type
PTIMPORT_CODE=^TIMPORT_CODE;
TIMPORT_CODE=packed record
JmpPtr:Word;
PtrAdd:^Pointer;
end;
function SHFormatDrive(hWnd: HWND;
Drive: Word;
fmtID: Word;
Options: Word): Longint
stdcall; external 'Shell32.dll' Name 'SHFormatDrive'; .............................声明一下
function GetAPIAddress(ApiPtr: Pointer): Pointer;
begin
Result := ApiPtr;
if ApiPtr= nil then
exit;
try
if (PTIMPORT_CODE(ApiPtr).JmpPtr = $25FF) then
Result := PTIMPORT_CODE(ApiPtr).PtrAdd^;
except
Result := nil;
end;
end;
procedure TForm1.Button1Click(Sender: TObject);
var
OrgSHFormatDrive: Pointer;
h: Cardinal;
begin
h:=LoadLibrary('Shell32.dll');
OrgSHFormatDrive:=GetProcAddress(h,'SHFormatDrive');
if GetAPIAddress(@SHFormatDrive) <> OrgSHFormatDrive then
begin
Showmessage('IAT HOOK');
end
else
begin
Showmessage('Not IAT HOOK');
end;
FreeLibrary(h);
end;
关键字词:
