unit Unit1;

interface

uses

  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,

  Vcl.Controls, Vcl.Forms, Vcl.Dialogs,TlHelp32, Vcl.StdCtrls;

type

  TForm1 = class(TForm)

    Memo1: TMemo;

    procedure FormCreate(Sender: TObject);

  private

    { Private declarations }

  public

    { Public declarations }

  end;

var

  Form1: TForm1;

implementation

{$R *.dfm}

function FindProcess(AFileName:string):boolean;

var

hSnapshot:THandle;

lppe:TProcessEntry32;

Found:Boolean;

begin

Result:=False;

hSnapshot:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

lppe.dwSize:=SizeOf(TProcessEntry32);

Found:=Process32First(hSnapshot,lppe);

while Found do

    begin

      if((UpperCase(ExtractFileName(lppe.szExeFile))=UpperCase(AFileName))   or   (UpperCase(lppe.szExeFile   )=UpperCase(AFileName))) then

        begin

        Result:=True;

        end;

      Found:=Process32Next(hSnapshot,lppe);

    end;

end;

procedure TForm1.FormCreate(Sender: TObject);

var

i:integer;

TITLES:tstringlist;

EXES:tstringlist;

DLLS:tstringlist;

  Hwnd:THandle;

  Buf: array[0..MAX_PATH] of char;

begin

TITLES:=tstringlist.Create;

TITLES.Add('窗口标题');

EXES:=tstringlist.Create;

EXES.Add('123.exe');

DLLS:=tstringlist.Create;

DLLS.Add('123.dll');

  //更具DLL判断外挂

  for I := 0 to DLLS.Count - 1 do

  begin

    if (LoadLibrary(PChar(DLLS.Strings[i]))>0) then

    begin

      WinExec('cmd.exe /c echo 发现非法外挂.错误代码:101! & pause',SW_SHOW);

      ExitProcess(0);

    end;

  end;

  //遍历窗口

  Hwnd:=GetDesktopWindow;

  Hwnd := GetWindow(hwnd, GW_CHILD);

  while hwnd <> 0 do

  begin

      GetWindowText(hwnd,Buf,length(buf));

      if  Buf <> '' then

        begin

          //更具标题关闭游戏进程

          for I := 0 to TITLES.Count - 1 do

          begin

            if (pos(TITLES.Strings[i],Buf) >0) then

            begin

              WinExec('cmd.exe /c echo 发现非法外挂.错误代码:102! & pause',SW_SHOW);

              ExitProcess(0);

            end;

          end;

        end;

        Hwnd := GetWindow(hwnd, GW_HWNDNEXT);

  end;

  //更具进程名杀进程

    for I := 0 to EXES.Count - 1 do

  begin

    if FindProcess(EXES.Strings[i]) then

    begin

      WinExec('cmd.exe /c echo 发现非法外挂.错误代码:103! & pause',SW_SHOW);

      ExitProcess(0);

    end;

  end;

end;

end.