kbhook.dpr

Delphi QQ连连看外挂源码。 利用全局DLL监控

library kbhook;

{ Important note about DLL memory management: ShareMem must be the
first unit in your library's USES clause AND your project's (select
Project-View Source) USES clause if your DLL exports any procedures or
functions that pass strings as parameters or function results. This
applies to all strings passed to and from your DLL--even those that
are nested in records and classes. ShareMem is the interface unit to
the BORLNDMM.DLL shared memory manager, which must be deployed along
with your DLL. To avoid using BORLNDMM.DLL, pass string information
using PChar or ShortString parameters. }

uses
  windows;
var
  hHk: HHOOK;
  BFirst:Boolean=True;
  //{$R *.res}
procedure ModMemData();
var
  pData: pointer;
  dwOldProtect: DWORD;
  mbi_thunk: TMemoryBasicInformation;
begin
  pData := pointer($00403296);
  //查询页信息。
  VirtualQuery(pData, mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));
  //改变页保护属性为读写。
  VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,
    PAGE_READWRITE, mbi_thunk.Protect);
  //清零。
  PByte(pData)^ := 0;
  //恢复页的原保护属性。
  VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,
    mbi_thunk.Protect, dwOldProtect);
end;

function keyHookProc(nCode: Integer; WParam: WPARAM; LParam: LPARAM): LRESULT;
  stdcall;
const
  _KeyPressMask = $80000000;
begin
  Result := 0;
  if nCode < 0 then
  begin
    Result := CallNextHookEx(hhk, nCode, wParam, lParam);

    Exit;
  end
  else
  begin
    if BFirst then
    // 侦测 Ctrl + B 组合键
    //if ((lParam and _KeyPressMask) = 0) and (GetKeyState(vk_Control) < 0) and
     // (wParam = VK_F2) then
      //(GetKeyState(vk_Control) < 0) and (wParam = Ord('B')) then
    begin
      Result := 1;
      ModMemData;
      BFirst:=False;

      //MessageBox(0, 'ok','',MB_OK);
     // MessageBox(0, pchar(GetModuleName(GetModuleHandle(nil))),
      // pchar(inttostr(GetCurrentThread)), 0);
    end;
  end;

end;

function SetKbHook(threadid: DWORD): boolean; stdcall; export; //外部调用
begin
  if threadid <> 0 then
  begin
    hHk := SetWindowsHookEx(WH_GETMESSAGE, @keyHookProc, HInstance, threadid);
    result := hhk <> 0;
  end
  else
  begin
    Result := UnHookWindowsHookEx(hHk);
  end;
  BFirst:=True;
end;

exports
  SetKbHook;
end.