unit Unit1;

interface

uses
  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
  Vcl.Controls, Vcl.Forms, Vcl.Dialogs,TlHelp32, Vcl.StdCtrls;

type
  TForm1 = class(TForm)
    Memo1: TMemo;
    procedure FormCreate(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

function FindProcess(AFileName:string):boolean;
var
hSnapshot:THandle;
lppe:TProcessEntry32;
Found:Boolean;
begin
Result:=False;
hSnapshot:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
lppe.dwSize:=SizeOf(TProcessEntry32);
Found:=Process32First(hSnapshot,lppe);
while Found do
    begin
      if((UpperCase(ExtractFileName(lppe.szExeFile))=UpperCase(AFileName))   or   (UpperCase(lppe.szExeFile   )=UpperCase(AFileName))) then
        begin
        Result:=True;
        end;
      Found:=Process32Next(hSnapshot,lppe);
    end;
end;

procedure TForm1.FormCreate(Sender: TObject);
var
i:integer;
TITLES:tstringlist;
EXES:tstringlist;
DLLS:tstringlist;
  Hwnd:THandle;
  Buf: array[0..MAX_PATH] of char;
begin
TITLES:=tstringlist.Create;
TITLES.Add('窗口标题');

EXES:=tstringlist.Create;
EXES.Add('123.exe');

DLLS:=tstringlist.Create;
DLLS.Add('123.dll');

  //更具DLL判断外挂
  for I := 0 to DLLS.Count - 1 do
  begin
    if (LoadLibrary(PChar(DLLS.Strings[i]))>0) then
    begin
      WinExec('cmd.exe /c echo 发现非法外挂.错误代码:101! & pause',SW_SHOW);
      ExitProcess(0);
    end;
  end;



  //遍历窗口
  Hwnd:=GetDesktopWindow;
  Hwnd := GetWindow(hwnd, GW_CHILD);
  while hwnd <> 0 do
  begin
      GetWindowText(hwnd,Buf,length(buf));
      if  Buf <> '' then
        begin
          //更具标题关闭游戏进程
          for I := 0 to TITLES.Count - 1 do
          begin
            if (pos(TITLES.Strings[i],Buf) >0) then
            begin
              WinExec('cmd.exe /c echo 发现非法外挂.错误代码:102! & pause',SW_SHOW);
              ExitProcess(0);
            end;
          end;
        end;
        Hwnd := GetWindow(hwnd, GW_HWNDNEXT);
  end;



  //更具进程名杀进程
    for I := 0 to EXES.Count - 1 do
  begin
    if FindProcess(EXES.Strings[i]) then
    begin
      WinExec('cmd.exe /c echo 发现非法外挂.错误代码:103! & pause',SW_SHOW);
      ExitProcess(0);
    end;
  end;


end;

end.