shellabout.dpr

Cracker终结者——提供最优秀的软件保护技术

// Shows HOOK_ALL_SAFE and both ways of allocating space for routine

library
  ShellAbout;
  {$IMAGEBASE $56780000}

uses
  ApiHooks, Windows, ShellApi;

type
  ShellAboutAType = function(hWnd :LongWord; szApp :PAnsiChar; szOtherStuff :PAnsiChar; hIcon :LongWord) :LongWord; stdcall;
  ShellAboutWType = function(hWnd :LongWord; szApp :PWideChar; szOtherStuff :PWideChar; hIcon :LongWord) :LongWord; stdcall;

  Routine  = array[0..31] of Byte;
  PRoutine = ^Routine;

function
  NewShellAboutA(hWnd :LongWord; szApp :PAnsiChar; szOtherStuff :PAnsiChar; hIcon :LongWord) :LongWord; stdcall; forward;
function
  NewShellAboutW(hWnd :LongWord; szApp :PWideChar; szOtherStuff :PWideChar; hIcon :LongWord) :LongWord; stdcall; forward;

var
  SHAA : Routine = (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);
  OldShellAboutA : PRoutine = @SHAA;      //use own space
  OldShellAboutW : ShellAboutWType = nil; //alloc from heap

  ApiHookChain :array[0..2] of API_HOOK = (
    (ModuleExport: 'SHELL32.dll'; ApiNameOrOrd: 'ShellAboutA'; dwFlags: HOOK_ALL_SAFE or HOOK_NOT_NT; ModuleImport:  @OldShellAboutA; UnhookAddresses: nil; HookAddress: @NewShellAboutA),
    (ModuleExport: 'SHELL32.dll'; ApiNameOrOrd: 'ShellAboutW'; dwFlags: HOOK_ALL_SAFE or HOOK_NOT_9X; ModuleImport: @@OldShellAboutW; UnhookAddresses: nil; HookAddress: @NewShellAboutW),
    (ModuleExport: HOOKS_END)
  );

function NewShellAboutA(hWnd :LongWord; szApp :PAnsiChar; szOtherStuff :PAnsiChar; hIcon :LongWord) :LongWord; stdcall;
  var
    pShellAboutA : ShellAboutAType;
  begin
  if ApiHookChain[0].ModuleImport = ALL_MODULES then
    pShellAboutA :=    @ShellAboutA
  else
    pShellAboutA :=  ShellAboutAType(OldShellAboutA);
  NewShellAboutA := pShellAboutA(hWnd, 'Abacus', szOtherStuff, hIcon);
end;

function NewShellAboutW(hWnd :LongWord; szApp :PWideChar; szOtherStuff :PWideChar; hIcon :LongWord) :LongWord; stdcall;
  var
    pShellAboutW : ShellAboutWType;
  begin
  if ApiHookChain[1].ModuleImport = ALL_MODULES then
    pShellAboutW :=    @ShellAboutW
  else
    pShellAboutW :=    OldShellAboutW;
  NewShellAboutW := pShellAboutW(hWnd, 'Abacus', szOtherStuff, hIcon);
end;

// ApiHookChain can be exported via
exports
  ApiHookChain;

{ // or GetApiHookChain can be exported:
function GetApiHookChain() :PAPI_HOOK_CHAIN; stdcall;
begin
 GetApiHookChain := @ApiHookChain;
end;
exports GetApiHookChain;
}

begin
end.