ring3下伪装进程名绕过HS 部分Inline hook (by 小枫)

以前有人发过类似文章(或者说我抄袭了吧。)，但是那个代码我测试了已经不能用了。貌似MFC上也会出错。这里我的代码可以在mfc上使用。
此方法不需注入就读写Hackshield的进程地址空间数据，以及其它API的Detour Hook。【不能用于过保护。】
HS白名单可用伪装的进程列表，

代码:

 1. Name: patcher.exe
 2. Name: WerFault.exe
 3. Name: IAANTmon.exe
 4. Name: avp.exe
 5. Name: WmiApSrv.exe
 6. Name: xsync.exe
 7. Name: fssm32.exe
 8. Name: LGDCORE.exe
 9. Name: ACS.EXE
 10.Name: ITPYE.EXE
 11.Name: Joy2Key.exe
 12.Name: JOYTOKEYHIDE.EXE
 13.Name: JOYTOKEYKR.EXE
 14.Name: JOYTOKEY.EXE
 15.Name: DWM.EXE
 16.Name: WMIPRVSE.EXE
 17.Name: DK2.EXE
 18.Name: CSTRIKE-ONLINE.EXE
 19.Name: RAGII.EXE
 20.Name: EKRN.EXE
 21.Name: GOM.EXE
 22.Name: GAMEMON.DES
 23.Name: VAIOCAMERACAPTUREUTILITY.EXE
 24.Name: IPOINT.EXE
 25.Name: NMCOSRV.EXE
 26.Name: DEKARON.EXE
 27.Name: AUDIODG.EXE
 28.Name: NGM.EXE
 29.Name: TASKMGR.EXE
 30.Name: HGSCRAPEDITORHELPER.EXE
 31.Name: SE