unit1.pas

为了防止被破解者用OLLDBG进行调试除了用加壳之外自己也可以用这个方式进行了一次检测!

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs,TLHELP32;

type
  TForm1 = class(TForm)
    procedure FormCreate(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}
//98下检查程序父进程是否为EXPLORER.EXE.NT/XP下检查是否为CMD.EXE
PROCEDURE CHECK_PARENTPROC;//检查自己的父进程
VAR
PN:TPROCESSENTRY32;
SHANDLE:THANDLE;
H,EXPLPROC,PARENTPROC:HWND;
FOUND:BOOLEAN;
BUFFER:ARRAY[0..1023]OF CHAR;
PATH:STRING;
BEGIN
H:=0;
EXPLPROC:=0;
PARENTPROC:=0;
//得到系统的目录
SETSTRING(PATH,BUFFER,GETWINDOWSDIRECTORY(BUFFER,SIZEOF(BUFFER)-1));
PATH:=UPPERCASE(PATH)+'\EXPLORER.EXE';//得到EXPLORER.EXE的路径
//得到所有进程的快照
SHANDLE:=CREATETOOLHELP32SNAPSHOT(TH32CS_SNAPALL,0);
FOUND:=PROCESS32FIRST(SHANDLE,PN); //查找进程
WHILE FOUND DO
BEGIN
  IF PN.szExeFile =PARAMSTR(0) THEN  //自己的进程
  BEGIN
    PARENTPROC:=PN.th32ProcessID;//得到父进程ID
    H:=OPENPROCESS(PROCESS_ALL_ACCESS,TRUE,PN.th32ProcessID);
    //父进程句柄
  END
  ELSE
  BEGIN
    IF UPPERCASE(PN.szExeFile)=PATH THEN
    BEGIN
      EXPLPROC:=PN.th32ProcessID;//EXPLOREX的ID
      FOUND:=PROCESS32NEXT(SHANDLE,PN);
    END;
  END;
  IF PARENTPROC<>EXPLPROC THEN
  BEGIN
    TERMINATEPROCESS(H,0);//杀之
    //这里可以写入死机的代码
  END;
END;
END;
procedure TForm1.FormCreate(Sender: TObject);
begin
  CHECK_PARENTPROC;
end;

end.