCase(ExtractFileName(FProcessEntry32.szExeFile)) = UpperCase(ExeFileName)) or (UpperCase(FProcessEntry32.szExeFile) = UpperCase(ExeFileName))) then begin Result :=FProcessEntry32.th32ProcessID; Break; end; ContinueLoop := Process32Next(FSnapshotHandle, FProcessEntry32); end; CloseHandle(FSnapshotHandle); end;var fhand:THandle; hProcess,hFile:THandle;begin fhand:=FileOpen(PWideChar(edt1.Text),GENERIC_READ);//取得阻止删除的文件句柄 EnabledDebugPrivilege; hProcess:=OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetPid('services.exe')); if DuplicateHandle(GetCurrentProcess(), fhand,hProcess, @hFile, 0 ,FALSE, DUPLICATE_SAME_ACCESS) then ShowMessage('文件占坑成功!'); CloseHandle(hProcess);end;