Magic API Hook

unit MagicApiHook;

(*

==============================================

Magic Api Hook Engine v1.0 - Date: 2006.04.24

this is a simple all around process api hooker

UserMode(Ring3) just for WinNT family

By: Magic_h2001 - magic_h2001@yahoo.com

Home: http://magic.shabgard.org

==============================================

*)

interface

uses Windows;

function LowCaseStr(S:string):string;

function UpCaseStr(S:string):string;

function StrCmp(String1,String2:string):Boolean;

function Trim(S:string):string;

function StrToInt(S:string):Integer;

function StrToInt64(S:string):Int64;

function IntToStr(i:Int64):string;

function IntToHex(i:Int64; P:Int64=0):string;

function HexToInt(S:string):Integer;

function HexToInt64(S:string):Int64;

function WideToStr(const WS:WideString):string;

function StrToWide(const S:AnsiString):WideString;

function GetWin:string;

function GetSys:string;

function GetTmp:string;

function IsWinNT:Boolean;

function IsWin9x:Boolean;

function IsAdmin:Boolean;

function GetPath(Path:string):string;

function GetFile(Path:string):string;

function GetFileInfo(Filename,BlockKey:string):string;

function IsFileExist(FileName:string):Boolean;

function IsFileInUse(FileName:string):Boolean;

function DebugPrivilege(ToEnable:Boolean):Boolean;

function GetExplorerPid:DWORD;

function PHandleToPID(dwProcessHandle:DWord):DWord;

function CalcJump(Src,Dest:DWORD):DWORD;

function InjectDll(DllPath:string; PID_or_PHD:DWORD):Boolean;

function UnInjectDll(DllName:string; PID_or_PHD:DWORD):Boolean;

function ApiHook(ModName,ApiName:Pchar; FuncAddr,HookedApi:Pointer; var MainApi:Pointer):Boolean;

function ApiUnHook(ModName,ApiName:Pchar; FuncAddr,HookedApi:Pointer; var MainApi:Pointer):Boolean;

function InjectAllProc(DllPath:string):Integer;

function UnInjectAllProc(DllPath:string):Integer;

function IsHeuristicScan:Boolean;

function OpCodeLength(Address:DWORD):DWORD; cdecl;

implementation

const

  TH32CS_SNAPPROCESS=$00000002;

type

  tagPROCESSENTRY32=packed record

    dwSize: DWORD;

    cntUsage: DWORD;

    th32ProcessID: DWORD;

    th32DefaultHeapID: DWORD;

    th32ModuleID: DWORD;

    cntThreads: DWORD;

    th32ParentProcessID: DWORD;

    pcPriClassBase: Longint;

    dwFlags: DWORD;

    szExeFile: array[0..MAX_PATH-1] of Char;

  end;

  PROCESSENTRY32=tagPROCESSENTRY32;

  TProcessEntry32=tagPROCESSENTRY32;

var LoadOpCodes: array[0..23] of Byte=($68,0,0,0,0,$E8,0,0,0,0,$B8,$FF,$FF,$FF,$FF,$50,$E8,0,0,0,0,$EB,$F3,$C3);

    FreeOpCodes: array[0..32] of Byte=($68,0,0,0,0,$E8,0,0,0,0,$B9,$FF,$FF,0,0,$50,$51,$50,$E8,0,0,0,0,$59,$83,$F8,$00,$58,$74,$02,$E2,$EF,$C3);

 CreateToolhelp32Snapshot: function(dwFlags, th32ProcessID: DWORD): THandle; stdcall;

 Process32First: function(hSnapshot: THandle; var lppe: TProcessEntry32): BOOL; stdcall;

 Process32Next: function(hSnapshot: THandle; var lppe: TProcessEntry32): BOOL; stdcall;

 OpenProcess: function(dwDesiredAccess:DWORD; bInheritHandle:BOOL; dwProcessId:DWORD):THandle; stdcall;

 VirtualAllocEx: function(hProcess:THandle; lpAddress:Pointer; dwSize,flAllocationType:DWORD; flProtect:DWORD):Pointer; stdcall;

 WriteProcessMemory: function(hProcess:THandle; const lpBaseAddress:Pointer; lpBuffer:Pointer; nSize:DWORD; var lpNumberOfBytesWritten:DWORD):BOOL; stdcall;

 CreateRemoteThread: function(hProcess:THandle; lpThreadAttributes:Pointer; dwStackSize:DWORD; lpStartAddress:TFNThreadStartRoutine; lpParameter:Pointer; dwCreationFlags:DWORD; var lpThreadId:DWORD):THandle; stdcall;

(******************************************************************************)

function LowCaseStr(S:string):string;

var i: Integer;

begin

 Result:=S;

 if S='' then Exit;

 for i:=1 to Length(S) do if Result[i] in ['A'..'Z'] then Inc(Result[i],32);

end;

(******************************************************************************)

function UpCaseStr(S:string):string;

var i: Integer;

begin

 Result:=S;

 if S='' then Exit;

 for i:=1 to Length(S) do Result[i]:=UpCase(Result[i]);

end;

(******************************************************************************)

function StrCmp(String1,String2:string):Boolean;

begin

 Result:=lstrcmpi(Pchar(String1),Pchar(String2))=0;

end;

(******************************************************************************)

function Trim(S:string):string;

begin

 Result:='';

 if S='' then Exit;

 while S[1]=' ' do begin

  Delete(S,1,1);

  if S='' then Exit;

 end;

 while S[Length(S)]=' ' do begin

  Delete(S,Length(S),1);

  if S='' then Exit;

 end;

 Result:=S;

end;

(******************************************************************************)

function IntToStr(i:Int64):string;

begin

 try

  Str(i,Result);

 except

  Result:='';

 end;

end;

(******************************************************************************)

function StrToInt(S:string):Integer;

var Code: Integer;

begin

 Val(S, Result, Code);

 if Code<>0 then Result:=0;

end;

(******************************************************************************)

function StrToInt64(S:string):Int64;

var Code: Integer;

begin

 Val(S, Result, Code);

 if Code<>0 then Result:=0;

end;

(******************************************************************************)

function HexToInt(S:string):Integer;

var Tmp: string;

begin

 Result:=0;

 Tmp:='';

 if S='' then Exit;

 if (S[1]='-') or (S[1]='+') then begin

   Tmp:=S[1];

   Delete(S,1,1);

  end;

 S:=Tmp+'$'+S;

 Result:=StrToInt(S);

end;

(******************************************************************************)

function HexToInt64(S:string):Int64;

var Tmp: string;

begin

 Result:=0;

 Tmp:='';

 if S='' then Exit;

 if (S[1]='-') or (S[1]='+') then begin

   Tmp:=S[1];

   Delete(S,1,1);

  end;

 S:=Tmp+'$'+S;

 Result:=StrToInt64(S);

end;

(******************************************************************************)

function IntToHex(i:Int64; P:Int64=0):string;

const

  Hexa:array[0..$F] of char='0123456789ABCDEF';

begin

 Result:='';

 if (P=0) and (i=0) then begin

  Result:='0';

  Exit;

 end;

 while (P>0)or(i>0) do begin

  Dec(P,1);

  Result:=Hexa[i and $F]+Result;

  i:=i shr 4;

 end;

end;

(******************************************************************************)

function WideToStr(const WS:WideString):string;

var l: Integer;

begin

 Result:='';

 if WS='' then Exit;

 l:=WideCharToMultiByte(CP_ACP,0,@WS[1],-1,nil,0,nil,nil);

 SetLength(Result,l-1);

 if l>1 then WideCharToMultiByte(CP_ACP,0,@WS[1],-1,@Result[1],l-1,nil,nil);

end;

(******************************************************************************)

function StrToWide(const S:AnsiString):WideString;

var l: Integer;

begin

 Result:='';

 if S='' then Exit;

 l:=MultiByteToWideChar(CP_ACP,0, Pchar(@S[1]),-1,nil,0);

 SetLength(Result,l-1);

 if l>1 then MultiByteToWideChar(CP_ACP,0,Pchar(@S[1]),-1,PWideChar(@Result[1]),l-1);

end;

(******************************************************************************)

function GetWin:string;

var

  Gwin : array[0..MAX_PATH] of Char;

begin

  GetWindowsDirectory(Gwin,MAX_PATH);

  Result:=Gwin;

  if Length(Result)>0 then

  if Result[Length(Result)]<>'\' then Result:=Result+'\';

end;

(******************************************************************************)

function GetSys:string;

var

  Gsys : array[0..MAX_PATH] of Char;

begin

  GetSystemDirectory(Gsys,MAX_PATH);

  Result:=Gsys;

  if Length(Result)>0 then

  if Result[Length(Result)]<>'\' then Result:=Result+'\';

end;

(******************************************************************************)

function GetTmp:string;

var

  Gtmp : array[0..MAX_PATH] of Char;

begin

  GetTempPath(MAX_PATH,Gtmp);

  Result:=Gtmp;

  if Length(Result)>0 then

  if Result[Length(Result)]<>'\' then Result:=Result+'\';

end;

(******************************************************************************)

function IsWinNT:Boolean;

var osVerInfo: TOSVersionInfo;

begin

 Result:=False;

 osVerInfo.dwOSVersionInfoSize:=SizeOf(TOSVersionInfo);

 if GetVersionEx(osVerInfo) then Result:=(osVerInfo.dwPlatformId=VER_PLATFORM_WIN32_NT);

end;

(******************************************************************************)

function IsWin9x:Boolean;

asm

 MOV     EAX, FS:[030H]

 TEST    EAX, EAX

 SETS    AL

end;

(******************************************************************************)

function IsAdmin:Boolean;

const

  SECURITY_NT_AUTHORITY: TSIDIdentifierAuthority = (Value: (0,0,0,0,0,5));

  SECURITY_BUILTIN_DOMAIN_RID = $00000020;

  DOMAIN_ALIAS_RID_ADMINS     = $00000220;

var

  IsUserAnAdmin: function(): BOOL; stdcall;

  hAccessToken: THandle;

  ptgGroups: PTokenGroups;

  dwInfoBufferSize: DWORD;

  psidAdministrators: PSID;

  xi: Integer;

  bSuccess: BOOL;

  hMod: Thandle;

begin

 Result:=True; 

 if IsWin9x then Exit;

 Result:=False;

 hAccessToken:=0;

 hMod:=GetModuleHandle('shell32.dll');

 if hMod=0 then hMod:=LoadLibrary('shell32.dll');

 IsUserAnAdmin:=GetProcAddress(hMod,'IsUserAnAdmin');

 if not Assigned(IsUserAnAdmin) then begin

  bSuccess:=OpenThreadToken(GetCurrentThread,TOKEN_QUERY,True,hAccessToken);

  if not bSuccess then if GetLastError=ERROR_NO_TOKEN then

   bSuccess:=OpenProcessToken(GetCurrentProcess,TOKEN_QUERY,hAccessToken);

  if bSuccess then begin

    GetMem(ptgGroups,1024);

    bSuccess:=GetTokenInformation(hAccessToken,TokenGroups,ptgGroups,1024,dwInfoBufferSize);

    CloseHandle(hAccessToken);

    if bSuccess then begin

      AllocateAndInitializeSid(SECURITY_NT_AUTHORITY,2,SECURITY_BUILTIN_DOMAIN_RID,DOMAIN_ALIAS_RID_ADMINS,0,0,0,0,0,0,psidAdministrators);

      if ptgGroups.GroupCount>0 then

        for xi:=0 to ptgGroups.GroupCount-1 do

         if EqualSid(psidAdministrators,ptgGroups.Groups[xi].Sid) then begin

          Result:=True;

          Break;

         end;

      FreeSid(psidAdministrators);

    end;

    FreeMem(ptgGroups);

  end;

 end

 else Result:=IsUserAnAdmin();

end;

(******************************************************************************)

function GetPath(Path:string):string;

begin

 Result:='';

 if Path='' then Exit;

 if Pos('\',Path)<>0 then begin

   while Path[Length(Path)]<>'\' do Delete(Path,Length(Path),1);

   Result:=Path;

   Exit;

 end;

 if Pos('/',Path)<>0 then begin

   while Path[Length(Path)]<>'/' do Delete(Path,Length(Path),1);

   Result:=Path;

   Exit;

 end;

end;

(******************************************************************************)

function GetFile(Path:string):string;

begin

 while Pos(':',Path)<>0 do Delete(Path,1,Pos(':',Path));

 while Pos('\',Path)<>0 do Delete(Path,1,Pos('\',Path));

 while Pos('/',Path)<>0 do Delete(Path,1,Pos('/',Path));

 Result:=Path;

end;

(******************************************************************************)

function GetFileInfo(Filename,BlockKey:string):string;

var Size,VSize,Dummy: Longword;

    Pbuff,Plang: Pointer;

    Pvalue: Pchar;

    Qroot: string;

begin

 Result:='';

 Size:=GetFileVersionInfoSize(Pchar(Filename),Dummy);

 if Size=0 then Exit;

 GetMem(Pbuff,Size);

 try

 if GetFileVersionInfo(Pchar(Filename),0,Size,Pbuff) then begin

   Qroot:='\StringFileInfo\040904E4\';

   if not VerQueryValue(Pbuff,Pchar(Qroot+BlockKey),Pointer(Pvalue),VSize) then begin

     if VerQueryValue(Pbuff,Pchar('\VarFileInfo\Translation'),Plang,VSize) then begin

       Qroot:=IntToHex(Integer(Plang^),8);

       Qroot:=Copy(Qroot,5,4)+Copy(Qroot,1,4);

       Qroot:='\StringFileInfo\'+Qroot+'\';

       if not VerQueryValue(Pbuff,Pchar(Qroot+BlockKey),Pointer(Pvalue),VSize) then Exit;

     end else Exit;

   end;

   Result:=Pvalue;

 end;

 finally

   FreeMem(Pbuff);

 end;

end;

(******************************************************************************)

function IsFileExist(FileName:string):Boolean;

var

 cHandle:THandle;

 FindData:TWin32FindData;

begin

 cHandle:=FindFirstFileA(Pchar(FileName),FindData);

 Result:=cHandle<>INVALID_HANDLE_VALUE;

 if Result then FindClose(cHandle);

end;

(******************************************************************************)

function IsFileInUse(FileName:string):Boolean;

var HFileRes: HFile;

begin

 Result:=False;

 if IsFileExist(FileName) then begin

  HFileRes := CreateFile(Pchar(FileName),GENERIC_READ or GENERIC_WRITE,

              FILE_SHARE_READ or FILE_SHARE_WRITE,nil,OPEN_EXISTING,0,0);

  Result:=(HFileRes=INVALID_HANDLE_VALUE);

  if Result=False then CloseHandle(HFileRes);

 end;

end;

(******************************************************************************)

function DebugPrivilege(ToEnable:Boolean):Boolean;

var

 OldTokenPrivileges, TokenPrivileges: TTokenPrivileges;

 ReturnLength: DWORD;

 hToken: THandle;

 Luid: Int64;

begin

 Result:=True;

 if IsWin9x then Exit;

 Result:=False;

 if not OpenProcessToken(GetCurrentProcess,TOKEN_ADJUST_PRIVILEGES,hToken) then Exit;

 try

  if not LookupPrivilegeValue(nil,'SeDebugPrivilege',Luid) then Exit;

  TokenPrivileges.Privileges[0].luid:=Luid;

  TokenPrivileges.PrivilegeCount:=1;

  TokenPrivileges.Privileges[0].Attributes:=0;

  AdjustTokenPrivileges(hToken,False,TokenPrivileges,SizeOf(TTokenPrivileges),OldTokenPrivileges,ReturnLength);

  OldTokenPrivileges.Privileges[0].luid:=Luid;

  OldTokenPrivileges.PrivilegeCount:=1;

  if ToEnable then OldTokenPrivileges.Privileges[0].Attributes:=TokenPrivileges.Privileges[0].Attributes or SE_PRIVILEGE_ENABLED

  else OldTokenPrivileges.Privileges[0].Attributes:=TokenPrivileges.Privileges[0].Attributes and (not SE_PRIVILEGE_ENABLED);

  Result:=AdjustTokenPrivileges(hToken,False,OldTokenPrivileges,ReturnLength,PTokenPrivileges(nil)^,ReturnLength);

 finally

  CloseHandle(hToken);

 end;

end;

(******************************************************************************)

function GetExplorerPid:DWORD;

begin

 GetWindowThreadProcessID(FindWindow('Shell_TrayWnd',nil), @Result );

end;

(******************************************************************************)

function PHandleToPID(dwProcessHandle:DWord):DWord;

type

 TPI=packed record

       Reserved1      : Pointer;

       PebBaseAddress : Pointer;

       Reserved2      : array[0..1] of Pointer;

       UniqueProcessId: DWord;

       Reserved3      : Pointer;

     end;

 PPI=^TPI;

var

 NtQueryInformationProcess: function(dwHandle: DWord; dwInfo: DWord; pbi: PPI; dwSize: DWord; pData: Pointer): DWord; stdcall;

 pbi: TPI;

 dwDupCP: DWord;

begin

 Result:=0;

 if IsWin9x then Exit;

 @NtQueryInformationProcess:=GetProcAddress(GetModuleHandle('ntdll.dll'),'NtQueryInformationProcess');

 if (@NtQueryInformationProcess<>nil) then

   if DuplicateHandle(GetCurrentProcess, dwProcessHandle, GetCurrentProcess, @dwDupCP, PROCESS_ALL_ACCESS, False, 0) then begin

     if NtQueryInformationProcess(dwDupCP,0,@pbi,SizeOf(pbi),nil)=0 then

       Result:=pbi.UniqueProcessId;

     CloseHandle(dwDupCP);

   end;

end;

(******************************************************************************)

function CalcJump(Src,Dest:DWORD):DWORD;

begin

 if(Dest<Src) then begin

   Result:=Src-Dest;

   Result:=$FFFFFFFF-Result;

   Result:=Result-4;

  end

  else begin

   Result:=Dest-Src;

   Result:=Result-5;

  end;

end;

(******************************************************************************)

function InjectDll(DllPath:string; PID_or_PHD:DWORD):Boolean;

var

 Bytes,Process,Thread,ThreadId: DWORD;

 Params: Pointer;

 LodLib,Slp,St: DWORD;

begin

 Result:=False;

 if (IsWin9x) or (DllPath='') then Exit;

 LodLib:=DWORD(GetProcAddress(GetModuleHandle('kernel32'),'LoadLibraryA'));

 Slp:=DWORD(GetProcAddress(GetModuleHandle('kernel32'),'Sleep'));

 if (@Slp=nil) or (@LodLib=nil) then Exit;

 Process:=OpenProcess(PROCESS_ALL_ACCESS,False,PID_or_PHD);

 if Process=0 then Process:=PID_or_PHD;

 Params:=VirtualAllocEx(Process,nil,$1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);

 if Params=nil then Exit;

 WriteProcessMemory(Process,Params,Pchar(DLLPath),Length(DllPath),Bytes);

 St:=Integer(Params)+Length(DllPath)+1;

 DWORD(Pointer(DWORD(@LoadOpCodes)+1)^):=DWORD(Params);

 DWORD(Pointer(DWORD(@LoadOpCodes)+6)^):=CalcJump(St+5,LodLib);

 DWORD(Pointer(DWORD(@LoadOpCodes)+17)^):=CalcJump(St+16,Slp);

 WriteProcessMemory(Process,Pointer(St),@LoadOpCodes,SizeOf(LoadOpCodes),Bytes);

 Thread:=CreateRemoteThread(Process,nil,0,Pointer(St),nil,0,ThreadId);

 if Thread<>0 then CloseHandle(Thread);

 CloseHandle(Process);

 Result:=True;

end;

(******************************************************************************)

function UnInjectDll(DllName:string; PID_or_PHD:DWORD):Boolean;

var

 Bytes,Process,Thread,ThreadId: DWORD;

 Params: Pointer;

 FreeLib,GetMod,St: DWORD;

begin

 Result:=False;

 if (IsWin9x) or (DllName='') then Exit;

 FreeLib:=DWORD(GetProcAddress(GetModuleHandle('kernel32'),'FreeLibrary'));

 GetMod:=DWORD(GetProcAddress(GetModuleHandle('kernel32'),'GetModuleHandleA'));

 if (@FreeLib=nil) or (@GetMod=nil) then Exit;

 Process:=OpenProcess(PROCESS_ALL_ACCESS,False,PID_or_PHD);

 if Process=0 then Process:=PID_or_PHD;

 Params:=VirtualAllocEx(Process,nil,$1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);

 if Params=nil then Exit;

 WriteProcessMemory(Process,Params,Pchar(DLLName),Length(DllName),Bytes);

 St:=Integer(Params)+Length(DllName)+1;

 DWORD(Pointer(DWORD(@FreeOpCodes)+1)^):=DWORD(Params);

 DWORD(Pointer(DWORD(@FreeOpCodes)+6)^):=CalcJump(St+5,GetMod);

 DWORD(Pointer(DWORD(@FreeOpCodes)+19)^):=CalcJump(St+18,FreeLib);

 WriteProcessMemory(Process,Pointer(St),@FreeOpCodes,SizeOf(FreeOpCodes),Bytes);

 Thread:=CreateRemoteThread(Process,nil,0,Pointer(St),nil,0,ThreadId);

 if Thread<>0 then CloseHandle(Thread);

 CloseHandle(Process);

 Result:=True;

end;

(******************************************************************************)

function ApiHook(ModName,ApiName:Pchar; FuncAddr,HookedApi:Pointer; var MainApi:Pointer):Boolean;

var

 dwCount,Cnt,i,Jmp: DWORD;

 P: Pointer;

 hMod,OldP,TMP: Cardinal;

begin

 Result:=False;

 if IsWin9x then Exit;

 P:=FuncAddr;

 if P=nil then begin

  hMod:=GetModuleHandle(ModName);

  if hMod=0 then hMod:=LoadLibrary(ModName);

  P:=GetProcAddress(hMod,ApiName);

 end;

 if (P=nil) or (HookedApi=nil) then Exit;

 if not VirtualProtect(P,$40,PAGE_EXECUTE_READWRITE,@OldP) then Exit;

 if ((Byte(P^)=$68) and (DWORD(Pointer(DWORD(P)+1)^)=DWORD(HookedApi))) then Exit;

 MainApi:=VirtualAlloc(nil,$1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);

 if MainApi=nil then Exit;

 Cnt:=0;

 for dwCount:=0 to $3F do begin

  Inc(Cnt,OpCodeLength(DWORD(P)+Cnt));

  for i:=0 to Cnt-1 do Pchar(MainApi)[i]:=Pchar(P)[i];

  if Cnt>5 then Break;

 end;

 Pchar(MainApi)[Cnt]:=Char($68);

 DWORD(Pointer(DWORD(MainApi)+Cnt+1)^):=DWORD(P)+Cnt;

 Pchar(MainApi)[Cnt+5]:=Char($C3);

 Pchar(MainApi)[Cnt+6]:=Char($99);

 if (OpCodeLength(DWORD(MainApi))=5) and ((Byte(MainApi^)=$E8) or (Byte(MAinApi^)=$E9)) then begin

  Jmp:=DWORD(P)+DWORD(Pointer(DWORD(MainApi)+1)^)+5;

  DWORD(Pointer(DWORD(MainApi)+1)^):=CalcJump(DWORD(MainApi),Jmp);

 end;

 Pchar(P)[0]:=Char($68);

 DWORD(Pointer(DWORD(P)+1)^):=DWORD(HookedApi);

 Pchar(P)[5]:=Char($C3);

 VirtualProtect(P,$40,OldP,@TMP);

 Result:=True;

end;

(******************************************************************************)

function ApiUnHook(ModName,ApiName:Pchar; FuncAddr,HookedApi:Pointer; var MainApi:Pointer):Boolean;

var

 dwCount,Cnt,i,Jmp: DWORD;

 P: Pointer;

 hMod,OldP,TMP: Cardinal;

begin

 Result:=False;

 if IsWin9x then Exit;

 P:=FuncAddr;

 if P=nil then begin

  hMod:=GetModuleHandle(Pchar(ModName));

  P:=GetProcAddress(hMod,Pchar(ApiName));

 end;

 if (P=nil) or (MainApi=nil) or (HookedApi=nil) then Exit;

 if not VirtualProtect(P,$40,PAGE_EXECUTE_READWRITE,@OldP) then Exit;

 if ((Byte(P^)<>$68) or (DWORD(Pointer(DWORD(P)+1)^)<>DWORD(HookedApi))) then Exit;

 Cnt:=0;

 for dwCount:=0 to $3F do begin

  Inc(Cnt,OpCodeLength(DWORD(MainApi)+Cnt));

  if (Byte(Pointer(DWORD(MainApi)+Cnt)^)=$C3) and (Byte(Pointer(DWORD(MainApi)+Cnt+1)^)=$99) then Break;

  for i:=0 to Cnt-1 do Pchar(P)[i]:=Pchar(MainApi)[i];

 end;

 if (OpCodeLength(DWORD(P))=5) and ((Byte(P^)=$E8) or (Byte(P^)=$E9)) then begin

  Jmp:=DWORD(MainApi)+DWORD(Pointer(DWORD(MainApi)+1)^)+5;

  DWORD(Pointer(DWORD(P)+1)^):=CalcJump(DWORD(P),Jmp);

 end;

 VirtualProtect(P,$40,OldP,@TMP);

 VirtualFree(MainApi,0,MEM_RELEASE);

 Result:=True;

end;

(******************************************************************************)

function InjectAllProc(DllPath:string):Integer;

var

 hSnapP: THandle;

 ProcInfo: ProcessEntry32;

begin

 Result:=0;

 hSnapP:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

 if hSnapP=INVALID_HANDLE_VALUE then Exit;

 ProcInfo.dwSize:=SizeOf(ProcessEntry32);

 if Process32First(hSnapP,ProcInfo) then

 repeat

  if InjectDll(DllPath,ProcInfo.th32ProcessID) then Inc(Result);

 until not Process32Next(hSnapP,ProcInfo);

 CloseHandle(hSnapP);

end;

(******************************************************************************)

function UnInjectAllProc(DllPath:string):Integer;

var

 hSnapP: THandle;

 ProcInfo: ProcessEntry32;

begin

 Result:=0;

 hSnapP:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

 if hSnapP=INVALID_HANDLE_VALUE then Exit;

 ProcInfo.dwSize:=SizeOf(ProcessEntry32);

 if Process32First(hSnapP,ProcInfo) then

 repeat

  if UnInjectDll(DllPath,ProcInfo.th32ProcessID) then Inc(Result);

 until not Process32Next(hSnapP,ProcInfo);

 CloseHandle(hSnapP);

end;

(******************************************************************************)

function RDTSC: Int64; assembler;

asm

  DB 0fh ,031h

end;

(******************************************************************************)

function IsHeuristicScan:Boolean;

var

 Tm1,Tm2: Int64;

 Tc1,Tc2: DWORD;

begin

 // Method by: Magic_h2001

 Tm1:=RDTSC;

 Tc1:=GetTickCount;

 Sleep(100);

 Tm2:=RDTSC-Tm1;

 Tc2:=GetTickCount-Tc1;

 Result:=(Tm2<50000000) or (Tc2<50);

end;

(******************************************************************************)

function OpCodeLength(Address:DWORD):DWORD; cdecl; assembler;

const

  O_UNIQUE = 0;

  O_PREFIX = 1;

  O_IMM8 = 2;

  O_IMM16 = 3;

  O_IMM24 = 4;

  O_IMM32 = 5;

  O_IMM48 = 6;

  O_MODRM = 7;

  O_MODRM8 = 8;

  O_MODRM32 = 9;

  O_EXTENDED = 10;

  O_WEIRD = 11;

  O_ERROR = 12;

asm

@@ps:

@@go:

@@ft:

@@i7:

@@i6:

    inc  edx

    cmp  al, O_IMM8

    jz   @@t_exit

    cmp  al, O_MODRM

    jz   @@t_modrm

    cmp  al, O_WEIRD

    jz   @@t_weird

@@i5:

    inc  edx

    cmp  al, O_IMM16

    jz   @@t_exit

    cmp  al, O_MODRM8

    jz   @@t_modrm

@@i4:

    inc  edx

    cmp  al, O_IMM24

    jz   @@t_exit

@@i3:

    inc  edx

@@i2:

    inc  edx

    pushad

    mov  al, 66h

    repnz scasb

    popad

    jnz  @@c32

@@d2:

    dec  edx

    dec  edx

@@c32:

    cmp  al, O_MODRM32

    jz   @@t_modrm

    sub  al, O_IMM32

    jz   @@t_imm32

@@i1:

    inc  edx

@@t_exit:

    jmp @@ASMEnded

@@t_modrm:

       lodsb

       mov  ah, al

       shr  al, 7

       jb   @@prmk

       jz   @@prm

       add  dl, 4

       pushad

       mov  al, 67h

       repnz scasb

       popad

       jnz  @@prm

@@d3:  sub  dl, 3

       dec  al

@@prmk:jnz  @@t_exit

       inc  edx

       inc  eax

@@prm:

       and  ah, 00000111b

       pushad

       mov  al, 67h

       repnz scasb

       popad

       jz   @@prm67chk

       cmp  ah, 04h

       jz   @@prmsib

       cmp  ah, 05h

       jnz  @@t_exit

@@prm5chk:

       dec  al

       jz   @@t_exit

@@i42: add  dl, 4

       jmp  @@t_exit

@@prm67chk:

       cmp  ax, 0600h

       jnz  @@t_exit

       inc  edx

       jmp  @@i1

@@prmsib:

       cmp  al, 00h

       jnz  @@i1

       lodsb

       and  al, 00000111b

       sub  al, 05h

       jnz  @@i1

       inc  edx

       jmp  @@i42

@@t_weird:

       test byte ptr [esi], 00111000b

       jnz  @@t_modrm

       mov  al, O_MODRM8

       shr  bh, 1

       adc  al, 0

       jmp  @@i5

@@t_imm32:

       sub  bh, 0A0h

       cmp  bh, 04h

       jae  @@d2

       pushad

       mov  al, 67h

       repnz scasb

       popad

       jnz  @@chk66t

@@d4:  dec  edx

       dec  edx

@@chk66t:

       pushad

       mov  al, 66h

       repnz scasb

       popad

       jz   @@i1

       jnz  @@d2

@@ASMEnded:

    mov esp, ebp

    mov [result+(9*4)], edx

    popad

end;

(******************************************************************************)

initialization

 if IsHeuristicScan then Halt; // undetecting from Avs...

 @OpenProcess:=GetProcAddress(GetModuleHandle('kernel32'),'OpenProcess');

 @VirtualAllocEx:=GetProcAddress(GetModuleHandle('kernel32'),'VirtualAllocEx');

 @WriteProcessMemory:=GetProcAddress(GetModuleHandle('kernel32'),'WriteProcessMemory');

 @CreateRemoteThread:=GetProcAddress(GetModuleHandle('kernel32'),'CreateRemoteThread');

 @CreateToolhelp32Snapshot:=GetProcAddress(GetModuleHandle('kernel32'),'CreateToolhelp32Snapshot');

 @Process32First:=GetProcAddress(GetModuleHandle('kernel32'),'Process32First');

 @Process32Next:=GetProcAddress(GetModuleHandle('kernel32'),'Process32Next');

end.