[分享]探测隐藏进程
在网上发现这个 也不知道真的假的 大家研究研究 #include "stdafx.h"
#include <windows.h>
#include "psapi.h"
#pragma comment(lib,"psapi.lib")
int main(int argc, char* argv[])
{
printf("\nEasy to Find Hided PID Code \n");
printf("Author: Finback Jun.6,2006 <Finbackcpp@hotmail.com> \n");
printf("NOTE：this code needn't any driver supported \n");
printf(" \n");
DWORD aProcesses[1024], cbNeeded;
if ( !EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) )
return 0;
DWORD cProcesses = cbNeeded / sizeof(DWORD);
DWORD PidFor;
for ( PidFor = 0x0c; PidFor < 0xFFFF; PidFor +=4 )
{
HANDLE hProcess = OpenProcess( PROCESS_QUERY_INFORMATION |
PROCESS_VM_READ,
FALSE, PidFor );
if (hProcess)
{
BOOL sHide = false;
unsigned int i;
char szName[MAX_PATH]="<Unknown>";
HMODULE hModule;
for ( i = 1; i <= cProcesses; i++ )
{
if (PidFor == aProcesses)
{
sHide = true;
break;
}
}
if(EnumProcessModules(hProcess,&hModule,sizeof(hModule),&cbNeeded))
{
GetModuleFileNameEx(hProcess,hModule,szName,sizeof(szName));
printf("%-5d - %16s %s\n", PidFor, szName, (sHide) ? "" : "--[Hidden]--");
}
else
{
GetProcessImageFileName(hProcess,szName,sizeof(szName));
printf("%-5d - %16s %s\n", PidFor, szName, "--[Zombie]--");
}
}
CloseHandle( hProcess );
}
return 0;
}
有点错误 正在解决中``
