ldm^.InLoadOrderModuleList.Blink^.Flink := ldm^.InLoadOrderModuleList.Flink;
ldm^.InLoadOrderModuleList.Flink^.Blink := ldm^.InLoadOrderModuleList.Blink;
ldm^.InInitializationOrderModuleList.Blink^.Flink := ldm^.InInitializationOrderModuleList.Flink;
ldm^.InInitializationOrderModuleList.Flink^.Blink := ldm^.InInitializationOrderModuleList.Blink;
ldm^.InMemoryOrderModuleList.Blink^.Flink := ldm^.InMemoryOrderModuleList.Flink;
ldm^.InMemoryOrderModuleList.Flink^.Blink := ldm^.InMemoryOrderModuleList.Blink;
//ldm^.BaseAddress:=nil; //如果设置nil loadlibrary会显示失败
if (Win32MajorVersion>=6) and (Win32MinorVersion>=2) then //win8 win8.1
begin
// ldm+$68 为ldm^.BaseAddressIndexNode地址
hide_InNode(Pointer( DWORD(ldm)+$68 ));
end;
function GetLdrpModuleBaseAddressIndex:DWORD;
var
ntdll:THandle;
I,curAdd:Cardinal;
LdrDisableThreadCalloutsForDll, //LdrDisableThreadCalloutsForDll win8 win8.1都存在
LdrpFindLoadedDllByHandle:Cardinal;
findAsmKey:TarrasmCodeKey;
begin
Result:=0;
ntdll:=GetModuleHandle('ntdll.dll'); LdrpFindLoadedDllByHandle:=0;
if ntdll<>0 then
begin
LdrDisableThreadCalloutsForDll:=Cardinal(GetProcAddress(ntdll,'LdrDisableThreadCalloutsForDll'));
if LdrDisableThreadCalloutsForDll>0 then
begin
SetLength(findAsmKey,1);
findAsmKey[0]:='call'; //硬编码
curAdd:=FindAsmCode(LdrDisableThreadCalloutsForDll,0,findAsmKey);
if curAdd>0 then
begin
LdrpFindLoadedDllByHandle:=PULONG(curAdd+1)^+5+curAdd;
end;
end;
if LdrpFindLoadedDllByHandle>0 then
begin
SetLength(findAsmKey,2);
findAsmKey[0]:='mov eax,'; //硬编码
findAsmKey[1]:='test eax, eax'; //硬编码
curAdd:=FindAsmCode(LdrpFindLoadedDllByHandle,0,findAsmKey);
if curAdd>0 then
begin
Result:=PULONG(curAdd+1)^;
end;
end;
end;
end;
function hide_InNode(NeedDeleteNode:Pointer):Cardinal;stdcall;
var
LdrpModuleBaseAddressIndex:DWORD;
RtlRbRemoveNode:Pointer;
begin
RtlRbRemoveNode:=GetProcAddress(GetModuleHandle('ntdll.dll'),'RtlRbRemoveNode');
if RtlRbRemoveNode<>nil then
begin
LdrpModuleBaseAddressIndex:=GetLdrpModuleBaseAddressIndex;
if LdrpModuleBaseAddressIndex>0 then
begin
TRtlRbRemoveNode(RtlRbRemoveNode)(Pointer(LdrpModuleBaseAddressIndex),NeedDeleteNode);
end;
end;
end;
