function IsInDebugr():Boolean;
var
DllModule: THandle;
IsDebuger: function (): BOOL; stdcall;
begin
DllModule := LoadLibrary('kernel32.dll');
IsDebuger := GetProcAddress(DllModule, 'IsDebuggerPresent');
Result := Assigned(IsDebuger) and IsDebuger();
end;
procedure CheckParentProc;
var //检查自己的进程的父进程
Pn: TProcesseNtry32;
sHandle:THandle;
H,ExplProc,ParentProc:Hwnd;
Found:Boolean;
Buffer:array[0..1023]of Char;
Path:string;
begin
H:= 0;
ExplProc:= 0;
ParentProc:= 0;
//得到Windows的目录
FillChar(Pn, SizeOf(Pn), 0);
Pn.dwSize := SizeOf(Pn);
GetWindowsDirectory(Buffer,Sizeof(Buffer)- 1);
//SetString(Path,Buffer,length(buffer));
path:=buffer;
//showmessage(path);
Path:= UpperCase(Path)+ '\EXPLORER.EXE';//得到Explorer的路径
//showmessage(path);
//得到所有进程的列表快照
sHandle:=CreateToolHelp32SnapShot(TH32CS_SNAPALL,0);
Found:= Process32First(sHandle,Pn);//查找进程
while Found do //遍历所有进程
begin
if Pn.szExeFile =ParamStr(0)then //自己的进程
begin
ParentProc:= Pn.th32ParentProcessID;//得到父进程的进程ID
inputbox('ParentProc父进程id','',inttostr(ParentProc));
//父进程的句柄
H:= OpenProcess(PROCESS_ALL_ACCESS,True,Pn.th32ParentProcessID);
end
//else if UpperCase(Pn.szExeFile)= Path then
else if UpperCase(Pn.szExeFile)= 'EXPLORER.EXE' then
begin
ExplProc:= Pn.th32ProcessID;//Ex plorer的PID
inputbox('explorere.exe id','',inttostr(ExplProc));
end;
Found:= Process32Next(sHandle,Pn);//查找下一个
end;
//父进程不是Explorer，是调试器……
if ParentProc<> ExplProc then
begin
//halt;showmessage('1111');
TerminateProcess(H,0);
halt;//杀之!除之而后快也! :）
//你还可以加上其它什么死机代码来消遣消遣这位可爱的Cracker:）
end;
end;
