function BlockAPI(hProcess : THANDLE; libName, apiName : PAnsiChar) : Boolean;
var
pRet : Char;
hLib : THandle;
pAddr : Pointer;
dwRet : DWORD;
begin
pRet := #$C3;
//hLib := nil;
Result := False;
hLib := LoadLibrary(libName);
if hLib > 0 then
begin
pAddr := GetProcAddress(hLib, apiName);
if pAddr <> nil then
begin
if WriteProcessMemory(hProcess, pAddr, @pRet, SizeOf(pRet), dwRet) then
if dwRet > 0 then
Result := True;
end;
FreeLibrary(hLib);
end;
end;
procedure AntiInject;
var
hProc : THANDLE;
begin
hProc := GetCurrentProcess;
while True do
begin
BlockAPI(hProc, 'NTDLL.DLL', 'LdrLoadDll');
Sleep (100);
end;
end;
procedure AntiInject2;
var
hProc : THnadle;
begin
hProc := FindWindow(nil, 'Gunz');
while True do
begin
BlockAPI(hProc, 'NTDLL.DLL', 'LdrLoadDll');
Sleep (100);
end;
end;
function BlockAPI(hProcess : THANDLE; libName, apiName : PAnsiChar; ParamsCount : byte) : Boolean;
var
pRet : Char;
hLib : THandle;
pAddr : Pointer;
dwRet : array [0..2] of byte;
begin
Result := False;
hLib := LoadLibrary(libName);
if hLib > 0 then
begin
pAddr := GetProcAddress(hLib, apiName);
if pAddr <> nil then
begin
if ParamCount = 0 then
begin
dwRet[0] := $C3;
Result := WriteProcessMemory(hProcess, pAddr, @pRet, 1, dwRet);
end else
begin
dwRet[0] := $C2;
dwRet[1] := ParamsCount * 4;
dwRet[2] := 0;
Result := WriteProcessMemory(hProcess, pAddr, @pRet, 3, dwRet);
end;
end;
FreeLibrary(hLib);
end;
end;
procedure AntiInject;
var
hProc : THANDLE;
begin
hProc := GetCurrentProcess;
while True do
begin
BlockAPI(hProc, 'NTDLL.DLL', 'LdrLoadDll', 4);
Sleep (100);
end;
end;
procedure AntiInject2;
var
hProc : THnadle;
begin
hProc := FindWindow(nil, 'Gunz');
while True do
begin
BlockAPI(hProc, 'NTDLL.DLL', 'LdrLoadDll', 4);
Sleep (100);
end;
end;
ok but i saw this line hProc := FindWindow(nil, 'Gunz'); i have to replace 'Gunz' witch my window name? e.g if i wana put this on Notepad i must put like this hProc := FindWindow(nil, 'Notepad'); ?
lolalexlol wrote:ok but i saw this line hProc := FindWindow(nil, 'Gunz'); i have to replace 'Gunz' witch my window name? e.g if i wana put this on Notepad i must put like this hProc := FindWindow(nil, 'Notepad'); ?
Yes, this is possible and your code is correct. Only note, FindWindow searches for a exact match of the Window Text which is not always known. So if the window text will be 'Notepad1', your check will fail.