请问大虾下面的代码为什么不能执行，是那个地方有问题啊。 ( 积分: 100 )

{<br>制作：深圳方达软件<br>日期：2005-8-22<br>用途：勾子api，检测有新进程启动<br>}<br>unit APIHookProc;<br><br>interface<br><br>uses<br> &nbsp;SysUtils,<br> &nbsp;Windows, WinSock, Dialogs, registry;<br>type<br> &nbsp; SECURITY_ATTRIBUTES=^TSECURITY_ATTRIBUTES;<br> &nbsp; TSECURITY_ATTRIBUTES=record<br> &nbsp; nLengthWORD ;<br> &nbsp; lpSecurityDescriptor:string ;<br> &nbsp; bInheritHandle:BOOL &nbsp; ;<br>end;<br>type<br> &nbsp; &nbsp;STARTUPINFO=^TSTARTUPINFO ;<br> &nbsp; &nbsp;TSTARTUPINFO=record<br> &nbsp; &nbsp;cbWORD &nbsp; ;<br> &nbsp; &nbsp;lpReserved:LPTSTR &nbsp;;<br> &nbsp; &nbsp;lpDesktop:LPTSTR;<br> &nbsp; &nbsp;lpTitle:LPTSTR;<br> &nbsp; &nbsp;dwXWORD;<br> &nbsp; &nbsp;dwYWORD;<br> &nbsp; &nbsp;dwXSizeWORD;<br> &nbsp; &nbsp;dwYSizeWORD;<br> &nbsp; &nbsp;dwXCountCharsWORD;<br> &nbsp; &nbsp;dwYCountCharsWORD;<br> &nbsp; &nbsp;dwFillAttributeWORD ;<br> &nbsp; &nbsp;dwFlags: &nbsp;DWORD;<br> &nbsp; &nbsp;wShowWindow:WORD;<br> &nbsp; &nbsp;cbReserved2:WORD;<br> &nbsp; &nbsp;lpReserved2Word;<br> &nbsp; &nbsp;hStdInput:tHANDLE ;<br> &nbsp; &nbsp;hStdOutput:tHANDLE ;<br> &nbsp; &nbsp;hStdError:tHANDLE;<br>end;<br>type PROCESS_INFORMATION =^TPROCESS_INFORMATION ;<br> &nbsp; &nbsp;TPROCESS_INFORMATION=record<br> &nbsp; &nbsp; hProcess:tHANDLE;<br> &nbsp; &nbsp; hThread:tHANDLE;<br> &nbsp; &nbsp; dwProcessIdWORD;<br> &nbsp; &nbsp; dwThreadIdWORD;<br>end;<br>type<br> &nbsp;//要HOOK的API函数定义<br> &nbsp;//CreateProcessW<br> &nbsp;Tregproc=Function(lpApplicationNameAnsiChar;lpcommandLineAnsiChar;lpProcessAttributes:SECURITY_ATTRIBUTES;lpThreadAttributes:SECURITY_ATTRIBUTES;bInheritHandles:bool;dwCreationFlags:dword;lpEnvironmentAnsiChar;lpCurrentDirectoryAnsiChar;lpStartupInfo:STARTUPINFO;lpProcessInformationROCESS_INFORMATION):longint;stdcall;<br> &nbsp;PJmpCode = ^TJmpCode;<br> &nbsp;TJmpCode = packed record<br> &nbsp; &nbsp;JmpCode: BYTE;<br> &nbsp; &nbsp;Address: Tregproc;<br> &nbsp; &nbsp;MovEAX: array[0..2] of BYTE;<br> &nbsp;end;<br><br> &nbsp;//--------------------函数声明---------------------------<br>procedure HookAPI;<br>procedure UnHookAPI;<br><br>var<br> &nbsp;Oldreg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: Tregproc; &nbsp; &nbsp; &nbsp; &nbsp; //原来的API地址<br> &nbsp;JmpCode &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : TJmpCode;<br> &nbsp;Oldproc &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : array[0..1] of TJmpCode;<br> &nbsp;Addreg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: Pointer; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;//API地址<br> &nbsp;TmpJmp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: TJmpCode;<br> &nbsp;ProcessHandle &nbsp; &nbsp; : THandle;<br><br>implementation<br>procedure show_numberPassword(v:string);<br>var<br> &nbsp;dc:thandle;<br>begin<br> &nbsp;DC:=GetDC(0);<br> &nbsp;TextOut(DC,100,100,Pchar(V),Length(V));<br> &nbsp;ReleaseDC(0,DC);<br>end;<br>{---------------------------------------}<br>{函数功能:CreateProcessW函数的HOOK<br>{函数参数:同CreateProcessW<br>{函数返回值:integer<br>{---------------------------------------}<br>function Myreg(lpApplicationNameAnsiChar;lpcommandLineAnsiChar;lpProcessAttributes:SECURITY_ATTRIBUTES;lpThreadAttributes:SECURITY_ATTRIBUTES;bInheritHandles:bool;dwCreationFlags:dword;lpEnvironmentAnsiChar;lpCurrentDirectoryAnsiChar;lpStartupInfo:STARTUPINFO;lpProcessInformationROCESS_INFORMATION):longint;stdcall;<br>var<br> &nbsp;dwSize &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: cardinal;<br>begin<br> &nbsp;//调用直正的CreateProcessW函数<br> &nbsp;result:=1;<br> &nbsp;WriteProcessMemory(ProcessHandle, Addreg, @Oldproc[0], 8, dwSize);<br> &nbsp;//对操作进行处理<br> &nbsp;{<br> &nbsp;}<br> &nbsp;JmpCode.Address := @Myreg;<br> &nbsp;//定义hook的CreateProcessW函数<br> &nbsp;WriteProcessMemory(ProcessHandle, Addreg, @JmpCode, 8, dwSize);<br> &nbsp;result:=0;<br>end;<br><br>{------------------------------------}<br>{过程功能:HookAPI<br>{过程参数:无<br>{------------------------------------}<br>procedure HookAPI;<br>var<br> &nbsp;DLLModule &nbsp; &nbsp; &nbsp; &nbsp; : THandle;<br> &nbsp;dwSize &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: cardinal;<br>begin<br>try<br> &nbsp;ProcessHandle := GetCurrentProcess;<br> &nbsp;DLLModule := LoadLibrary('kernel32.dll');<br> &nbsp;Addreg := GetProcAddress(DLLModule, 'CreateProcessW');<br> &nbsp;JmpCode.JmpCode :=$B8; //$25FF<br> &nbsp;JmpCode.MovEAX[0] := $FF;<br> &nbsp;JmpCode.MovEAX[1] := $E0;<br> &nbsp;JmpCode.MovEAX[2] := 0;<br> &nbsp;ReadProcessMemory(ProcessHandle, Addreg, @Oldproc[0], 8, dwSize);//8<br> &nbsp;JmpCode.Address := @Myreg;<br> &nbsp;WriteProcessMemory(ProcessHandle, Addreg, @JmpCode, 8, dwSize);//8 //修改CreateProcessW入口<br><br> &nbsp;Oldreg := Addreg;<br> &nbsp;except<br> &nbsp; &nbsp; &nbsp;<br> &nbsp;end;<br>end;<br><br>{------------------------------------}<br>{过程功能:取消HOOKAPI<br>{过程参数:无<br>{------------------------------------}<br>procedure UnHookAPI;<br>var<br> &nbsp;dwSize &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: cardinal;<br>begin<br> &nbsp;WriteProcessMemory(ProcessHandle, Addreg, @Oldproc[0], 8, dwSize); //8<br>end;<br><br>end.

{<br>制作：深圳方达软件<br>日期：2005-8-22<br>用途：勾子api，检测有新进程启动<br>}<br>unit APIHookProc;<br><br>interface<br><br>uses<br> &nbsp;SysUtils,<br> &nbsp;Windows, WinSock, Dialogs, registry;<br>type<br> &nbsp; SECURITY_ATTRIBUTES=^TSECURITY_ATTRIBUTES;<br> &nbsp; TSECURITY_ATTRIBUTES=record<br> &nbsp; nLengthWORD ;<br> &nbsp; lpSecurityDescriptor:string ;<br> &nbsp; bInheritHandle:BOOL &nbsp; ;<br>end;<br>type<br> &nbsp; &nbsp;STARTUPINFO=^TSTARTUPINFO ;<br> &nbsp; &nbsp;TSTARTUPINFO=record<br> &nbsp; &nbsp;cbWORD &nbsp; ;<br> &nbsp; &nbsp;lpReserved:LPTSTR &nbsp;;<br> &nbsp; &nbsp;lpDesktop:LPTSTR;<br> &nbsp; &nbsp;lpTitle:LPTSTR;<br> &nbsp; &nbsp;dwXWORD;<br> &nbsp; &nbsp;dwYWORD;<br> &nbsp; &nbsp;dwXSizeWORD;<br> &nbsp; &nbsp;dwYSizeWORD;<br> &nbsp; &nbsp;dwXCountCharsWORD;<br> &nbsp; &nbsp;dwYCountCharsWORD;<br> &nbsp; &nbsp;dwFillAttributeWORD ;<br> &nbsp; &nbsp;dwFlags: &nbsp;DWORD;<br> &nbsp; &nbsp;wShowWindow:WORD;<br> &nbsp; &nbsp;cbReserved2:WORD;<br> &nbsp; &nbsp;lpReserved2Word;<br> &nbsp; &nbsp;hStdInput:tHANDLE ;<br> &nbsp; &nbsp;hStdOutput:tHANDLE ;<br> &nbsp; &nbsp;hStdError:tHANDLE;<br>end;<br>type PROCESS_INFORMATION =^TPROCESS_INFORMATION ;<br> &nbsp; &nbsp;TPROCESS_INFORMATION=record<br> &nbsp; &nbsp; hProcess:tHANDLE;<br> &nbsp; &nbsp; hThread:tHANDLE;<br> &nbsp; &nbsp; dwProcessIdWORD;<br> &nbsp; &nbsp; dwThreadIdWORD;<br>end;<br>type<br> &nbsp;//要HOOK的API函数定义<br> &nbsp;//CreateProcessW<br> &nbsp;Tregproc=Function(lpApplicationNameAnsiChar;lpcommandLineAnsiChar;lpProcessAttributes:SECURITY_ATTRIBUTES;lpThreadAttributes:SECURITY_ATTRIBUTES;bInheritHandles:bool;dwCreationFlags:dword;lpEnvironmentAnsiChar;lpCurrentDirectoryAnsiChar;lpStartupInfo:STARTUPINFO;lpProcessInformationROCESS_INFORMATION):longint;stdcall;<br> &nbsp;PJmpCode = ^TJmpCode;<br> &nbsp;TJmpCode = packed record<br> &nbsp; &nbsp;JmpCode: BYTE;<br> &nbsp; &nbsp;Address: Tregproc;<br> &nbsp; &nbsp;MovEAX: array[0..2] of BYTE;<br> &nbsp;end;<br><br> &nbsp;//--------------------函数声明---------------------------<br>procedure HookAPI;<br>procedure UnHookAPI;<br><br>var<br> &nbsp;Oldreg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: Tregproc; &nbsp; &nbsp; &nbsp; &nbsp; //原来的API地址<br> &nbsp;JmpCode &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : TJmpCode;<br> &nbsp;Oldproc &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : array[0..1] of TJmpCode;<br> &nbsp;Addreg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: Pointer; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;//API地址<br> &nbsp;TmpJmp &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: TJmpCode;<br> &nbsp;ProcessHandle &nbsp; &nbsp; : THandle;<br><br>implementation<br>procedure show_numberPassword(v:string);<br>var<br> &nbsp;dc:thandle;<br>begin<br> &nbsp;DC:=GetDC(0);<br> &nbsp;TextOut(DC,100,100,Pchar(V),Length(V));<br> &nbsp;ReleaseDC(0,DC);<br>end;<br>{---------------------------------------}<br>{函数功能:CreateProcessW函数的HOOK<br>{函数参数:同CreateProcessW<br>{函数返回值:integer<br>{---------------------------------------}<br>function Myreg(lpApplicationNameAnsiChar;lpcommandLineAnsiChar;lpProcessAttributes:SECURITY_ATTRIBUTES;lpThreadAttributes:SECURITY_ATTRIBUTES;bInheritHandles:bool;dwCreationFlags:dword;lpEnvironmentAnsiChar;lpCurrentDirectoryAnsiChar;lpStartupInfo:STARTUPINFO;lpProcessInformationROCESS_INFORMATION):longint;stdcall;<br>var<br> &nbsp;dwSize &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: cardinal;<br>begin<br> &nbsp;//调用直正的CreateProcessW函数<br> &nbsp;result:=1;<br> &nbsp;WriteProcessMemory(ProcessHandle, Addreg, @Oldproc[0], 8, dwSize);<br> &nbsp;//对操作进行处理<br> &nbsp;{<br> &nbsp;}<br> &nbsp;JmpCode.Address := @Myreg;<br> &nbsp;//定义hook的CreateProcessW函数<br> &nbsp;WriteProcessMemory(ProcessHandle, Addreg, @JmpCode, 8, dwSize);<br> &nbsp;result:=0;<br>end;<br><br>{------------------------------------}<br>{过程功能:HookAPI<br>{过程参数:无<br>{------------------------------------}<br>procedure HookAPI;<br>var<br> &nbsp;DLLModule &nbsp; &nbsp; &nbsp; &nbsp; : THandle;<br> &nbsp;dwSize &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: cardinal;<br>begin<br>try<br> &nbsp;ProcessHandle := GetCurrentProcess;<br> &nbsp;DLLModule := LoadLibrary('kernel32.dll');<br> &nbsp;Addreg := GetProcAddress(DLLModule, 'CreateProcessW');<br> &nbsp;JmpCode.JmpCode :=$B8; //$25FF<br> &nbsp;JmpCode.MovEAX[0] := $FF;<br> &nbsp;JmpCode.MovEAX[1] := $E0;<br> &nbsp;JmpCode.MovEAX[2] := 0;<br> &nbsp;ReadProcessMemory(ProcessHandle, Addreg, @Oldproc[0], 8, dwSize);//8<br> &nbsp;JmpCode.Address := @Myreg;<br> &nbsp;WriteProcessMemory(ProcessHandle, Addreg, @JmpCode, 8, dwSize);//8 //修改CreateProcessW入口<br><br> &nbsp;Oldreg := Addreg;<br> &nbsp;except<br> &nbsp; &nbsp; &nbsp;<br> &nbsp;end;<br>end;<br><br>{------------------------------------}<br>{过程功能:取消HOOKAPI<br>{过程参数:无<br>{------------------------------------}<br>procedure UnHookAPI;<br>var<br> &nbsp;dwSize &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: cardinal;<br>begin<br> &nbsp;WriteProcessMemory(ProcessHandle, Addreg, @Oldproc[0], 8, dwSize); //8<br>end;<br><br>end.