ldm^.InLoadOrderModuleList.Blink^.Flink := ldm^.InLoadOrderModuleList.Flink;
   ldm^.InLoadOrderModuleList.Flink^.Blink := ldm^.InLoadOrderModuleList.Blink;
   ldm^.InInitializationOrderModuleList.Blink^.Flink := ldm^.InInitializationOrderModuleList.Flink;
   ldm^.InInitializationOrderModuleList.Flink^.Blink := ldm^.InInitializationOrderModuleList.Blink;
   ldm^.InMemoryOrderModuleList.Blink^.Flink := ldm^.InMemoryOrderModuleList.Flink;
   ldm^.InMemoryOrderModuleList.Flink^.Blink := ldm^.InMemoryOrderModuleList.Blink;

   //ldm^.BaseAddress:=nil;  //如果设置nil  loadlibrary会显示失败


   if (Win32MajorVersion>=6) and (Win32MinorVersion>=2) then  //win8 win8.1
   begin
    // ldm+$68 为ldm^.BaseAddressIndexNode地址
    hide_InNode(Pointer(   DWORD(ldm)+$68   ));
   end;

function GetLdrpModuleBaseAddressIndex:DWORD;
var
 ntdll:THandle;
 I,curAdd:Cardinal;
 LdrDisableThreadCalloutsForDll,    //LdrDisableThreadCalloutsForDll win8 win8.1都存在
 LdrpFindLoadedDllByHandle:Cardinal;
 findAsmKey:TarrasmCodeKey;
begin
 Result:=0;
 ntdll:=GetModuleHandle('ntdll.dll');   LdrpFindLoadedDllByHandle:=0;
 if ntdll<>0 then
 begin
   LdrDisableThreadCalloutsForDll:=Cardinal(GetProcAddress(ntdll,'LdrDisableThreadCalloutsForDll'));
   if LdrDisableThreadCalloutsForDll>0 then
   begin
    SetLength(findAsmKey,1);
    findAsmKey[0]:='call';          //硬编码
    curAdd:=FindAsmCode(LdrDisableThreadCalloutsForDll,0,findAsmKey);
    if curAdd>0 then
    begin
      LdrpFindLoadedDllByHandle:=PULONG(curAdd+1)^+5+curAdd;
    end;
   end;
   if LdrpFindLoadedDllByHandle>0 then
   begin
     SetLength(findAsmKey,2);
     findAsmKey[0]:='mov     eax,';         //硬编码
     findAsmKey[1]:='test    eax, eax';     //硬编码
     curAdd:=FindAsmCode(LdrpFindLoadedDllByHandle,0,findAsmKey);
     if curAdd>0 then
     begin
       Result:=PULONG(curAdd+1)^;
     end;
   end;  
   
 end;
end;

function hide_InNode(NeedDeleteNode:Pointer):Cardinal;stdcall;
var
 LdrpModuleBaseAddressIndex:DWORD;
 RtlRbRemoveNode:Pointer;
begin
 RtlRbRemoveNode:=GetProcAddress(GetModuleHandle('ntdll.dll'),'RtlRbRemoveNode');
 if RtlRbRemoveNode<>nil then
 begin
  LdrpModuleBaseAddressIndex:=GetLdrpModuleBaseAddressIndex;
  if LdrpModuleBaseAddressIndex>0 then
  begin
   TRtlRbRemoveNode(RtlRbRemoveNode)(Pointer(LdrpModuleBaseAddressIndex),NeedDeleteNode);
  end;
 end;  
end;