delphi WH_CALLWNDPROC钩子卸载后出现EXPLORER.EXE内存访问错误

Question

下面是源码，谁帮我看看，。谢谢。很急。
unit Unit1;interfaceuses
  Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
  StdCtrls, ExtCtrls,UnitConst;type
  TForm1 = class(TForm)
    Button1: TButton;
    Button2: TButton;
    Timer1: TTimer;
    Edit1: TEdit;
    Button3: TButton;
    Edit2: TEdit;
    procedure Button1Click(Sender: TObject);
    procedure Button2Click(Sender: TObject);
    procedure Timer1Timer(Sender: TObject);
    procedure FormCreate(Sender: TObject);
    procedure Button3Click(Sender: TObject);
    procedure FormClose(Sender: TObject; var Action: TCloseAction);
  private
    { Private declarations }
  public
    { Public declarations }
  end;function SetHook(wnd:Hwnd;ExplorerProcessID:THandle):Boolean;stdcall; external 'MyHook.dll';// name 'SetHook';
function DelHook:Boolean;stdcall; external 'MyHook.dll';// name 'DelHook';
var
  Form1: TForm1;
  hook:HHOOK;{钩子变量}
  fromwhere:Integer;
 procedure Setfromwhere(whereid: Integer);
implementation{$R *.DFM}
procedure Setfromwhere(whereid: Integer);
begin
    fromwhere:=whereid;
end;procedure TForm1.Timer1Timer(Sender: TObject);
begin
   if fromwhere=1 then
   begin
        Timer1.Enabled:=false;
        ShowMessage('fromwhere=1');
   end
   else if fromwhere=2 then
   begin
       Timer1.Enabled:=false;
        ShowMessage('fromwhere=2');
   end;
end;procedure TForm1.FormCreate(Sender: TObject);
var
  ExplorerProcessID:THandle;
begin
      fromwhere:=0;
      Timer1.Enabled:=true;
      Timer1.Interval:=100;
      ExplorerProcessID:=GetCurrentProcessId;
     SetHook(Form1.handle,ExplorerProcessID);
end;procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction);
begin
      DelHook;
end;end.UnitConst.pasunit UnitConst;interface
uses
  windows,
  messages,
  sysutils,
  tlhelp32,Forms;const
  MemName = 'MemName';type
  {内存映射文件记录结构}
  TGetMem = record
    wnd: Hwnd; {远程句柄}
    ExplorerProcessID:THandle;
  end;  PTGetMem = ^TGetMem;implementationend.
UnitMyHook.pasunit UnitMyHook;interface
uses
  SysUtils,
  Windows,
  Messages,
  Classes,
  Dialogs,
  Forms,
  UnitConst;  function SetHook(wnd:Hwnd;ExplorerProcessID:THandle):Boolean;stdcall;
  function DelHook:Boolean;stdcall;
var
  MemFile: THandle;
  pShMem: PTGetMem;
  hook:HHOOK;{钩子变量}
implementationfunction CallWndProc(nCode:Integer;wP:wParam;lP:LPARAM):LRESULT;stdcall;
begin
  Result:=CallNextHookEx(hook,nCode,wP,lP);
end;{建立钩子}
function SetHook(wnd:Hwnd;ExplorerProcessID:THandle):Boolean;stdcall;
var
  hThread:DWORD;
  pid:THandle;
begin
  pShMem^.wnd:=wnd;
  pShMem^.ExplorerProcessID:=ExplorerProcessID;
  if hook = 0 then
  begin
     pid:=GetCurrentProcessId;
     OutputDebugString(PChar('ExplorerProcessID'+IntToStr(ExplorerProcessID)+'   '+'GetCurrentProcessId'+IntToStr(pid)));
     //hook:=SetWindowsHookEx(WH_CALLWNDPROC,Pointer(@CallWndProc),HInstance,0);//TFNHookProc
     hook:=SetWindowsHookEx(WH_CALLWNDPROC,CallWndProc,HInstance,0);
  end;
  //hook:=setWindowsHookEx(WH_CALLWNDPROC,TFNHookProc(@CallWndProc),0,GetCurrentThreadID); // 可以触发。
  Result:=hook <> 0;
end;{释放钩子}
function DelHook:Boolean;stdcall;
var
  pid:THandle;
begin
   Result:=False;
   if hook <>0 then
   begin
     pid:=GetCurrentProcessId;
     OutputDebugString(PChar('ExplorerProcessID'+IntToStr(pShMem^.ExplorerProcessID)+'   '+'GetCurrentProcessId'+IntToStr(pid)));
     Result:=UnhookWindowsHookEx(hook);
     hook:=0;
   end;
end;
procedure Intro;
begin
  MemFile := OpenFileMapping(FILE_MAP_WRITE or FILE_MAP_READ,False, MemName);
  if MemFile=0 then
  begin
     MemFile := CreateFileMapping($FFFFFFFF, nil, PAGE_READWRITE, 0, SizeOf(TGetMem), MemName);
  end;
  pShMem := MapViewOfFile(MemFile, FILE_MAP_WRITE or FILE_MAP_READ, 0, 0, 0);
end;procedure Extro;
begin
  if pShMem<>nil then
  begin
    UnmapViewOfFile(pShMem);
    pShMem:=nil;
  end;
  if memfile<>0 then
  Begin
    CloseHandle(MemFile);
    MemFile:=0;
  end;
end;
initialization
      Intro;
finalization
      Extro;
end.
MyHook.dlllibrary MyHook;{ Important note about DLL memory management: ShareMem must be the
  first unit in your library's USES clause AND your project's (select
  Project-View Source) USES clause if your DLL exports any procedures or
  functions that pass strings as parameters or function results. This
  applies to all strings passed to afrom your DLL--even those that
  are nested in records and classes. ShareMem is the interface unit to
  the BORLNDMM.DLL shared memory manager, which must be deployed along
  with your DLL. To avoid using BORLNDMM.DLL, pass string information
  using PChar or ShortString parameters. }uses  Windows,
  Classes,
  UnitMyHook in 'UnitMyHook.pas',
  UnitConst in 'UnitConst.pas';{$R *.RES}
exports
 SetHook,DelHook;
begin
end.没东西了，以上是全部代码了。问题就是我所说的，可以运行，可以关闭。但是当关闭程序后，把鼠标移动桌面上，会出现EXPLORER.EXE内存访问错误。哪位大侠知道啊？

Answer 1

有没高手啊？今天我看到有将hook和dll句柄保存到共享区域的，就是
 hook:=SetWindowsHookEx(WH_CALLWNDPROC,CallWndProc,HInstance,0); hook都改为 pShMem^.hook,HInstance改为Shared^.Moudle，【Shared^.Moudle：=GetModuleHandle(PChar('Myhook'));】
最后在UninstallHook函数里加上Freelibrary(Shared^.Moudle);可我试了一运行，窗体就关不了，而且很快就系统就崩溃，要注销才行。有谁知道啊？很急啊啊啊

Answer 2

难道WH_CALLWNDPROC只能设置成SetWindowsHookEx(WH_CALLWNDPROC,CallWndProc,HInstance,thread);  方式吗？

Answer 3

有点乱，把DLL的代码删除一些，把内存映射也去掉，自己调试一下