PB 写DLL

#COMPILE DLL  '表示编译成DLL文件
#DIM ALL
%USEMACROS = 1
#INCLUDE "Win32API.inc"      '在C:/PBWin80/WinAPI目录下的文件，这是  Win32API函数库，只要这样用了大部分的API都可以直接用了
GLOBAL ghInstance AS DWORD
GLOBAL hThread AS DWORD

FUNCTION IsFileRun(BYVAL pFile AS STRING) AS LONG
    DIM hFile AS LONG
    hFile = CreateFile(BYVAL STRPTR(pFile), %GENERIC_READ OR %GENERIC_WRITE, 0&, BYVAL %NULL, %OPEN_EXISTING, %FILE_ATTRIBUTE_NORMAL, 0&)
    IsFileRun = hFile
    CloseHandle hFile
END FUNCTION
'这是打开和创建文件等等的API函数
'如执行成功，则返回文件句柄，如果失败就返回INVALID_HANDLE_VALUE 即-1,这跟下面的判断是符合的。
'CreateFile这个API函数详细信息BAIDU一下就清楚了。
'大概原理是：看看指定路径的文件可不可直接改写，如果可以就表示文件没运行，如果不可，就表示它在运行了。当然这只是一种方法。
FUNCTION LIBMAIN(BYVAL hInstance AS LONG, BYVAL fwdReason AS LONG, BYVAL lpvReserved AS LONG) AS LONG   '这是DLL的入口函数LIBMAIN
                                                                                                        '  这
    SELECT CASE fwdReason                                                                               '  一
    CASE %DLL_PROCESS_ATTACH                                                                            '  大
                                                                                                        '  块
        ghInstance = hInstance                                                                          '  是
        THREAD CREATE ThreadProc1(%NULL) TO hThread     'DLL载入时建立一个线程 ThreadProc1              '  用
        FUNCTION = 1                                                                                    '  来
                                                                                                        '  控
    CASE %DLL_PROCESS_DETACH  '进程被停止                                                               '  制
                                                                                                        '  线
        'TerminateThread hThread, %NULL                  'DLL卸载时结束线程 ,这里我们不需要去动它。     '  程
        'Function = 1                                                                                   '  的
                                                                                                        '
    CASE %DLL_THREAD_ATTACH       '线程被调用                                                           '
                                                                                                        '
        FUNCTION = 1                                                                                    '
                                                                                                        '
    CASE %DLL_THREAD_DETACH         '线程被停止                                                         '
                                                                                                        '
        FUNCTION = 1                                                                                    '
                                                                                                        '
    END SELECT                                                                                          '
END FUNCTION                                                                                            '

FUNCTION ThreadProc1(BYVAL x AS DWORD) AS LONG'这是被创建的线程，我们的目的是用来检测进程
    DO WHILE (%TRUE)'死循环，不怕，在注入DLL里不会影响CPU多少
        IF IsFileRun("e:/desktop/procmon.exe") <> -1 THEN'检测e:/desktop/procmon.exe有没有运行，这就是您要保护的进程路径了。
            FUNCTION = SHELL("e:/desktop/procmon.exe")'如果没有运行就运行它。
        END IF
        SLEEP (300)    '暂停1秒
    LOOP
END FUNCTION