01-10-2016, 02:01 PM
اضافة بسيطة للب العملية بالباسكال:
PHP كود :
var
ObjectAttributes: OBJECT_ATTRIBUTES;
IoStatusBlock: IO_STATUS_BLOCK;
hTarget: THandle;
Status: NTSTATUS;
FolderName: UNICODE_STRING;
begin
RtlInitUnicodeString(@FolderName, '\??\C:\Winmend~Folder~Hidden\...\cn');
InitializeObjectAttributes(@ObjectAttributes, @FolderName, OBJ_CASE_INSENSITIVE, 0, nil);
Status := NtCreateFile(@hTarget,
FILE_WRITE_DATA + SYNCHRONIZE,
@ObjectAttributes,
@IoStatusBlock,
nil,
FILE_ATTRIBUTE_HIDDEN,
FILE_SHARE_READ + FILE_SHARE_WRITE,
FILE_CREATE,
FILE_DIRECTORY_FILE,
nil,
0);
if Status = STATUS_SUCCESS then
(* Display Message box *)
NtClose(hTarget);
end;
Computer Forensics - Insid3Code Team - I3CT


![[-]](https://delphi4arab.net/forum/D4A2020/collapse.png)