各位朋友,原窗体的PAS如下 :
unit untMain;
。
var
frmCannotKill: TfrmCannotKill;
InstallHook: function (MainHandle: HWND):Boolean; stdcall;implementation{$R *.dfm}procedure TfrmCannotKill.btn1Click(Sender: TObject);
var
ModuleHandle: THandle;
begin
ModuleHandle := LoadLibrary('Hook.dll');
if ModuleHandle = 0 then Exit;
@InstallHook := GetProcAddress(ModuleHandle, 'InstallHook');
InstallHook(0)
end;现在想将上面代码里面的:
InstallHook: function (MainHandle: HWND):Boolean; stdcall;
和
var
ModuleHandle: THandle;
begin
ModuleHandle := LoadLibrary('Hook.dll');
if ModuleHandle = 0 then Exit;
@InstallHook := GetProcAddress(ModuleHandle, 'InstallHook');
InstallHook(0)
end;
放到工程文件里面,请问能否实现?如果可以实现,位置该怎样放,请各位朋友赐教,谢谢!!!工程文件如下:
program Run;uses
Forms,
untMain in 'untMain.pas' {frmCannotKill};{$R *.res}begin
Application.Initialize;
Application.CreateForm(TfrmCannotKill, frmCannotKill);
Application.Run;
end.
unit untMain;
。
var
frmCannotKill: TfrmCannotKill;
InstallHook: function (MainHandle: HWND):Boolean; stdcall;implementation{$R *.dfm}procedure TfrmCannotKill.btn1Click(Sender: TObject);
var
ModuleHandle: THandle;
begin
ModuleHandle := LoadLibrary('Hook.dll');
if ModuleHandle = 0 then Exit;
@InstallHook := GetProcAddress(ModuleHandle, 'InstallHook');
InstallHook(0)
end;现在想将上面代码里面的:
InstallHook: function (MainHandle: HWND):Boolean; stdcall;
和
var
ModuleHandle: THandle;
begin
ModuleHandle := LoadLibrary('Hook.dll');
if ModuleHandle = 0 then Exit;
@InstallHook := GetProcAddress(ModuleHandle, 'InstallHook');
InstallHook(0)
end;
放到工程文件里面,请问能否实现?如果可以实现,位置该怎样放,请各位朋友赐教,谢谢!!!工程文件如下:
program Run;uses
Forms,
untMain in 'untMain.pas' {frmCannotKill};{$R *.res}begin
Application.Initialize;
Application.CreateForm(TfrmCannotKill, frmCannotKill);
Application.Run;
end.
Forms,
Windows, ----必须有
untMain in 'untMain.pas ' {frmCannotKill};{$R *.res}
var
InstallHook: function (MainHandle: HWND):Boolean; stdcall;
begin
ModuleHandle := LoadLibrary( 'Hook.dll ');
if ModuleHandle = 0 then Exit;
@InstallHook := GetProcAddress(ModuleHandle, 'InstallHook ');
InstallHook(0);
Application.Initialize;
Application.CreateForm(TfrmCannotKill, frmCannotKill);
Application.Run;
end.
unit APIHook;interfaceuses
SysUtils, Windows, TlHelp32, Dialogs;type
{ 要HOOK的API函数定义 }
TMyOpenProcess = function(dwDesiredAccess: DWORD; bInheritHandle:
BOOL; dwProcessId: DWORD): THandle; stdcall;procedure HookAPI;
procedure UnHookAPI;var
ProcessHandle: HWND;
BaseAddress: Pointer;
MainHooK: Cardinal;
OldProc: array[0..7] of Byte;
NewPorc: array[0..7] of Byte;
implementationfunction GetFileName(dwProcessID: Cardinal): string;
var
me: MODULEENTRY32;
hm: Thandle;
begin
hm := CreateToolHelp32SnapShot(TH32CS_SNAPmodule, dwProcessID);
me.dwSize := sizeof(ModuleEntry32);
Module32First(hm, me);
Result := StrPas(@me.szExePath);
end;function MyOpenProcess(dwDesiredAccess: DWORD; bInheritHandle:
BOOL; dwProcessId: DWORD): THandle; stdcall;
const
INPMCLASS = 'TForm1';
var
nSize: Cardinal;
Hwnds: HWND;
AppProID: DWORD;
begin
if dwDesiredAccess = PROCESS_TERMINATE then
begin
Hwnds := FindWindow(INPMCLASS, nil);
if Hwnds <> 0 then
begin
GetWindowThreadProcessId(Hwnds, @AppProID);
if dwProcessId = AppProID then
begin
Result := 0;
Exit;
end;
end;
end;
WriteProcessMemory(ProcessHandle, BaseAddress, @OldProc, 8, nSize);
Result := OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId);
WriteProcessMemory(ProcessHandle, BaseAddress, @NewPorc, 8, nSize);
end;procedure HookAPI();
var
DLLModule: THandle;
nSize: Cardinal;
Dat: DWORD;
Tmp: array[0..3] of Byte;
begin
ProcessHandle := GetCurrentProcess;
DLLModule := LoadLibrary('kernel32.dll');
{ 系统函数入口点地址 }
BaseAddress := GetProcAddress(DLLModule, 'OpenProcess');
Dat := DWORD(@MyOpenProcess);
Move(Dat, Tmp, 4);
NewPorc[0] := $B8; { 汇编跳转指令 }
NewPorc[1] := Tmp[0]; { 跳转到自身的函数 }
NewPorc[2] := Tmp[1];
NewPorc[3] := Tmp[2];
NewPorc[4] := Tmp[3];
NewPorc[5] := $FF;
NewPorc[6] := $E0;
NewPorc[7] := 0;
{ 读取系统函数内存地址 }
if ReadProcessMemory(ProcessHandle, BaseAddress, @OldProc, 8, nSize) then
{ 用自己的函数地址覆盖系统的函数地址 }
if WriteProcessMemory(ProcessHandle, BaseAddress, @NewPorc, 8, nSize) then
end;procedure UnHookAPI;
var
nSize: Cardinal;
begin
{ 恢复所修改的地址 }
WriteProcessMemory(ProcessHandle, BaseAddress, @OldProc, 8, nSize);end;end.
var
nSize: Cardinal;
Hwnds: HWND;
AppProID: DWORD;
begin
if dwDesiredAccess = PROCESS_TERMINATE then
begin
Hwnds := FindWindow(INPMCLASS, nil);
if Hwnds <> 0 then
begin
GetWindowThreadProcessId(Hwnds, @AppProID);
if dwProcessId = AppProID then
begin
Result := 0;
Exit;
end;
end;
end; 这段代码是通过查找TForm1返回进程pid,若你隐藏后就找不到了,直接将AppProID 换为你程序的PID即可