delphi 调用驱动

最新推荐文章于 2025-08-07 10:21:48 发布

原创最新推荐文章于 2025-08-07 10:21:48 发布 · 1.7k 阅读

1 ·

本内容遵循CC 4.0 BY-SA版权协议

标签

#delphi #reference #action #forms #file

这篇博客详细介绍了如何在Delphi应用程序中调用驱动程序来实现隐藏指定进程的功能。通过创建设备、创建事件、发送事件句柄给驱动以及传递进程名到驱动，实现了对目标进程的隐藏操作。

unit Unit1; interface uses Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms, Dialogs, StdCtrls, untProcessEventThr, PsAPI, ComCtrls, StrUtils; type TForm1 = class(TForm) btnHide: TButton; edtProcessName: TEdit; procedure FormClose(Sender: TObject; var Action: TCloseAction); procedure btnHideClick(Sender: TObject); private { Private declarations } public { Public declarations } m_hCommDevice:THandle; m_hCommEvent:THandle; end; var Form1: TForm1; implementation uses Unit2, untConst; {$R *.dfm} procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction); var dwReturn:DWORD ; begin if(m_hCommDevice <> 0) then begin if(m_hCommEvent <> 0) then begin DeviceIoControl(m_hCommDevice, IO_DEREFERENCE_EVENT, nil, 0, nil, 0, dwReturn, nil); CloseHandle(m_hCommEvent); end; CloseHandle(m_hCommDevice); end; end; procedure TForm1.btnHideClick(Sender: TObject); var dwReturn: DWORD; proname:array [0..1023] of char; begin //创建设备 try m_hCommDevice := CreateFile('//./HideProcess', GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); except MessageBox(Handle, '创建设备失败', '隐藏进程启动', MB_OK + MB_ICONWARNING); end; //创建事件 try m_hCommEvent := CreateEvent(nil, false, false, nil); except CloseHandle(m_hCommDevice); MessageBox(Handle, '创建事件失败', '隐藏进程启动', MB_OK + MB_ICONWARNING); end; //发送事件句柄给驱动 DeviceIoControl(m_hCommDevice, IO_REFERENCE_EVENT, pointer(m_hCommEvent), 0, nil, 0, dwReturn, nil); StrPCopy(@proname, Trim(edtProcessName.Text)); DeviceIoControl(m_hCommDevice, IO_PASSBUF, @proname, sizeof(proname), nil, 0, dwReturn, nil); end; end.