防止全局hook入侵Delphi版，2000以上系统适用（part2）

unit Unit1;

interface

uses

Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,

Dialogs, StdCtrls;

type

TForm1 = class(TForm)

Button1: TButton;

Memo1: TMemo;

Button2: TButton;

Button3: TButton;

procedure Button1Click(Sender: TObject);

procedure Button2Click(Sender: TObject);

procedure Button3Click(Sender: TObject);

procedure FormDestroy(Sender: TObject);

procedure FormCreate(Sender: TObject);

private

{ Private declarations }

procedure ShowMsg(s: string);

public

{ Public declarations }

end;

var

Form1: TForm1;

implementation

{$R *.dfm}

uses MLDE32Unit;

const

DesPath = 'C:\Program Files\Borland\Delphi6\Projects\Adv APIHOOK\Test\vt.exe';

Func2Hook = 'FreeLibrary';

var //must be a globle variable

PtrReal: Pointer;

cbStolen: Cardinal;

NtDllBase, NtDllLength: integer;

p: pointer;

h:dword;

procedure TForm1.ShowMsg(s: string);

begin

Memo1.Lines.Add(s);

end;

procedure TForm1.Button1Click(Sender: TObject);

label

FakeCode,

RtnCode;

var

// si: STARTUPINFO;

// pi: PROCESS_INFORMATION;

OriginalBytes: Array [0..4] of Char;

HookJmp: PChar;

Rtn: Cardinal;

Bytes: Array [0..4] of Char;

tmp: Cardinal;

peb, ldr, flink: pointer;

bs: DWORD;

begin

PtrReal := nil;

NtDllLength := 0;

NtDllBase := GetModuleHandle('ntdll.dll');

asm

mov eax,fs:[$30]

mov peb,eax

end;

ldr := pointer(dword(pointer(dword(peb)+12)^));

flink := pointer(dword(pointer(dword(ldr)+12)^));

p := flink;

repeat

bs := DWORD(pointer(dword(p)+$18)^);

if bs = NtDllBase then

begin

NtDllLength := DWORD(pointer(dword(p)+$20)^);

break;

end;

p := pointer(dword(p^));

until dword(flink) = dword(p^);

if NtDllLength = 0 then

ShowMsg('Can''t get ntdll.dll image size!');

{ ShowMsg('Creating suspended process ...');

ZeroMemory(@si, sizeof(STARTUPINFO));

si.cb := sizeof(STARTUPINFO);

CreateProcess(DesPath, nil, nil, nil, False, CREATE_SUSPENDED, nil, nil, si, pi); }

ShowMsg('Preparing HOOK ' + Func2Hook + ' ...');

PtrReal := GetProcAddress(GetModuleHandle('Kernel32.dll'), Func2Hook);

if Assigned(PtrReal) then

ShowMsg('Real ' + Func2Hook + ' Addr: ' + inttohex(DWORD(PtrReal), 8))

else

begin

ShowMsg(' Addr: ' + Func2Hook + ' is unreadable! Exit!');

// ResumeThread(pi.hThread);

Exit;

end;

ReadProcessMemory(GetCurrentProcess, PtrReal, @Bytes, 5, Rtn);

// ReadProcessMemory(pi.hProcess, PtrReal, @Bytes, 5, Rtn);

if Bytes[0] Chr($E9) then

begin

CopyMemory(@OriginalBytes, @Bytes, 5);

ShowMsg(Func2Hook + ' havn''t been hooked!');

end

else

begin

ShowMsg(Func2Hook + ' have been hooked! Exit!');

// ResumeThread(pi.hThread);

exit;

end;

cbStolen :=0;

while cbStolen