type
PTIMPORT_CODE=^TIMPORT_CODE;
TIMPORT_CODE=packed record
JmpPtr:Word;
PtrAdd:^Pointer;
end;



function SHFormatDrive(hWnd: HWND;
Drive: Word;
fmtID: Word;
Options: Word): Longint
stdcall; external 'Shell32.dll' Name 'SHFormatDrive'; .............................声明一下



function GetAPIAddress(ApiPtr: Pointer): Pointer;
begin
Result := ApiPtr;
if ApiPtr= nil then
exit;
try
if (PTIMPORT_CODE(ApiPtr).JmpPtr = $25FF) then
Result := PTIMPORT_CODE(ApiPtr).PtrAdd^;
except
Result := nil;
end;
end;


procedure TForm1.Button1Click(Sender: TObject);
var
OrgSHFormatDrive: Pointer;
h: Cardinal;
begin
h:=LoadLibrary('Shell32.dll');
OrgSHFormatDrive:=GetProcAddress(h,'SHFormatDrive');
if GetAPIAddress(@SHFormatDrive) <> OrgSHFormatDrive then

begin
Showmessage('IAT HOOK');

end
else

begin
Showmessage('Not IAT HOOK');

end;
FreeLibrary(h);
end;