delphi在ring3阻止文件删除(8圈桌面广告图标生成原理)

8圈网管计费系统，最近在桌面生成图标，直接删除会提示服务和应用管理程序已经打开，无法删除，8圈计费系统先生成url快捷图标，然后打开这个快捷方式取得句柄，再使用DuplicateHandle复制句柄丢给系统进程services.exe，达到占用文件，删除8圈桌面图标就不行了!8圈桌面图标阻止删除的方法关键地方就是使用了DuplicateHandle这个API，看看下面的代码!

function EnabledDebugPrivilege(const bEnabled: Boolean): Boolean;//提权
var
hToken: THandle;
tp: TOKEN_PRIVILEGES;
a: DWORD;
const
SE_DEBUG_NAME = 'SeDebugPrivilege';
begin
Result := False;
if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, hToken)) then
begin
tp.PrivilegeCount := 1;
LookupPrivilegeValue(nil, SE_DEBUG_NAME, tp.Privileges[0].Luid);
if bEnabled then
tp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED
else
tp.Privileges[0].Attributes := 0;
a := 0;
AdjustTokenPrivileges(hToken, False, tp, SizeOf(tp), nil, a);
Result := GetLastError = ERROR_SUCCESS;
CloseHandle(hToken);
end;
end;
 
function DupFile(FileName:String;PID:Cardinal):Boolean;
var
hFile,hProcess,hTarget:THandle;
begin
Result := False;
EnabledDebugPrivilege(True);
hProcess := OpenProcess(PROCESS_DUP_HANDLE, False, PID);
Try
if hProcess <> 0 then
begin
hFile := CreateFile(PChar(FileName), GENERIC_READ, 0, nil, Create_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
if hFile = INVALID_HANDLE_VALUE then Exit;
Result := DuplicateHandle(GetCurrentProcess(), hFile, hProcess, @hTarget,
0, False, DUPLICATE_SAME_ACCESS or DUPLICATE_CLOSE_SOURCE);
end;
Finally
CloseHandle(hProcess);
End;
end;

8圈在桌面生成图标就是利用上面的原理!实际改一下就是这样

procedure TForm1.btn2Click(Sender: TObject);
  function GetPid(ExeFileName: string): THandle;  //根据进程名返回进程PID
  const
    PROCESS_TERMINATE = $0001;
  var
    ContinueLoop: BOOL;
    FSnapshotHandle: THandle;
    FProcessEntry32: TProcessEntry32;
  begin
    Result := 0;
    FSnapshotHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    FProcessEntry32.dwSize := SizeOf(FProcessEntry32);
    ContinueLoop := Process32First(FSnapshotHandle, FProcessEntry32);
    while Integer(ContinueLoop) <> 0 do
    begin
      if ((UpperCase(ExtractFileName(FProcessEntry32.szExeFile)) = UpperCase(ExeFileName)) or
          (UpperCase(FProcessEntry32.szExeFile) = UpperCase(ExeFileName))) then
          begin
              Result :=FProcessEntry32.th32ProcessID;
              Break;
          end;
          ContinueLoop := Process32Next(FSnapshotHandle, FProcessEntry32);
      end;
    CloseHandle(FSnapshotHandle);
  end;
var
  fhand:THandle;
  hProcess,hFile:THandle;
begin
  fhand:=FileOpen(PWideChar(edt1.Text),GENERIC_READ);//取得阻止删除的文件句柄
  EnabledDebugPrivilege;
  hProcess:=OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetPid('services.exe'));
  if DuplicateHandle(GetCurrentProcess(), fhand,hProcess, @hFile,  0 ,FALSE, DUPLICATE_SAME_ACCESS) then  
    ShowMessage('文件占坑成功!');
  CloseHandle(hProcess);
end;