Delphi – XP下的進程靜音技術

很多瀏覽器有這種功能，實現原理都是一樣。發聲源基本都來自Flash，比如Flash遊戲啦，視頻播放器啦等等

而Flash的發聲都是通過winmm.dll::waveOutWrite函數來完成，所以，我們只要能“接管”這個函數就行了

下面的代碼是以前寫的一個模組，針對Flash的靜音，代碼寫的比較粗糙 ^_^

 

注意，下面的代碼僅僅針對Flash模組進行IAT Hook

XP測試通過

unit FlashMute;interfaceuses  Windows, SysUtils, Classes, StrUtils, TlHelp32, MMSystem;type  TFlashMute = class  private    class var Flag: Boolean;  public    class function Modify_waveOutWrite: Boolean;    class procedure Enable;    class procedure Disable;  end;implementationfunction MywaveOutWrite(hWaveOut: HWAVEOUT; lpWaveOutHdr: PWaveHdr; uSize: UINT): MMRESULT; stdcall;begin  if TFlashMute.Flag then    ZeroMemory(lpWaveOutHdr.lpData, lpWaveOutHdr.dwBufferLength);  Result := waveOutWrite(hWaveOut, lpWaveOutHdr, uSize);end;{ TFlashMute }class procedure TFlashMute.Disable;begin  TFlashMute.Flag := True;end;class procedure TFlashMute.Enable;begin  TFlashMute.Flag := False;end;class function TFlashMute.Modify_waveOutWrite: Boolean;var  hSnapshot: THandle;  ME32: TModuleEntry32;  Found: Boolean;  BaseAddr: DWORD;  DosHeader: PImageDosHeader;  NtHeader: PImageNtHeaders;  ImportDesc: PImageImportDescriptor;  ITD, ITD2: PImageThunkData;  IIBN: PImageImportByName;  mbi: TMemoryBasicInformation;begin  Result := False;  // 枚舉當前進程模組列表，找到Flash?.ocx  hSnapshot := CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId);  if hSnapshot <> INVALID_HANDLE_VALUE then  begin    ME32.dwSize := SizeOf(TModuleEntry32);    Found := Module32First(hSnapshot, ME32);    while Found do    begin      if ContainsText(ME32.szModule, 'Flash') then      begin        if SameText(ExtractFileExt(ME32.szModule), '.ocx') then        begin          BaseAddr := DWORD(@ME32.modBaseAddr^);          DosHeader := @ME32.modBaseAddr^;          NtHeader := Ptr(BaseAddr + DosHeader^._lfanew);          // 遍曆輸入模組          ImportDesc := Ptr(BaseAddr + NtHeader.OptionalHeader.DataDirectory[1].VirtualAddress);          while ImportDesc^.Name <> 0 do          begin            ITD := PImageThunkData(BaseAddr + ImportDesc^.OriginalFirstThunk);    // 指向函數名稱RVA或函數序號            ITD2 := PImageThunkData(BaseAddr + ImportDesc^.FirstThunk);           // 指向函數地址            // 遍曆輸入函數            while ITD^.AddressOfData <> 0 do            begin              // 按函數名方式匯入的函數              if ITD^.AddressOfData and IMAGE_ORDINAL_FLAG <> IMAGE_ORDINAL_FLAG then              begin                IIBN := PImageImportByName(BaseAddr + ITD^.AddressOfData);                // 找出 winmm.dll::waveOutWrite                if SameText(string(PAnsiChar(@IIBN^.Name[0])), 'waveOutWrite') then                begin                  if VirtualProtect(@ITD2^._Function, SizeOf(DWORD), PAGE_EXECUTE_READWRITE, @mbi.Protect) then                  begin                    ITD2^._Function := DWORD(@MywaveOutWrite);                    Result := True;                  end;                  Break;                end;              end;              Inc(ITD);              Inc(ITD2);            end;            if Result then              Break;            Inc(ImportDesc);          end;        end;      end;      if Result then        Break;      Found := Module32Next(hSnapshot, ME32);    end;    CloseHandle(hSnapshot);  end;end;