关于ＨＯＯＫ　ＡＰＩ的问题(100分)

ＤＬＬ正文
library hook;

uses
SysUtils,
windows,
Messages,
APIHook in 'APIHook.pas';

type
PData = ^TData;
TData = record
Hook: THandle;
Hooked: Boolean;
end;

var
DLLData: PData;
{------------------------------------}
procedure HookProc(nCode, wParam, lParam: LongWORD);stdcall;
begin
if not DLLData^.Hooked then
begin
HookAPI;
DLLData^.Hooked := True;
end;
CallNextHookEx(DLLData^.Hook, nCode, wParam, lParam);
end;



function InstallHook(SWindow: LongWORD):Boolean;stdcall;
var
ThreadID: LongWORD;
begin
Result := False;
DLLData^.Hook := 0;
ThreadID := GetWindowThreadProcessId(sWindow, nil);
DLLData^.Hook := SetWindowsHookEx(WH_GETMESSAGE, @HookProc,Hinstance, ThreadID);
if DLLData^.Hook > 0 then
Result := True
else
exit;
end;


procedure UnHook;stdcall;
begin
UnHookAPI;
UnhookWindowsHookEx(DLLData^.Hook);
end;

procedure MyDLLHandler(Reason: Integer);
var
FHandle: LongWORD;
begin
case Reason of
DLL_PROCESS_ATTACH:
begin
FHandle := CreateFileMapping($FFFFFFFF, nil, PAGE_READWRITE, 0,$ffff, 'MYDLLDATA');
if FHandle = 0 then
if GetLastError = ERROR_ALREADY_EXISTS then
begin
FHandle := OpenFileMapping(FILE_MAP_ALL_ACCESS, False,'MYDLLDATA');
if FHandle = 0 then Exit;
end else Exit;
DLLData := MapViewOfFile(FHandle, FILE_MAP_ALL_ACCESS, 0, 0, 0);
if DLLData = nil then
CloseHandle(FHandle);
end;
DLL_PROCESS_DETACH:
begin
if Assigned(DLLData) then
begin
UnmapViewOfFile(DLLData);
DLLData := nil;
end;
end;
end;
end;

{$R *.res}
exports
InstallHook, UnHook, HookProc;

begin
DLLProc := @MyDLLHandler;
MyDLLhandler(DLL_PROCESS_ATTACH);
DLLData^.Hooked := False;
end.

用到相关ＰＡＳ
unit APIHook;

interface

uses
SysUtils,
Windows, WinSock;
type tsockproc=procedure(code:integer);stdcall;
type
PJmpCode = ^TJmpCode;
TJmpCode = packed record
JmpCode: BYTE;
Address: TSockProc;
MovEAX: Array [0..2] of BYTE;
end;

//--------------------º¯ÊýÉùÃ÷---------------------------
procedure HookAPI;
procedure UnHookAPI;

var
OldSend, OldRecv: TSockProc; //Ô­À´µÄAPIµØÖ·
JmpCode: TJmpCode;
OldProc: array [0..1] of TJmpCode;
AddSend, AddRecv: pointer; //APIµØÖ·
TmpJmp: TJmpCode;
ProcessHandle: THandle;
implementation
////////////////////////////////////////////////////////////////////
procedure myexitprocess(code:integer);
begin
messagebox(0,'you know i','i am hook',mb_ok);
end;
{------------------------------------}
{¹ý³Ì¹¦ÄÜ:HookAPI
{¹ý³Ì²ÎÊý:ÎÞ
{------------------------------------}
procedure HookAPI;
var
DLLModule: THandle;
dwSize: cardinal;
begin
ProcessHandle := GetCurrentProcess;
DLLModule := LoadLibrary('kernel32.dll');
AddSend := GetProcAddress(DLLModule, 'ExitProcess'); //È¡µÃAPIµØÖ·
JmpCode.JmpCode := $B8;
JmpCode.MovEAX[0] := $FF;
JmpCode.MovEAX[1] := $E0;
JmpCode.MovEAX[2] := 0;
ReadProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize);
JmpCode.Address := @myexitprocess;
WriteProcessMemory(ProcessHandle, AddSend, @JmpCode, 8, dwSize); //ÐÞ¸ÄSendÈë¿Ú
OldSend := AddSend;
end;

{------------------------------------}
{¹ý³Ì¹¦ÄÜ:È¡ÏûHOOKAPI
{¹ý³Ì²ÎÊý:ÎÞ
{------------------------------------}
procedure UnHookAPI;
var
dwSize: Cardinal;
begin
WriteProcessMemory(ProcessHandle, AddSend, @OldProc[0], 8, dwSize);
end;

end.

／／主程序调用
function installhook(swindow:longint):boolean;stdcall;external 'hook.dll';
procedure TForm1.Button9Click(Sender: TObject);
begin
installhook(form1.Handle);
exitprocess(0);
end;

现在的问题是主程序根本就无法运行

我准备用我自己写的ＭＹＥＸＩＴＰＲＯＣＥＳＳ来取代系统的ＥＸＩＴＰＲＯＣＥＳＳ

顶一下

再顶

WIN98下去用用看
这篇文章网上到处转载.都没说是在WIN98下的

我没９８只有ＸＰ

2K以后的操作系统下的API HOOK也有例子.但这里的人一般不会说的
要他们回答你的话也是到网上去转载篇错误百出的文章给你.
楼主是写外挂或木马吧?这些都是很有意思的偏门
l楼主自己研究吧

楼主是写外挂或木马吧?这些都是很有意思的偏门


１不写外挂
２　不写木马

只想研究这门技术而已，谢谢你

顶

顶

多人接受答案了。