Hack Forums
[Delphi] Delphi - Anti Runtime Hooking - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Coders Lounge (https://hackforums.net/forumdisplay.php?fid=5)
+---- Thread: [Delphi] Delphi - Anti Runtime Hooking (/showthread.php?tid=5852303)

Delphi - Anti Runtime Hooking - Crakxproo - Jun 21, 2018

Code
procedure hook(target, newfunc:pointer);
var
  jmpto:dword;
    OldProtect: Cardinal; // old protect in memory
begin
  jmpto:=dword(newfunc)-dword(target)-5;
  VirtualProtect(target, 5, PAGE_EXECUTE_READWRITE, @OldProtect);
  pbyte(target)^:=$e9;
  pdword(dword(target)+1)^:=jmpto;
end;

procedure myLdrLoadDll(PathToFile:PAnsiChar; Flags:variant; ModuleFileName:PAnsiChar; var ModuleHandle:THandle);
begin
  MessageBox(0, 'I have blocked your attempt to inject a dll file!!', 'WARNING!', MB_OK);
  ModuleHandle:=0;
end;

procedure Main;
begin
Hook(GetProcAddress(GetModuleHandle('ntdll.dll'), 'LdrLoadDll'), @myLdrLoadDll);
end;

begin
end.

Where a skid can be a skid!!