function SuperHook(HookPro,DllName,ApiName:PAnsiChar;NewHookAdderss:Pointer;var OldNtDeviceIoControl:Pointer):Boolean;
  var
    hMod: HMODULE;
    pDosHeader: PImageDosHeader;
    pNtHeaders: PImageNtHeaders;
    ImportDescriptor: PImageImportDescriptor;
    ThunkData: PImageThunkData;
    dll_name, func_name: PAnsiChar;
    iNum: Integer;
    lpAddr: Pointer;
    myaddr :DWORD;
    btw:SIZE_T;
    Ordinal:DWORD;

  begin
    Result := False;
    //得到目标的模块基址
    hMod := GetModuleHandleA(HookPro);
    if (hMod = 0) then
    begin
      Exit;
    end;

    //得到DOS头
    pDosHeader := PImageDosHeader(hMod);
    //如果DOS头无效
    if ( pDosHeader^.e_magic <> IMAGE_DOS_SIGNATURE ) then
    begin
      Exit;
    end;

    //得到NT头
    pNtHeaders := PImageNtHeaders(hMod + DWORD(pDosHeader^._lfanew));
    //如果NT头无效
    if ( pNtHeaders^.Signature <> IMAGE_NT_SIGNATURE ) then
    begin
      Exit;
    end;

    //检查输入表数据目录是否存在
    if (pNtHeaders^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress = 0)
      or (pNtHeaders^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size = 0) then
    begin
      Exit;
    end;


    //得到输入表描述指针
    ImportDescriptor := PImageImportDescriptor(hMod + pNtHeaders^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);

    //检查每个输入项
    while (ImportDescriptor^.FirstThunk <> 0) do
    begin
      // 检查输入表项是否为ntdll.dll
      dll_name := PAnsiChar(hMod + ImportDescriptor^.Name);
      // 如果不是，则跳到下一个处理
      if (StrIComp(dll_name, DllName) <> 0) then
      begin
        ImportDescriptor := PImageImportDescriptor(DWORD(ImportDescriptor) + SizeOf(_IMAGE_IMPORT_DESCRIPTOR));
        Continue;
      end;

      ThunkData := PImageThunkData(hMod + ImportDescriptor^.CharacteristicsOrOriginalFirstThunk);
      iNum := 1;
      while (ThunkData^.Function_ <> 0) do
      begin
        Ordinal := (ThunkData^.Ordinal and $80000000);
        func_name := PAnsiChar(hMod + ThunkData^.AddressOfData + 2);
        if (StrIComp(func_name , ApiName) = 0) then
        begin
          OutputDebugString(PChar(Format('[HOOK] Lock "%s" for HOOK.', [StrPas(func_name)])));
          myaddr := dword(NewHookAdderss);
          lpAddr := Pointer(hMod + ImportDescriptor^.FirstThunk + DWORD(iNum-1)*4);
          DWORD(OldNtDeviceIoControl) := Pdword(lpAddr)^;
          OutputDebugString(PChar(Format('[HOOK] Base=%0.8X, Thunk=%0.8X, ID=%X', [hMod, ImportDescriptor^.FirstThunk, iNum-1])));
          OutputDebugString(PChar(Format('[HOOK] Orign[0x%0.8X]=0x%0.8X, new Addr=0x%0.8X', [DWORD(lpAddr), PDWORD(lpAddr)^, myaddr])));
          WriteProcessMemory(GetCurrentProcess(), lpAddr, @myaddr, 4, btw);
          //需要处理一下 CharacteristicsOrOriginalFirstThunk
          lpAddr := Pointer(hMod + ImportDescriptor^.CharacteristicsOrOriginalFirstThunk + DWORD(iNum-1)*4);
          //如果FirstThunk无效则使用CharacteristicsOrOriginalFirstThunk作为返回地址
          if ImportDescriptor^.FirstThunk = 0 then DWORD(OldNtDeviceIoControl) := Pdword(lpAddr)^;
          WriteProcessMemory(GetCurrentProcess(), lpAddr, @myaddr, 4, btw);
          Result := True;
        //  Exit;
        end;

        Inc(iNum);
        ThunkData := PImageThunkData(DWORD(ThunkData) + SizeOf(_IMAGE_THUNK_DATA));
      end;

      Inc(ImportDescriptor);
    end;
  end;