先执行一次old 然后你在看看有没有这个结构

WIN7上没有这个结构了吗

怎么弄呀

function  NewNtQuerySystemInformation(
    SystemInformationClass : SYSTEM_INFORMATION_CLASS;
    SystemInformation : PVOID;
    SystemInformationLength : ULONG;
    ReturnLength : PULONG
  NTSTATUS; stdcall;
type
   TNewNtQuerySystemInformation= function (
   SystemInformationClass : SYSTEM_INFORMATION_CLASS;
   SystemInformation : PVOID;
    SystemInformationLength : ULONG;
    ReturnLength : PULONG
  NTSTATUS; stdcall;

var
pSystemProcesses,prev:PSYSTEM_PROCESSES;
begin
Hook[53].UnHook;

Result:= TNewNtQuerySystemInformation(Hook[53].BaseAddr)(SystemInformationClass,SystemInformation,SystemInformationLength,ReturnLength);
if SystemInformationClass= SystemProcessesAndThreadsInformation && Result then

  begin
   pSystemProcesses := PSYSTEM_PROCESSES(SystemInformation);

    while true do
    begin
    //ShowMessage(IntToStr(pSystemProcesses^.ProcessId));这里输出进程ID全部为0，hook到了程序里的调用不应该为0的呀，这代码没申请内存还是怎么回事
      if (pSystemProcesses^.ProcessId = GetCurrentProcessId) then       begin

        if (pSystemProcesses^.NextEntryDelta)=0 then
        begin

          Prev^.NextEntryDelta:= pSystemProcesses^.NextEntryDelta;
        end else
        begin
         Prev^.NextEntryDelta:=0;
        end;
        break;
      end;
      if (pSystemProcesses^.NextEntryDelta = 0) then break;
      Prev:=pSystemProcesses;
      pSystemProcesses := PSYSTEM_PROCESSES(ULONG(pSystemProcesses) + pSystemProcesses^.NextEntryDelta);
    end;
  end;                        

Result:= TNewNtQuerySystemInformation(Hook[53].BaseAddr)(SystemInformationClass,SystemInformation,SystemInformationLength,ReturnLength);

//Result := 0;
// ShowMessage(IntToStr(Result));
Hook[53].Hook;
end;

Result>0   还是0 是不是  pSystemProcesses := PSYSTEM_PROCESSES(SystemInformation);没申请内存呀还是什么原因