按ctrl+alt+del 等也hook不到，他们不是调用CreateProcess 吗？试试监视Shellexecute，用Shell钩子 function NewShellExecuteW(hwnd:HWND;Operation:PWideChar;FileName:PWideChar;Parameters:PWideChar;Directory:PWideChar;ShowCmd:Integer):HINST;Stdcall; type TNewShellExecuteW=function (hwnd:HWND;Operation:PWideChar;fileName:PWideChar;Parameters:PWideChar;Directory:PWideChar;ShowCmd:Integer):HINST;Stdcall; begin Resutl:=8; Exit; end; 为什么这样编译不能通过来，这个函数本来就是这么声明的啊，
[DCC Error] eabe_data_main.dpr(127): E2005 'hwnd' is not a type identifier NtCreateProcess(
OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN BOOLEAN InheritObjectTable, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL );
和zwCreateProcess这两个函数的delphi声明
帮我把这个转换成delphi的function. MARK hwnd:HWND C++照抄过来的吧，DELPHI不区分大小写的。
delphi 手动装载驱动文件提示： RROR (1058): The driver is marked as disabled (Start=4) in its service database entry. 是不是这个驱动必需要用INF来安装。。用自带的INF来装是正常的。用手动装载就提示如上� ......
Option Explicit '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' ' Copyright ?1996-2009 VBnet, Randy Birch, All Rights Reserved. ' Some pages may also contain other copyrights by th ......
