unit Unit1;

interface

uses

  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,

  Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls;

type

  TForm1 = class(TForm)

    Memo1: TMemo;

    procedure FormCreate(Sender: TObject);

  private

    { Private declarations }

  public

    { Public declarations }

  end;

var

  Form1: TForm1;

implementation

{$R *.dfm}

procedure TForm1.FormCreate(Sender: TObject);

var

i:integer;

dlls:tstringlist;

begin

dlls:=tstringlist.Create;

dlls.Add('ntdll.dll');

  //更具DLL判断外挂

  for I := 0 to DLLS.Count - 1 do

  begin

    if (LoadLibrary(PChar(DLLS.Strings[i]))>0) then

    begin

      WinExec('cmd.exe /c echo 发现非法外挂.错误代码:101! & pause',SW_SHOW);

      ExitProcess(0);

    end;

  end;

end;

end.