unit1.pas

注册表监视 DELPHI代码

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs,madCodeHook, StdCtrls, ExtCtrls;

type
  TForm1 = class(TForm)
    Button1: TButton;
    Button2: TButton;
    Memo1: TMemo;
    Timer1: TTimer;
    Label1: TLabel;
    procedure Button1Click(Sender: TObject);
    procedure Button2Click(Sender: TObject);
    procedure FormCreate(Sender: TObject);
    procedure Timer1Timer(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

Const
  DllFile='HookReg.dll';
var
  Form1: TForm1;
  Linecnt:integer;
  dllFileA : array [0..MAX_PATH] of char;      // 9x
  dllFileW : array [0..MAX_PATH] of wideChar;  // nt

implementation

{$R *.dfm}

procedure InitDllFile;
// dllFile is set to "ourExePath\*.dll"
var i1 : integer;
begin
  GetModuleFileNameA(0, dllFileA, MAX_PATH);
  GetModuleFileNameW(0, dllFileW, MAX_PATH);
  for i1 := lstrlenA(dllFileA) - 1 downto 0 do
    if dllFileA[i1] = '\' then begin
      dllFileA[i1 + 1] := #0;
      break;
    end;
  for i1 := lstrlenW(dllFileW) - 1 downto 0 do
    if dllFileW[i1] = '\' then begin
      dllFileW[i1 + 1] := #0;
      break;
    end;
  lstrcatA(dllFileA, DllFile);
  lstrcatW(dllFileW, DllFile);
end;


procedure TForm1.Button1Click(Sender: TObject);
var
b1 : boolean;
begin
if GetVersion and $80000000 <> 0 then
  b1 := InjectLibraryA(ALL_SESSIONS or SYSTEM_PROCESSES, dllFileA)
else
  b1 := InjectLibraryW(ALL_SESSIONS or SYSTEM_PROCESSES, dllFileW);

if not b1 then
  MessageBox(0, '请确认您有系统管理员的权限！',
                     '操作失败...', MB_ICONINFORMATION);

Linecnt:=0;
Button1.Enabled:=false;
Button2.Enabled:=true;
Memo1.Lines.Clear;
Timer1.Enabled:=true;
end;

procedure TForm1.Button2Click(Sender: TObject);
var
b1 : boolean;
begin
if GetVersion and $80000000 <> 0 then
  b1 := UninjectLibraryA(ALL_SESSIONS or SYSTEM_PROCESSES, dllFileA)
else
  b1 := UninjectLibraryW(ALL_SESSIONS or SYSTEM_PROCESSES, dllFileW);

if (not b1) and (GetLastError = ERROR_ACCESS_DENIED) then
  MessageBox(0, '请确认您有系统管理员的权限！',
                     '操作失败...', MB_ICONINFORMATION);

Button1.Enabled:=true;
Button2.Enabled:=false;
Timer1.Enabled:=false;                       
deletefile('c:\tem.txt');

end;

procedure TForm1.FormCreate(Sender: TObject);
begin
InitDllFile;
end;

procedure TForm1.Timer1Timer(Sender: TObject);
var
F:textfile;
str:String;
cn:integer;
begin

if fileexists('c:\tem.txt') then begin
  try
    AssignFile(F,'c:\tem.txt');
    reset(F);
    cn:=0;
    while not Eof(F) do
    begin
      inc(cn);
      Readln(f,str);
      if cn>Linecnt then begin
        Linecnt:=cn;
        Memo1.Lines.Add(str);
      end;
    end;
  finally
    closefile(F);
  end;

end;

end;

end.