Критический системный процесс

format PE GUI 5.0

include 'win32wx.inc'


.code
        entry $

        xor eax,eax
        push eax
        invoke RtlAdjustPrivilege,20,1,0,esp  ; RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE,TRUE,FALSE,OldPrivilege)
        ;cmp eax,0xC0000061 ; STATUS_PRIVILEGE_NOT_HELD
        ;je @f

        mov eax,esp
        mov dword [eax],TRUE
        invoke NtSetInformationProcess,-1,29,eax,4  ; NtSetInformationProcess(GetCurrentProcess(),ProcessBreakOnTermination,TRUE,4)
        pop eax

        ; BSOD...
        invoke NtTerminateProcess,-1,0 ; NtTerminateProcess(GetCurrentProcess(),0)

.data

        data import

                library ntdll,'NTDLL.DLL'

                import ntdll,\
                       RtlAdjustPrivilege,'RtlAdjustPrivilege',\
                       NtSetInformationProcess,'NtSetInformationProcess',\
                       NtTerminateProcess,'NtTerminateProcess'

        end data

program criticalprocess;

uses
  Windows, SysUtils;

const
  ntdll = 'NTDLL.DLL';

type
  NTSTATUS = ULONG;
  HANDLE = ULONG;
  PROCESS_INFORMATION_CLASS = ULONG;

const
  STATUS_SUCCESS            = $00000000;
  STATUS_PRIVILEGE_NOT_HELD = $C0000061;

const
  SE_DEBUG_PRIVILEGE = 20;

const
  ProcessBreakOnTermination = 29;
               
function RtlAdjustPrivilege(Privilege: ULONG; Enable: BOOL;
  CurrentThread: BOOL; out OldPrivilege: BOOL): NTSTATUS; stdcall; external ntdll;
function NtSetInformationProcess(ProcessHandle: HANDLE;
  ProcessInformationClass: PROCESS_INFORMATION_CLASS;
  ProcessInformation: Pointer; ProcessInformationLength: ULONG): NTSTATUS; stdcall; external ntdll;

var
  Status: NTSTATUS;
  Enabled: BOOL;
begin

  Status := RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE, True, False, Enabled);

  case (Status) of

    STATUS_SUCCESS:
    begin
      Enabled := True;
      NtSetInformationProcess(HANDLE(-1),
        ProcessBreakOnTermination,  @Enabled, SizeOf(Enabled));
    end;

    STATUS_PRIVILEGE_NOT_HELD:
    begin
      MessageBox(0, 'Debug privilege needed.', nil, MB_ICONERROR);
      Exit;
    end;

  else
    MessageBoxW(0, PWideChar(WideString(Format('NTSTATUS: 0x%.8X', [Status]))), nil, MB_ICONERROR);
    Exit;
  end;

  MessageBoxW(0, 'Do not terminate!', 'Warning!', MB_ICONWARNING);
end.