delphi中hookapi进行进程保护(不允许进程结束的方法).pdfVIP

Delphi 中 Hook API 进行进程保护 (不允许进程结束的方法 ) Delphi 中 Hook API 进行进程保护 (不允许进程结束的方 法) 减小字体 增大字体 const PRG_NAME = HA.exe; var TerminateProcessNext : function (processHandle, exitCode: dword) : bool; stdcall; NtTerminateProcessNext : function (processHandle, exitCode: dword) : dword; stdcall; { ＄R *.res} function ThisIsOurProcess(processHandle: dword): boolean; var pid: dword; arrCh: array [0 .. MAX_PATH] of char; begin pid := ProcessHandleToId(processHandle); result := (pid lt;gt; 0) and ProcessIdToFileName(pid, arrCh) and (PosText(PRG_NAME, arrCh) gt; 0); end; function TerminateProcessCallback(processHandle, exitCode: dword): bool; stdcall; begin if ThisIsOurProcess(processHandle) then begin result := false; SetLastError(ERROR_ACCESS_DENIED); end else result := TerminateProcessNext(processHandle, exitCode); end; function NtTerminateProcessCallback(processHandle, exitCode: dword): dword; stdcall; const STATUS_ACCESS_DENIED = ＄ C0000022; begin if ThisIsOurProcess(processHandle) then begin result := STATUS_ACCESS_DENIED end else result := NtTerminateProcessNext(processHandle, exitCode); end; begin if GetVersion and ＄= 0 then HookAPI(ntdll.dll, NtTerminateProcess, @NtTerminateProcessCallback, @NtTerminateProcessNext) else HookAPI(kernel32.dll, TerminateProcess, @TerminateProcessCallback, @TerminateProcessNext); end. 再写个 exe 调用这个 dll ，把这个 dll 插入到系统进程中去。 procedure inject; begin try if not InjectLibrary((CURRENT_SESSION or CURRENT_PROCESS), hook.dll) then begin ExitProcess(0); // 如果没有把 hook.dll 插入到进程中 去，那么程序就自动关闭 end; except // end; end; procedure uninject; // 把 hook.dll 从插入的进程中卸载掉 b