| 网站首页 | 业界新闻 | 小组 | 威客 | 人才 | 下载频道 | 博客 | 代码贴 | 在线编程 | 编程论坛
欢迎加入我们,一同切磋技术
用户名:   
 
密 码:  
共有 522 人关注过本帖
标题:查找隐藏进程
只看楼主 加入收藏
feifeijkl
Rank: 1
等 级:新手上路
帖 子:1
专家分:0
注 册:2006-8-12
收藏
 问题点数:0 回复次数:0 
查找隐藏进程

通过Windows的Toolhlp32、psapi或ZwQuerySystemInformation系统调用能够列出进程,但这些方法一个随便的
ApiHook就能干掉,有没有其它好的方法找到隐藏进程?

有谁能转换下面代码为vb代码吗?
// Easy to Find Hided PID Code
// Author: Finback Jun.6,2006 <Finbackcpp@hotmail.com>
// NOTE:this code needn't any driver supported

#include "stdafx.h"
#include <windows.h>
#include "psapi.h"

#pragma comment(lib,"psapi.lib")

int main(int argc, char* argv[])
{

printf("\nEasy to Find Hided PID Code \n");
printf("Author: Finback Jun.6,2006 <Finbackcpp@hotmail.com> \n");
printf("NOTE:this code needn't any driver supported \n");
printf(" \n");


DWORD aProcesses[1024], cbNeeded;

if ( !EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) )
return 0;
DWORD cProcesses = cbNeeded / sizeof(DWORD);

DWORD PidFor;
for ( PidFor = 0x0c; PidFor < 0xFFFF; PidFor +=4 )
{
HANDLE hProcess = OpenProcess( PROCESS_QUERY_INFORMATION |
PROCESS_VM_READ,
FALSE, PidFor );

if (hProcess)
{
BOOL sHide = false;
unsigned int i;
char szName[MAX_PATH]="<Unknown>";
HMODULE hModule;

for ( i = 1; i <= cProcesses; i++ )
{
if (PidFor == aProcesses)
{
sHide = true;
break;
}

}

if(EnumProcessModules(hProcess,&hModule,sizeof(hModule),&cbNeeded))
{
GetModuleFileNameEx(hProcess,hModule,szName,sizeof(szName));
printf("%-5d - %16s %s\n", PidFor, szName, (sHide) ? "" : "--[Hidden]--");
}
else
{
GetProcessImageFileName(hProcess,szName,sizeof(szName));
printf("%-5d - %16s %s\n", PidFor, szName, "--[Zombie]--");
}

}

CloseHandle( hProcess );
}

return 0;
}

搜索更多相关主题的帖子: 进程 windows include 隐藏 
2006-08-12 10:58
快速回复:查找隐藏进程
数据加载中...
 
   



关于我们 | 广告合作 | 编程中国 | 清除Cookies | TOP | 手机版

编程中国 版权所有,并保留所有权利。
Powered by Discuz, Processed in 0.024112 second(s), 9 queries.
Copyright©2004-2024, BCCN.NET, All Rights Reserved