Question

我试图隐藏任务管理员的进程，但它不起作用。我不明白为什么......

提前感谢您的帮助......！

这是我注入hider_dll.dll的函数：

int Inject(char* dll)
{
    int pid = getpid();

    HANDLE hProc=OpenProcess(PROCESS_ALL_ACCESS,false,pid);
    if(hProc)
    {
        cout<<"OpenProcess success"<<endl;
    }
    else
    {
        cout<<"OpenProcess failed..."<<endl;
        return 0;
    }
    LPVOID Vmem=VirtualAllocEx(hProc,0,strlen(dll)+1,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE);
    DWORD wrt;
    WriteProcessMemory(hProc,Vmem,dll,strlen(dll),(SIZE_T*)&wrt);



    stringstream sstr;
    sstr << wrt;
    string str = sstr.str();

    cout<<"Writed "+str+" bytes"<<endl;

    FARPROC LoadLib=GetProcAddress(LoadLibrary(L"kernel32.dll"),"LoadLibraryA");
    HANDLE h=CreateRemoteThread(hProc,0,0,(LPTHREAD_START_ROUTINE)LoadLib,Vmem,0,0);
    if(h)
    {
        cout<<"CreateRemoteThread success"<<endl;
    }
    else
    {
        cout<<"CreateRemoteThread failed\r\nError:"<<GetLastError()<<endl;
        return 0;
    }
    WaitForSingleObject(h,INFINITE);
    DWORD exit;
    GetExitCodeThread(h,&exit);
    cout<<"Dll loaded to "<<exit<<endl;
    return 1;
    }

Answer 1

这里是合适的注射器：

.second-page .flex .text-main

要从任务管理器中隐藏进程，您需要挂钩NtQuerySystemInformation（），如果使用了参数SYSTEM_PROCESS_INFORMATION，则需要从进程的链接列表中删除该进程。

这是您的钩子的样子：

#include <iostream>
#include <Windows.h>
#include <TlHelp32.h>

DWORD GetProcId(const char* procName)
{
    DWORD procId = 0;
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

    if (hSnap != INVALID_HANDLE_VALUE)
    {
        PROCESSENTRY32 procEntry;
        procEntry.dwSize = sizeof(procEntry);

        if (Process32First(hSnap, &procEntry))
        {
            do
            {
                if (!_stricmp(procEntry.szExeFile, procName))
                {
                    procId = procEntry.th32ProcessID;
                    break;
                }
            } while (Process32Next(hSnap, &procEntry));
        }
    }
    CloseHandle(hSnap);
    return procId;
}

int main()
{
    const char* dllPath = "C:\\Users\\'%USERNAME%'\\Desktop\\dll.dll"; //
    const char* procName = "processname.exe"; //
    DWORD procId = 0;

    while (!procId)
    {
        procId = GetProcId(procName);
        Sleep(30);
    }

    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, 0, procId);

    if (hProc && hProc != INVALID_HANDLE_VALUE)
    {
        void* loc = VirtualAllocEx(hProc, 0, MAX_PATH, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

        WriteProcessMemory(hProc, loc, dllPath, strlen(dllPath) + 1, 0);

        HANDLE hThread = CreateRemoteThread(hProc, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, loc, 0, 0);

        if (hThread)
        {
            CloseHandle(hThread);
        }
    }

    if (hProc)
    {
        CloseHandle(hProc);
    }
    return 0;
}

从任务管理器隐藏进程

1 个答案: