熱點推薦:
您现在的位置: 電腦知識網 >> 操作系統 >> Windows系統管理 >> 正文

WIN 9X下查找隱藏進程實現方法

2013-11-11 21:53:23  來源: Windows系統管理 

  在WIN X下一些黑客工具利用了未公開的API函數實現了隱藏自身不在任務列表中出現的功能要把它們找出來同樣也需要用到未公開的TOOLHELP系列函數因操作系統的不同NT下遍歷進程則用PSAPI函數來實現下面給出完整實列
  Processh
  //
  #ifndef UnitH
  #define UnitH
  //
  #include
  #include
  #include
  #include
  
  #define THCS_SNAPPROCESS x //快照進程
  #define PROCESS_HANDLE_NAME
  //
  typedef struct tagPROCESSENTRY //自定義TOOLHELP結構
  {
  DWORD dwSize;
  DWORD cntUsage;
  DWORD thProcessID; //進程ID
  DWORD thDefaultHeapID;
  DWORD thModuleID;
  DWORD cntThreads;
  DWORD thParentProcessID;
  LONG pcPriClassBase;
  DWORD dwFlags;
  TCHAR szExeFile[MAX_PATH]; //進程文件名
  } PROCESSENTRY;
  
  typedef PROCESSENTRY * LPPROCESSENTRY;
  
  //以下定義要從KERENLDLL中取出的TOOLHELP函數的函數指針
  
  HANDLE (WINAPI *CreateToolhelpSnapshot)(DWORD dwFlagsDWORD thPD);
  BOOL (WINAPI *ProcessFirst)(HANDLE hSnapshotLPPROCESSENTRY pe);
  BOOL (WINAPI *ProcessNext)(HANDLE hSnapshotLPPROCESSENTRY pe);
  
  //以下定義要從PSAPIDLL中取出函數的函數指針
  BOOL (WINAPI *EnumProcesses)(DWORD* lpidProcessDWORD cbDWORD *cbNeeded);
  DWORD (WINAPI *GetModuleFileNameExA)(HANDLE hProcessHMODULE hModuleLPTSTR lpstrFileNameDWORD nSize);
  
  
  class TForm : public TForm
  {
  __published: // IDEmanaged Components
  TButton *FindAllProcessFileName;
  TListBox *ListBox;
  void __fastcall FindAllProcessFileNameClick(TObject *Sender);
  void __fastcall FormResize(TObject *Sender);
  void __fastcall ButtonClick(TObject *Sender);
  void __fastcall ListBoxClick(TObject *Sender);
  private: // User declarations
  public: // User declarations
  __fastcall TForm(TComponent* Owner);
  };
  //
  extern PACKAGE TForm *Form;
  //
  #endif
  
  
  Processcpp
  //
  #include
  #pragma hdrstop
  #include Unith
  //
  #pragma package(smart_init)
  #pragma resource *dfm
  
  TForm *Form;
  
  //定義變量
  HANDLE process[];
  PROCESSENTRY p;
  DWORD process_ids[];
  DWORD num_processes;
  TCHAR file_name[MAX_PATH];
  TCHAR class_name[MAX_PATH];
  unsigned i;
  //
  
  //初始化TOOLHELP
  BOOL InitToolHelp()
  {
  //動態調用
  HINSTANCE DLLinst=LoadLibrary(KERNELDLL);
  if(DLLinst)
  {
  //取各函數在KERNEL中的地址
  CreateToolhelpSnapshot=(HANDLE(WINAPI *)(DWORD dwFlagsDWORD thPD))
  GetProcAddress(DLLinstCreateToolhelpSnapshot);
  ProcessFirst=(BOOL(WINAPI *)(HANDLE hSnapshotLPPROCESSENTRY pe))
  GetProcAddress(DLLinstProcessFirst);
  ProcessNext=(BOOL(WINAPI *)(HANDLE hSnapshotLPPROCESSENTRY pe))
  GetProcAddress(DLLinstProcessNext);
  if((!(UINT)CreateToolhelpSnapshot)||(!(UINT)ProcessFirst)||(!(UINT)ProcessNext))
  return FALSE;
  else
  return TRUE;
  }
  return FALSE;
  }
  
  
  //初始化PSAPI
  BOOL InitPSAPI()
  {
  HINSTANCE PSAPI=LoadLibrary(PSAPIDLL);
  if(NULL==PSAPI)
  return FALSE;
  EnumProcesses=(BOOL(WINAPI *)(DWORD* lpidProcessDWORD cbDWORD *cbNeeded))
  GetProcAddress(PSAPIEnumProcesses);
  GetModuleFileNameExA=(DWORD(WINAPI *)(HANDLE hProcessHMODULE hModuleLPTSTR lpstrFileNameDWORD nSize))
  GetProcAddress(PSAPIGetModuleFileNameExA);
  if(NULL == EnumProcesses||NULL == GetModuleFileName)
  return FALSE;
  else
  return TRUE;
  }
  
  
  __fastcall TForm::TForm(TComponent* Owner)
  : TForm(Owner)
  {
  }
  //
  
  void __fastcall TForm::FindAllProcessFileNameClick(TObject *Sender)
  {
  OSVERSIONINFO osinfo;
  osinfodwOSVersionInfoSize=sizeof(OSVERSIONINFO);
  //取當前操作系統類型
  if(GetVersionEx(&osinfo))
  {
  switch(osinfodwPlatformId)
  {
  //當前操作系統是WINX
  case VER_PLATFORM_WIN_WINDOWS:
  if(InitToolHelp())
  {
  ListBox>Clear();
  pdwSize=sizeof(PROCESSENTRY);
  //初始化TOOLHELP快照
  HANDLE pName=CreateToolhelpSnapshot(THCS_SNAPPROCESSNULL);
  //開始查找
  BOOL Next=ProcessFirst(pName&p);
  i=;
  //遍歷進程
  while(Next)
  {
  //顯示進程
  ListBox>Items>Add(pszExeFile);
  //根據進程ID獲取句並
  process[i]=OpenProcess(PROCESS_TERMINATEpthProcessID);
  //繼續查找
  Next=ProcessNext(pName&p);
  i++;
  }
  CloseHandle(pName);
  }
  break;
  
  //當前操作系統是NT
  case VER_PLATFORM_WIN_NT:
  if(InitPSAPI())
  {
  ListBox>Clear();
  //獲取當前進程個數
  EnumProcesses(process_idssizeof(process_ids)&num_processes);
  //遍歷進程
  for(i=; i  {
  //根據進程ID獲取句並
  process[i]=OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ
  process_ids[i]);
  //通過句並獲取進程文件名
  if(GetModuleFileNameExA(process[i]NULLfile_namesizeof(file_name)))
  ListBox>Items>Add(file_name);
  }
  }
  break;
  }
  }
  }
  
  //
  void __fastcall TForm::ListBoxClick(TObject *Sender)
  {
  int iCount;
  iCount=ListBox>ItemIndex;
  ListBox>Hint=ListBox>Items>Strings[iCount];
  }
  //
  
  else ShowMessage(初始化TOOLHELP失敗);
  }
  
  
  

From:http://tw.wingwit.com/Article/os/xtgl/201311/9444.html
    Copyright © 2005-2013 電腦知識網 Computer Knowledge   All rights reserved.