Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

Delphi 

Delphi - Anti Runtime Hooking

Code
procedure hook(target, newfunc:pointer);
var
  jmpto:dword;
    OldProtect: Cardinal; // old protect in memory
begin
  jmpto:=dword(newfunc)-dword(target)-5;
  VirtualProtect(target, 5, PAGE_EXECUTE_READWRITE, @OldProtect);
  pbyte(target)^:=$e9;
  pdword(dword(target)+1)^:=jmpto;
end;

procedure myLdrLoadDll(PathToFile:PAnsiChar; Flags:variant; ModuleFileName:PAnsiChar; var ModuleHandle:THandle);
begin
  MessageBox(0, 'I have blocked your attempt to inject a dll file!!', 'WARNING!', MB_OK);
  ModuleHandle:=0;
end;

procedure Main;
begin
Hook(GetProcAddress(GetModuleHandle('ntdll.dll'), 'LdrLoadDll'), @myLdrLoadDll);
end;

begin
end.

Where a skid can be a skid!!


Possibly Related Threads...
Thread / Author Replies Views Last Post
[Help] by xray55Sep 28, 2021 12:11 PM 1 294 Sep 28, 2021 12:11 PM
Last Post: Sajuuk
[Delphi] by SIM-3298677Mar 6, 2018 10:26 AM 2 384 Mar 6, 2018 10:26 AM
Last Post: Mohinder
by thegodhelloJan 11, 2018 10:46 AM 11 1,677 Jan 11, 2018 10:46 AM
Last Post: evelboy