unit Unit1;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls;
type
TForm1 = class(TForm)
Button1: TButton;
Memo1: TMemo;
Button2: TButton;
Button3: TButton;
procedure Button1Click(Sender: TObject);
procedure Button2Click(Sender: TObject);
procedure Button3Click(Sender: TObject);
procedure FormDestroy(Sender: TObject);
procedure FormCreate(Sender: TObject);
private
{ Private declarations }
procedure ShowMsg(s: string);
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
uses MLDE32Unit;
const
DesPath = 'C:\Program Files\Borland\Delphi6\Projects\Adv APIHOOK\Test\vt.exe';
Func2Hook = 'FreeLibrary';
var //must be a globle variable
PtrReal: Pointer;
cbStolen: Cardinal;
NtDllBase, NtDllLength: integer;
p: pointer;
h:dword;
procedure TForm1.ShowMsg(s: string);
begin
Memo1.Lines.Add(s);
end;
procedure TForm1.Button1Click(Sender: TObject);
label
FakeCode,
RtnCode;
var
// si: STARTUPINFO;
// pi: PROCESS_INFORMATION;
OriginalBytes: Array [0..4] of Char;
HookJmp: PChar;
Rtn: Cardinal;
Bytes: Array [0..4] of Char;
tmp: Cardinal;
peb, ldr, flink: pointer;
bs: DWORD;
begin
PtrReal := nil;
NtDllLength := 0;
NtDllBase := GetModuleHandle('ntdll.dll');
asm
mov eax,fs:[$30]
mov peb,eax
end;
ldr := pointer(dword(pointer(dword(peb)+12)^));
flink := pointer(dword(pointer(dword(ldr)+12)^));
p := flink;
repeat
bs := DWORD(pointer(dword(p)+$18)^);
if bs = NtDllBase then
begin
NtDllLength := DWORD(pointer(dword(p)+$20)^);
break;
end;
p := pointer(dword(p^));
until dword(flink) = dword(p^);
if NtDllLength = 0 then
ShowMsg('Can''t get ntdll.dll image size!');
{ ShowMsg('Creating suspended process ...');
ZeroMemory(@si, sizeof(STARTUPINFO));
si.cb := sizeof(STARTUPINFO);
CreateProcess(DesPath, nil, nil, nil, False, CREATE_SUSPENDED, nil, nil, si, pi); }
ShowMsg('Preparing HOOK ' + Func2Hook + ' ...');
PtrReal := GetProcAddress(GetModuleHandle('Kernel32.dll'), Func2Hook);
if Assigned(PtrReal) then
ShowMsg('Real ' + Func2Hook + ' Addr: ' + inttohex(DWORD(PtrReal), 8))
else
begin
ShowMsg(' Addr: ' + Func2Hook + ' is unreadable! Exit!');
// ResumeThread(pi.hThread);
Exit;
end;
ReadProcessMemory(GetCurrentProcess, PtrReal, @Bytes, 5, Rtn);
// ReadProcessMemory(pi.hProcess, PtrReal, @Bytes, 5, Rtn);
if Bytes[0] Chr($E9) then
begin
CopyMemory(@OriginalBytes, @Bytes, 5);
ShowMsg(Func2Hook + ' havn''t been hooked!');
end
else
begin
ShowMsg(Func2Hook + ' have been hooked! Exit!');
// ResumeThread(pi.hThread);
exit;
end;
cbStolen :=0;
while cbStolen
