[Delphi] Process Detection – Handle Table Enumeration

just some code requested for detect process by handle table enumeration..

[Delphi] Example Enum Object

Although the Windows NT API is not object-oriented, NT uses objects internally to provide support for certain features uniformly across a variety of different entities. Internally, files, events, mutexes, pipes, and so on, are all implemented as objects. This allows NT to perform some operations, such as security checks, in a generic fashion for different types of objects.

Diatas itu qoute from Here , and code berikut adalah sample implementasinya

here u go

[Delphi] Unlock File And Share Nice Utils

Tadi keasikan browse blognya IvanleF0u’s, eh saya liat ada tutorial yang menarik yaitu tentang system handle information dan bagaimana sih program file unlocker bekerja … ? link tutornya here (bahasa france so use translate google :P). Garis besar dari tutorialnya sih untuk meng’Unlock file maka perlu membebaskan penggunaan dari file itu seperti kill processnya, jika berupa dll unload it, and close handlenya di system handle information.

adapun codenya saya share satu unit aja yah, malas extract :D, btw here u go the code..

[Delphi] PEB Module Manipulation

Beberapa fungsi PEB module manipulation, semoga berguna..

Enum Modules (Memory region Way)

pada thread sebelumnya
[url]https://cybercoding.wordpress.com/2011/04/15/example-enum-module-at-peb/[/url]
sy post bagaimana cara enum module dari peb ldr lingketlist…

nah kelemahan dari cara enumerate peb method adalah sang malware bisa saja menghilangkan (unlink) modulenya sehingga saat di enum (peb-ldr) tidak akan ada…

so how to detect typical malware / rootkit like that then ? kita bisa mengenum memory region (check memory tipe = image)

lebih jelas take a look this code