1. Pascal / Говнокод #25038

    +4

    1. 01
    2. 02
    3. 03
    4. 04
    5. 05
    6. 06
    7. 07
    8. 08
    9. 09
    10. 10
    11. 11
    12. 12
    13. 13
    14. 14
    15. 15
    16. 16
    17. 17
    18. 18
    19. 19
    20. 20
    21. 21
    22. 22
    23. 23
    24. 24
    25. 25
    26. 26
    27. 27
    28. 28
    29. 29
    30. 30
    31. 31
    32. 32
    33. 33
    34. 34
    35. 35
    36. 36
    37. 37
    38. 38
    39. 39
    40. 40
    41. 41
    unit ZwDeleteFileSample;

interface

uses Windows, nt_status, native, hal, fcall, macros, ntoskrnl;

function _DriverEntry(DriverObject: PDriverObject; RegistryPath: PUnicodeString): NTSTATUS; stdcall;

implementation

procedure DriverUnload(pDriverObject: PDriverObject); stdcall;
begin
  DbgPrint('Test Driver :: Unloaded');
end;

function _DriverEntry(DriverObject: PDriverObject; RegistryPath: PUnicodeString): NTSTATUS; stdcall;
var UNICODESTRING: UNICODE_STRING;
  obj: OBJECT_ATTRIBUTES;

begin

  DbgPrint('Test Driver :: Loaded');
  DriverObject^.DriverUnload := @DriverUnload;

  RtlInitUnicodeString(UNICODESTRING, '\??\C:\test.exe');
  InitializeObjectAttributes(obj, @UNICODESTRING, OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE, 0, nil);
  Result := ZwDeleteFile(@obj);

  if Result = STATUS_SUCCESS then
  begin
    DbgPrint('File deleted sucessfully - Result:0x%.8X', Result); // Result to get Error Code
  end else
  begin
    DbgPrint('Fail to delete file - Result:0x%.8X', Result); // Result to get Error Code
    DbgPrint('Object name :%wZ',  obj.ObjectName); // Result to get Error Code
  end;
  Result := STATUS_SUCCESS;

end;

end.

    Драйвер на дэлфи. Ничего необычного, листайте дальше.

    Запостил: blackray, 29 Октября 2018

    Комментарии (10) RSS

    Добавить комментарий