RSS订阅 | 匿名投稿
您的位置:网站首页 > 黑客 > 正文

delphi 检测 IAT HOOK API 的方法

作者:admin 来源: 日期:2011/8/16 9:39:27 人气: 标签:

 type
PTIMPORT_CODE=^TIMPORT_CODE;
TIMPORT_CODE=packed record
JmpPtr:Word;
PtrAdd:^Pointer;
end;



function SHFormatDrive(hWnd: HWND;
Drive: Word;
fmtID: Word;
Options: Word): Longint
stdcall; external 'Shell32.dll' Name 'SHFormatDrive'; .............................声明一下



function GetAPIAddress(ApiPtr: Pointer): Pointer;
begin
Result := ApiPtr;
if ApiPtr= nil then
exit;
try
if (PTIMPORT_CODE(ApiPtr).JmpPtr = $25FF) then
Result := PTIMPORT_CODE(ApiPtr).PtrAdd^;
except
Result := nil;
end;
end;


procedure TForm1.Button1Click(Sender: TObject);
var
OrgSHFormatDrive: Pointer;
h: Cardinal;
begin
h:=LoadLibrary('Shell32.dll');
OrgSHFormatDrive:=GetProcAddress(h,'SHFormatDrive');
if GetAPIAddress(@SHFormatDrive) <> OrgSHFormatDrive then

begin
Showmessage('IAT HOOK');

end
else

begin
Showmessage('Not IAT HOOK');

end;
FreeLibrary(h);
end;
读完这篇文章后,您心情如何?
0
0
0
0
0
0
0
0
本文网址: