实际就是-field offset

看看宏实现就可以了~

procedure HideModuleFromPEB(dllName: string);
var
  hMod : THandle;
  Head,Cur : PListEntry;
  ldr : PPEB_LDR_DATA;
  ldm :  PLDR_MODULE;
begin
  hMod := GetModuleHandle(PChar(dllName));
  asm
    MOV EAX,FS:[$30] //得到PEB结构地址
    MOV EAX,[EAX+$C] //得到PEB_LDR_DATA结构地址
    MOV LDR, EAX
  end;
  Head := @ldr.InLoadOrderModuleList;
  Cur := Head.Flink;  //运行到这里Head.Flink=0xE0000000，ldr=241EA0，应该不对吧，哪里错了啊？
  repeat
    ldm := PLDR_MODULE(DWORD(@Cur.Flink)-DWORD(@Cur));  // ??????????
    if DWORD(hMod)=DWORD(ldm.BaseAddress) then
    begin
      ldm.InLoadOrderModuleList.BLink.Flink := ldm.InLoadOrderModuleList.Flink;
      ldm.InLoadOrderModuleList.Flink.Blink := ldm.InLoadOrderModuleList.Blink;

      ldm.InInitializationOrderModuleList.BLink.Flink := ldm.InInitializationOrderModuleList.Flink;
      ldm.InInitializationOrderModuleList.Flink.Blink := ldm.InInitializationOrderModuleList.Blink;

      ldm.InMemoryOrderModuleList.BLink.Flink := ldm.InMemoryOrderModuleList.Flink;
      ldm.InMemoryOrderModuleList.Flink.Blink := ldm.InMemoryOrderModuleList.Blink;
       break;
    end;
    Cur := Cur.Flink;
  until Head<>Cur;
end;

暴搜一下就出来了…

ldm:=PLDR_MODULE(ULONG_PTR(Cur)-ULONG_PTR(@PLDR_MODULE(0)^.InLoadOrderModuleList));
好像是这样，但是不知道为什么不对

错了这样来实现的
var
  stEntry:LDR_DATA_TABLE_ENTRY;
begin
    pstEntry := pointer(DWORD(Current)-(DWORD(@stEntry.InLoadOrderLinks)-dword(@stEntry)));//实现DDK中的CONTAINING_RECORD宏做这个事情

暴搜链表就出来了。。没什么用，贴段娱乐下

type
    _UNICODE_STRING = record
      Length: WORD{Ushort};
      MaximumLength: WORD;
      Buffer: PWideChar;
    end {_UNICODE_STRING};
    UNICODE_STRING = _UNICODE_STRING;
    PUNICODE_STRING = ^_UNICODE_STRING;

//PEB中的一个结构
type
    _PEB_LDR_DATA = record
      Length: ULONG;
      Initialized: BOOLEAN;
      SsHandle: pointer;//PVOID;
      InLoadOrderModuleList: LIST_ENTRY;
      InMemoryOrderModuleList: LIST_ENTRY;
      InInitializationOrderModuleList: LIST_ENTRY;
    end {_PEB_LDR_DATA};
    PEB_LDR_DATA = _PEB_LDR_DATA;
    PPEB_LDR_DATA = ^_PEB_LDR_DATA;

//模块结构 (72)
type
    _LDR_MODULE = record
      InLoadOrderModuleList: LIST_ENTRY;
      InMemoryOrderModuleList: LIST_ENTRY;
      InInitializationOrderModuleList: LIST_ENTRY;
      BaseAddress: pointer;
      EntryPoint:    pointer;
      SizeOfImage: ULONG;
      FullDllName: UNICODE_STRING;
      BaseDllName: UNICODE_STRING;
      Flags: ULONG;
      LoadCount: SmallInt;
      TlsIndex: SmallInt;
      HashTableEntry: LIST_ENTRY;
      TimeDateStamp: ULONG;
    end {_LDR_MODULE};
    LDR_MODULE = _LDR_MODULE;
    PLDR_MODULE = ^_LDR_MODULE;

  function HideDll(const dllname: PChar):HMODULE;
  var
    hMod: HMODULE;
    Head, Cur: PListEntry;
    ldr: PPEB_LDR_DATA;
    ldm: PLDR_MODULE;
  begin
    hMod := GetModuleHandle(dllname);
    if hMod <= 0 then
      begin
        exit;
      end;
    asm
      mov eax, fs:[30h]
      mov ecx, [eax + 0Ch]
      mov ldr, ecx
    end;
    Head := @ldr^.InLoadOrderModuleList;
    Cur := Head^.Flink;
    repeat
      ldm := PLDR_MODULE(Cur);
      ldm := PLDR_MODULE(DWORD(Cur) - DWORD(@PLDR_MODULE(0)^.InLoadOrderModuleList));
      if (hMod = DWORD(ldm^.BaseAddress)) then
        begin
          ldm^.InLoadOrderModuleList.Blink^.Flink := ldm^.InLoadOrderModuleList.Flink;
          ldm^.InLoadOrderModuleList.Flink^.Blink := ldm^.InLoadOrderModuleList.Blink;
          ldm^.InInitializationOrderModuleList.Blink^.Flink := ldm^.InInitializationOrderModuleList.Flink;
          ldm^.InInitializationOrderModuleList.Flink^.Blink := ldm^.InInitializationOrderModuleList.Blink;
          ldm^.InMemoryOrderModuleList.Blink^.Flink := ldm^.InMemoryOrderModuleList.Flink;
          ldm^.InMemoryOrderModuleList.Flink^.Blink := ldm^.InMemoryOrderModuleList.Blink;
          Break;
        end;
        Cur := Cur^.Flink;
    until (Head = Cur);
    Result := hMod;
  end;