unit Define; interface uses System.SysUtils, Winapi.Windows, Tocsg.Param, Winapi.Messages; //const // APP_MUTEX = 'Global\SecuInWndMonM20141023'; // APP_MUTEX = 'Global\QTWndMonM20141023'; // Qator // APP_MUTEX = 'Global\AssistHook120531'; // Sunk Assist const // 64ºñÆ® ÇÁ·Î±×·¥¿¡¼­¸¸ »ç¿ë°¡´ÉÇÑ vssadmin.exe °á°ú¸¦ °¡Á®¿À±â À§ÇØ Ãß°¡ 17_1201 10:09:44 sunk PARAM_RESULT_WINDOW = '/rcvwnd'; PARAM_DESTINATION_WINDOW = '/rcvwndmg'; PARAM_DESTINATION_WINDOW_MSG = '/rcvwndmsg'; PARAM_TOSS = '/toss'; PARAM_VSSADMIN_SHADOWS = '/vssadminshdws'; PARAM_NODE = '/node'; type TProcessParam = class(TTgParam) private // sMapName_, // Ãß°¡ 16_0106 09:59:51 sunk sWatchMutex_, sHookDllName_: String; public Constructor Create; Destructor Destroy; override; function IsParamOK: Boolean; property WatchMutex: String read sWatchMutex_; property HookDllName: String read sHookDllName_; // property ShareMapFileName: String read sMapName_; end; var gParam: TProcessParam = nil; implementation uses superobject, Tocsg.Path; Constructor TProcessParam.Create; begin Inherited Create; ASSERT(gParam = nil); gParam := Self; sWatchMutex_ := GetParamValue('/mutex'); sHookDllName_ := GetParamValue('/dllname'); // sMapName_ := SwitchValue['/mapname']; end; Destructor TProcessParam.Destroy; begin gParam := nil; Inherited; end; function GetVssAdminListShadowsResult(sDrive: String): String; var hReadOutPipe, hWriteOutPipe, hReadInPipe, hWriteInPipe: THandle; SI: TStartUpInfo; SA: TSecurityAttributes; SD: TSecurityDescriptor; dwResult, dwExitCode, dwBytesRead: DWORD; sDest: AnsiString; sExecute, sDestSend: String; dwAvail: DWORD; CopyData: TCopyDataStruct; ProcInfo: TProcessInformation; function IsNT: Boolean; var OS: TOSVersionInfo; begin OS.dwOSVersionInfoSize := Sizeof(OS); GetVersionEx(OS); if OS.dwPlatformId = VER_PLATFORM_WIN32_NT then Result:= true else Result:= false; end; begin Result := ''; hReadOutPipe := 0; hWriteOutPipe := 0; hReadInPipe := 0; hWriteInPipe := 0; if IsNT then begin InitializeSecurityDescriptor(@SD, SECURITY_DESCRIPTOR_REVISION); SetSecurityDescriptorDacl(@SD, True, nil, False); SA.nLength := SizeOf(SA); SA.lpSecurityDescriptor := @SD; SA.bInheritHandle := true; CreatePipe(hReadOutPipe, hWriteOutPipe, @SA, 1024); CreatePipe(hReadInPipe, hWriteInPipe, @SA, 1024); end else begin CreatePipe(hReadOutPipe, hWriteOutPipe, nil, 1024); CreatePipe(hReadInPipe, hWriteInPipe, nil, 1024); end; ZeroMemory(@ProcInfo, SizeOf(ProcInfo)); ZeroMemory(@SI, SizeOf(SI)); SI.cb := SizeOf(SI); SI.wShowWindow := SW_HIDE; SI.dwFlags := STARTF_USESHOWWINDOW or STARTF_USESTDHANDLES; SI.hStdInput := hReadInPipe; SI.hStdOutput := hWriteOutPipe; SI.hStdError := hWriteOutPipe; if sDrive = '' then sExecute := GetSystemDir + 'vssadmin.exe list shadows' else sExecute := GetSystemDir + Format('vssadmin.exe list shadows /for=%s:', [sDrive[1]]); if CreateProcess(nil, PChar(sExecute), nil, nil, true, NORMAL_PRIORITY_CLASS, nil, nil, SI, ProcInfo) then begin try dwExitCode := 0; while dwExitCode = 0 do begin dwResult := WaitForSingleObject(ProcInfo.hProcess, 500); if PeekNamedPipe(hReadOutPipe, nil, 0, nil, @dwAvail, nil) then begin if dwAvail > 0 then begin SetLength(sDest, dwAvail); ReadFile(hReadOutPipe, sDest[1], dwAvail, dwBytesRead, nil); Result := Result + sDest; end; end; if dwResult <> WAIT_TIMEOUT then dwExitCode := 1; end; finally CloseHandle(ProcInfo.hProcess); CloseHandle(ProcInfo.hThread); end; end; if hReadOutPipe <> 0 then CloseHandle(hReadOutPipe); if hWriteOutPipe <> 0 then CloseHandle(hWriteOutPipe); if hReadInPipe <> 0 then CloseHandle(hReadInPipe); if hWriteInPipe <> 0 then begin CloseHandle(hWriteInPipe); hWriteInPipe := 0; end; end; function TProcessParam.IsParamOK: Boolean; const WNDHOOK64_VSSADMIN_SHADOWS_RESULT = 1212; // GlobalDefine.pas¿¡ ¶È°°ÀÌ Á¤ÀÇµÊ 17_1201 10:40:19 sunk var hRcvWnd, hRcvWndMg: HWND; llNode, llToss, llWndMsg: LONGLONG; O: ISuperObject; sDrive: String; procedure SendCopyData(dwCmd: DWORD; const sJsonData: String); var CopyData: TCopyDataStruct; begin CopyData.dwData := dwCmd; CopyData.cbData := (Length(sJsonData)+1)*2; CopyData.lpData := PChar(sJsonData); SendMessage(hRcvWnd, WM_COPYDATA, 0, NativeInt(@CopyData)); end; begin Result := (sWatchMutex_ <> '') and (sHookDllName_ <> '');// and (sMapName_ <> ''); if not Result and ExistsParam(PARAM_VSSADMIN_SHADOWS) then begin hRcvWnd := StrToInt64Def(GetParamValue(PARAM_RESULT_WINDOW), 0); if hRcvWnd = 0 then exit; hRcvWndMg := StrToInt64Def(GetParamValue(PARAM_DESTINATION_WINDOW), 0); llWndMsg := StrToInt64Def(GetParamValue(PARAM_DESTINATION_WINDOW_MSG), 0); llToss := StrToInt64Def(GetParamValue(PARAM_TOSS), 0); llNode := StrToInt64Def(GetParamValue(PARAM_NODE), 0); sDrive := Trim(GetParamValue(PARAM_VSSADMIN_SHADOWS)); O := SO; O.I['RcvWndMg'] := hRcvWndMg; O.I['WndMsg'] := llWndMsg; O.I['Toss'] := llToss; O.I['Node'] := llNode; O.S['Drive'] := sDrive; O.S['Result'] := GetVssAdminListShadowsResult(sDrive); SendCopyData(WNDHOOK64_VSSADMIN_SHADOWS_RESULT, O.AsString); end; end; end.