Location:
Search - hook delphi
Search list
Description: delphi键盘记录原码 -keylogger delphi source delphi keylogger source code
Platform: |
Size: 2048 |
Author: |
Hits:
Description: 用DDDK编写驱动,修改SSDT表HOOK NTDebugActiveProcess函数
钩子函数中可以判断PID号,决定是否放行,放行则在钩子函数中调用原来的NTDebugActiveProcess函数.否则直接返回False.HOOK成功后所有调用DebugActiveProcess的程序将会失效.当然可以按照你的需要HOOK更多的系统服务函数.同一服务函数的服务号在每个操作系统版本中是不同的.下面附件中编译完成的驱动请在WinXP SP2的环境下测试.否则可能会导致直接重启-Used to prepare DDDK drive, modify SSDT Table HOOK NTDebugActiveProcess function hook function can determine the PID number, decide whether to release, release in the hook function to call the original function NTDebugActiveProcess. False.HOOK Otherwise, after the success of a direct return all calls DebugActiveProcess procedures will be failure. You can, of course, in accordance with the needs of more system services HOOK function. the same service function of the service in each of the operating system versions are different. following the completion of the annex to compile drivers in WinXP SP2 test environment. or else may lead to the resumption of direct
Platform: |
Size: 3072 |
Author: 张京 |
Hits:
Description: hook winAPI达到隐藏进程端口服务注册表等-process to reach the hidden hook winAPI service registry, such as port
Platform: |
Size: 270336 |
Author: fyz |
Hits:
Description: DELHPI HOOK源码 -Source DELHPI HOOK
Platform: |
Size: 169984 |
Author: |
Hits:
Description: HOOK,
监控-HOOK, monitoring
Platform: |
Size: 7168 |
Author: |
Hits:
Description: 一个利用键盘低级钩子锁屏的实例，禁止了alt+tab,alt+esc,开始菜单,ctl+alt+del等系统热键-A use of low-level keyboard hook lock screen examples of banned alt+ Tab, alt+ Esc, Start menu, ctl+ Alt+ Del hotkeys, etc.
Platform: |
Size: 226304 |
Author: 天一 |
Hits:
Description: Start.exe 安装 Insert.dll 中的 WH_GETMESSAGE 钩子. 当任何一个进程从
消息队列取消息时, Insert.dll 都将被装入其空间. Insert.dll在入口代码
中判断当前进入的进程模块名, 如果是 Explorer则建立一个线程, 并发消息
通知 Start.exe退出. 这个时候建立的新线程, 当然是属于Explorer进程的,
这就是关键之所在了. 另外, 该线程还建立了一个窗体, 可以设定IE首页. :~)-Start.exe installation of Insert.dll hook WH_GETMESSAGE. When any one process from the message queue check news, Insert.dll will be put into its space. Insert.dll at the entry code to enter the process to determine the current module name, if is the Explorer is the creation of a thread, and发消息Start.exe quit notice. this time the new thread, of course, is the Explorer process, and this is the key to a. In addition, the thread has also set up a form, can set the IE homepage.: ~)
Platform: |
Size: 29696 |
Author: hss |
Hits:
Description: 使用TDI 和Filter-Hook进行网络数据拦截的两个例子, 以前外挂用过-The use of TDI and the Filter-Hook for network data to intercept the two examples previously used plug-ins
Platform: |
Size: 163840 |
Author: Yofoo |
Hits:
Description: 注册表钩子，可防止非法修改电脑注册表，请站长审核开通帐号．-Hook registry, computer registry to prevent illegal modifications, please head audited accounts opened.
Platform: |
Size: 342016 |
Author: foxconn |
Hits:
Description: Hooking DLL. Windows hook library. Keyboard, mouse, journal hooking etc.
Platform: |
Size: 149504 |
Author: selamicik |
Hits:
Description: 一个delphi的使自己的进程不能被taskmgr杀掉的示范源码.-A delphi process of making their own can not be taskmgr kill source model.
Platform: |
Size: 234496 |
Author: daemen |
Hits:
Description: DELPHI恢复SSDT源码
有搞这方面的人可以学习一下-DELPHI source SSDT has engaged in the restoration of this area can learn about
Platform: |
Size: 439296 |
Author: lianx |
Hits:
Description: Hook Api Library 0.2 [Ring0&3] By Anskya
Email:Anskya@Gmail.com
ring3 inline hook For Api
Thank:
前29A高手也一直都是我的偶像...z0mbie大牛...这里膜拜一下
使用的LDE32引擎是翻译他老人家的...C->Delphi...
说明:
1.利用堆栈跳转
没有使用传统的jmp xxxx 长跳转,使用容易理解的push xxxx+ret
仔细看代码容易理解...封装完好.
2.内存补丁结构:
补丁1:|push xxx--钩子处理过程|ret|
补丁2:|保存原始补丁地址|保存原始地址代码长度|原始地址的代码|push xxxxxx|ret|
更新说明:
0.2:
支持Ring0 Inline Hook
0.1:
Ring3 Inline Hook
-Hook Api Library 0.2 [Ring0
Platform: |
Size: 6144 |
Author: david |
Hits:
Description: The dll project hook to dll .if u wanna hacker or cracker.it must help u
Platform: |
Size: 709632 |
Author: 唐小明 |
Hits:
Description: QQ2008木马源代码，带编译方法。1, 打开 DLL，打开Hook.dpr，project -> Build Hook 得到HOOK.dll 。
2, 运行Brcc.bat,得到hook.res。
3, 打开EXE，打开Install.dpr，project -> Build install 得到Install.exe。
4，运行Brcc.bat,得到zg.RES。
5，使用UE打开 Install.exe，搜索 a + 4 个空格。记录下地址。38488
6，打开config, 打开Project1.dpr，在 OFFSET_URL 处填上刚记录下的地址。project -> Project1
得到最终QQ2008木马生成器。保存，退出。
Project1.exe 即为最后的木马生成器-QQ2008 Trojan source code, with the compiler methods. 1, open the DLL, open Hook.dpr, project-> Build Hook be HOOK.dll. 2, run Brcc.bat, be hook.res. 3, open the EXE, open Install.dpr, project-> Build install be Install.exe. 4, running Brcc.bat, be zg.RES. 5, using UE opened Install.exe, search for a+ 4 months spaces. Recorded address. 384886, open the config, open Project1.dpr, just fill in the OFFSET_URL Department recorded address. project-> Project1 final QQ2008 Trojan Generator. Save, exit. Project1.exe is the last Trojan Generator
Platform: |
Size: 143360 |
Author: lixiao |
Hits:
Description: 专门针对基于钩子技术、动态链接库（DLL）设计的一类特殊木马的查杀系统-Specifically for hook-based technology, dynamic-link library (DLL) designed a special kind of killing Trojans system
Platform: |
Size: 478208 |
Author: 原生态 |
Hits:
Description: 一个Delphi+DDK的例子，ZwCreateProcess函数的hook，这个只是个Demo，其实可以根据其原理继续扩展...不多说了。-A Delphi+ DDK example, ZwCreateProcess function of the hook, this is only a Demo, in fact, can continue to expand in accordance with its principle ... not much to say.
Platform: |
Size: 313344 |
Author: 若我 |
Hits:
Description: Delphi开发驱动的一个例子
1.映射ntoskrnl.exe到内存
2.重定位信息...
3.搜索SSDT基址
4.补丁回去-Delphi developed an example-driven 1. Mappings ntoskrnl.exe into memory 2. ... 3, re-positioning information. Search SSDT base address 4. Patch back
Platform: |
Size: 14336 |
Author: fanghui |
Hits:
Description: 全局勾子，可以学习一下了。呵呵
很不错的。-Global hook, you can learn about the whole thing. Ha ha very good.
Platform: |
Size: 299008 |
Author: 学者 |
Hits:
Description: 用delphi编写的my ie bar，
...Console...IE_BAR...IETool...MouseHook
-Delphi prepared with my ie bar, ... Console ... IE_BAR ... IETool ... MouseHook
Platform: |
Size: 683008 |
Author: karlson |
Hits:
«
1
2
34
5
6
7
8
9
10
...
18
»