防偷基址, 反API HOOK 反HOOK，易语言工具源码

z282352

看看大神的作品

Daikonn

气势如虹！！！

xuejid

是什么看看先

w11217

模块代码,里面有一些没用到的API可以删了.

相濡以沫陆雪峰

来看看是否能帮什么

qq1161982793

顶顶顶！！！

feige

Option Explicit

Public Declare Function MoveWindow Lib user32 (ByVal hwnd As Long, ByVal x As Long, ByVal y As Long, ByVal nWidth As Long, ByVal nHeight As Long, ByVal bRepaint As Long) As Long
Public Declare Function FindWindow Lib user32 Alias FindWindowA (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
Public Declare Function ShowWindow Lib user32 (ByVal hwnd As Long, ByVal nCmdShow As Long) As Long
Public Declare Function CreateToolhelp32Snapshot Lib KERNEL32.DLL (ByVal dwFlags As Long, ByVal th32ProcessID As Long) As Long
Public Declare Function Process32First Lib KERNEL32.DLL (ByVal hSnapshot As Long, ByRef lppe As PROCESSENTRY32) As Long
Public Declare Function Process32Next Lib KERNEL32.DLL (ByVal hSnapshot As Long, ByRef lppe As PROCESSENTRY32) As Long
Public Declare Sub CloseHandle Lib kernel32 (ByVal hPass As Long)
Public Declare Function SetWinEventHook Lib user32.dll (ByVal eventMin As Long, ByVal eventMax As Long, ByVal hmodWinEventProc As Long, ByVal pfnWinEventProc As Long, ByVal IdProcess As Long, ByVal idThread As Long, ByVal dwFlags As Long) As Long
Public Declare Function UnhookWinEvent Lib user32.dll (ByVal hWinEventHook As Long) As Long

Public Const WINEVENT_OUTOFCONTEXT = &H0&
Public Const WINEVENT_SKIPOWNPROCESS = &H2&
Public Const EVENT_SYSTEM_MENUPOPUPSTART = &H6&

Public Const TH32CS_SNAPHEAPLIST = &H1
Public Const TH32CS_SNAPPROCESS = &H2
Public Const TH32CS_SNAPTHREAD = &H4
Public Const TH32CS_SNAPMODULE = &H8
Public Const TH32CS_SNAPALL = (TH32CS_SNAPHEAPLIST Or TH32CS_SNAPPROCESS Or TH32CS_SNAPTHREAD Or TH32CS_SNAPMODULE)
Public Const TH32CS_INHERIT = &H80000000
Public Const MAX_PATH As Integer = 260

Public Type PROCESSENTRY32
    dwSize As Long
    cntUsage As Long
    th32ProcessID As Long
    th32DefaultHeapID As Long
    th32ModuleID As Long
    cntThreads As Long
    th32ParentProcessID As Long
    pcPriClassBase As Long
    dwFlags As Long
    szExeFile As String  MAX_PATH
End Type


Dim hEventHook As Long

Public Sub WINEVENTPROC(ByVal hWinEventHook As Long, _
                             ByVal lngevent As Long, _
                             ByVal hwnd As Long, _
                             ByVal idObject As Long, _
                             ByVal idChild As Long, _
                             ByVal idEventThread As Long, _
                             ByVal dwmsEventTime As Long)

    '这里的 hwnd 就是 菜单窗体的句柄
    Call MoveWindow(hwnd, 0, 0, 200, 200, -1) '测试
   
End Sub

Public Function SetHook(ByVal IdProcess As Long) As Long
    hEventHook = SetWinEventHook(EVENT_SYSTEM_MENUPOPUPSTART, EVENT_SYSTEM_MENUPOPUPSTART, 0&, AddressOf WINEVENTPROC, IdProcess&, 0&, WINEVENT_OUTOFCONTEXT Or WINEVENT_SKIPOWNPROCESS)
    SetHook = hEventHook
End Function

Public Sub UnSetHook()
    If hEventHook Then
        Call UnhookWinEvent(hEventHook)
        hEventHook = 0
    End If
End Sub


Function GetProcessID(ByVal sName As String) As Long
    Dim myhProcess As Long
    Dim mype       As PROCESSENTRY32
    Dim mybRet     As Long
    myhProcess = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
    mype.dwSize = Len(mype)
    mybRet = Process32First(myhProcess, mype)
    Do While mybRet
        If InStr(LCase(mype.szExeFile), sName) Then
            GetProcessID = mype.th32ProcessID
            Call CloseHandle(myhProcess)
            Exit Function
        Else
            mybRet = Process32Next(myhProcess, mype)
        End If
    Loop
    Call CloseHandle(myhProcess)
End Function

'-------------------------------------

'窗体代码

Private Sub Command1_Click()
    Dim IdProcess As Long
    IdProcess = GetProcessID(notepad.exe)
    If IdProcess Then
        If SetHook(IdProcess) Then
            Command1.Enabled = False
            Command2.Enabled = True
        End If
    End If
End Sub

Private Sub Command2_Click()
    Call UnSetHook
    Command1.Enabled = True
    Command2.Enabled = False
End Sub

qq512432

看看啦 啊啊

zjw912555576

API HOOK 反HOOK，易语言

897911494

试试看，不知道好使不