Контроль за процессом

#include "APIHook.h"
.....
static int (WINAPI*TrueConnect)(SOCKET s,const SOCKADDR_IN* name,int namelen);
.....
int __stdcall Hconnect(SOCKET s,const SOCKADDR_IN* name,int namelen)
{
  if(name->.sin_addr.s_addr == inet_addr("12.34.56.78")) return -1;
  return TrueConnect(s,name,namelen);
}
.....
int WINAPI DllEntryPoint(HINSTANCE hinst, unsigned long reason, void* lpReserved)
{
   if (reason==DLL_PROCESS_ATTACH)
   {
     // лутше всего добавить проверку на тему точно ли ет тот процесс
       TrueConnect = (int(__stdcall*)(unsigned int,const struct sockaddr FAR*,int))SetAPIHookByName("wsock32.dll","connect",Hconnect);
    };
  ....
}
.....

FindFirstChangeNotification
FindNextChangeNotification
FindCloseChangeNotification

RegNotifyChangeKeyValue

library Hook;

uses
  Windows,
  advApiHook;

{$R *.res}

const
  MutexName='__API_HOOK';

var
SH:HHOOK = 0;

  CopyFileNextHook: function (lpExistingFileName, lpNewFileName: PChar; bFailIfExists: BOOL): BOOL; stdcall;

//\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

function CopyFileHookProc(lpExistingFileName, lpNewFileName: PChar; bFailIfExists: BOOL): BOOL; stdcall;
begin
  MessageBox(0, 'Функция: CopyFile', 'Позволить ?', MB_YESNO or MB_ICONQUESTION);
end;

function MsgProc(code:DWORD;wParam,lparam:DWORD):DWORD;stdcall;
begin
  CallNextHookEx(SH,code,wParam,lparam);
end;

procedure SetWindowsHook(e:Boolean); stdcall;
var
  M:THandle;
begin
  if e then
   begin
    m:=CreateMutex(0,false,MutexName);
    if m=0 then exit;
    SH:=SetWindowsHookEx(WH_GETMESSAGE,@MsgProc,HInstance,0);
   end
       else
    UnhookWindowsHookEx(sh);
end;

procedure HandleEvents(reason: integer);
begin
  case reason of
    DLL_PROCESS_ATTACH:
      begin
        SetWindowsHook(true);
        HookProc('kernel32.dll', 'CopyFileW', @CopyFileHookProc, @CopyFileNextHook);
      end;
    DLL_PROCESS_DETACH:
      begin
        SetWindowsHook(false);  
        UnhookCode(@CopyFileNextHook);
      end;
  end;
end;

   //     HandleEvents(DLL_PROCESS_DETACH);

begin
  DllProc := @HandleEvents;
  MessageBox(0, 'Запускаем дллку', 'Позволить ?', MB_YESNO or MB_ICONQUESTION);
  HandleEvents(DLL_PROCESS_ATTACH);
///  CopyFile('C:\test.txt','C:\test1.txt',true);
end.
end.

function NewNtCreateFile(....)....
begin
  if <проверка> then
    result:=OldNtCreateFile(......);
     else
    begin
     result:=SEVERITY_ERROR; ///(3 или $C0000000, точно не помню)
     FileHandle^:=INVALID_HANDLE_VALUE;//(-1)
     exit;
    end;

library Hook;

uses
  Windows, advApiHook,
  NTSTATUSDEFS,
  HSNtDef,
  NtDll;

{$R *.res}

const
  MutexName='__API_HOOK';

var
SH:HHOOK = 0;
  NtCreateFileNextHook: function (FileHandle: PHandle; const DesiredAccess: ACCESS_MASK;
                    ObjectAttributes: POBJECT_ATTRIBUTES; IoStatusBlock: PIoStatusBlock;
                    AllocationSize: PLARGE_INTEGER;  FileAttributes, ShareAccess, CreateDisposition, CreateOptions: ULONG;
                    EaBuffer: PVOID; EaLength: ULONG): NTSTATUS; stdcall;
  NtOpenFileNextHook: function (FileHandle: PHandle; const DesiredAccess: ACCESS_MASK;  ObjectAttributes: POBJECT_ATTRIBUTES;
                    IoStatusBlock: PIoStatusBlock; const ShareAccess, OpenOptions: ULONG) : NTSTATUS; stdcall;

////////////////////////////////////////////////////////////////////////////////

{*
function NtCreateFileHookProc(FileHandle: PHandle; const DesiredAccess: ACCESS_MASK;
  ObjectAttributes: POBJECT_ATTRIBUTES; IoStatusBlock: PIoStatusBlock;
  AllocationSize: PLARGE_INTEGER;
  FileAttributes, ShareAccess, CreateDisposition, CreateOptions: ULONG;
  EaBuffer: PVOID; EaLength: ULONG): NTSTATUS; stdcall;

begin
end;
  *}
function NtOpenFileHookProc(FileHandle: PHandle; const DesiredAccess: ACCESS_MASK;  ObjectAttributes: POBJECT_ATTRIBUTES;
                    IoStatusBlock: PIoStatusBlock; const ShareAccess, OpenOptions: ULONG) : NTSTATUS; stdcall;
var
  res : NTSTATUS;
  err : Integer;
  text : PUNICODE_STRING;
  f:hFile;
  buffer,st :string;
  rwd : DWORD;
begin
  res:=NtOpenFileNextHook(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, ShareAccess, OpenOptions);
  if res = STATUS_SUCCESS then begin
//--
    err:=GetLastError;
    f:= CreateFile('C:\towrite.txt',GENERIC_READ or GENERIC_WRITE,0,
               nil, OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL, 0);
    if f <> INVALID_HANDLE_VALUE then begin
      try
        buffer:=#13+#10+'NtOpenFile: ';
        SetFilePointer(f,0,0,FILE_END);
        WriteFile(f,buffer[1],length(buffer),rwd,nil);
        text:= ObjectAttributes.ObjectName;
        st := WideCharToString(text.Buffer);
        WriteFile(f,st[1],length(st),rwd,nil);
      finally
        CloseHandle(f);
        SetLastError(err);
      end;
    end;
//--

    if (st = 'C:\test.txt') then begin
      CloseHandle(FileHandle^);
      FileHandle^:=INVALID_HANDLE_VALUE;
      res:=STATUS_OBJECT_NAME_NOT_FOUND;
    end;
  end;
  result:=res;
end;

function MsgProc(code:DWORD;wParam,lparam:DWORD):DWORD;stdcall;
begin
  CallNextHookEx(SH,code,wParam,lparam);
end;

procedure SetWindowsHook(e:Boolean); stdcall;
var
  M:THandle;
begin
  if e then
   begin
    m:=CreateMutex(0,false,MutexName);
    if m=0 then exit;
    SH:=SetWindowsHookEx(WH_GETMESSAGE,@MsgProc,HInstance,0);
   end
       else
    UnhookWindowsHookEx(sh);
end;

procedure HandleEvents(reason: integer)export;stdcall;
begin
  case reason of
    DLL_PROCESS_ATTACH:
      begin
        SetWindowsHook(true);
        //HookProc('ntdll.dll', 'NtCreateFile', @NtCreateFileHookProc, @NtCreateFileNextHook);
        HookProc('ntdll.dll', 'NtOpenFile', @NtOpenFileHookProc, @NtOpenFileNextHook);
      end;
    DLL_PROCESS_DETACH:
      begin
        SetWindowsHook(false);
        //UnhookCode(@NtCreateFileNextHook);
        UnhookCode(@NtOpenFileNextHook);
      end;
  end;
end;

begin
  DllProc := @HandleEvents;
  MessageBox(0, 'Запускаем дллку', 'Позволить ?', MB_YESNO or MB_ICONQUESTION);
  HandleEvents(DLL_PROCESS_ATTACH);
end.

if (st = 'C:\test.txt') then begin
      CloseHandle(FileHandle^);
      FileHandle^:=INVALID_HANDLE_VALUE;
      res:=STATUS_OBJECT_NAME_NOT_FOUND;
    end;

if (st = 'C:\test.txt') then begin
      CloseHandle(FileHandle^);
      FileHandle^:=INVALID_HANDLE_VALUE;
      res:=STATUS_OBJECT_NAME_NOT_FOUND;
    end;