///XP/Vista/WIN7以及X86/X64 通吃
function Kernel32Handle(): HMODULE;
{$IFDEF CPUX64}
asm
mov rbx,$60
mov rax,[gs:rbx] // peb
mov rax,[rax+$18] // LDR
mov rax,[rax+$30] // InLoadOrderModuleList.Blink,
mov rax,[rax] // [_LDR_MODULE.InLoadOrderModuleList].Blink kernelbase.dll
mov rax,[rax] // [_LDR_MODULE.InLoadOrderModuleList].Blink kernel32.dll
mov rax,[rax+$10] //[_LDR_MODULE.InLoadOrderModuleList]. BaseAddress
end;
{$ELSE}
asm
mov eax,[fs:$30] // Peb
mov eax,[eax+$C] // LDR
mov eax,[eax+$C] // InLoadOrderModuleList
mov eax,[eax] // [_LDR_MODULE.InLoadOrderModuleList].Blink kernelbase.dll
mov eax,[eax] //[_LDR_MODULE.InLoadOrderModuleList].Blink kernel32.dll
mov eax,[eax+$18] //[_LDR_MODULE.InLoadOrderModuleList]. BaseAddress
end;
{$ENDIF}
转载于:https://my.oschina.net/u/1777508/blog/609175