进程守护

最新推荐文章于 2024-09-03 14:42:05 发布

小范f-li.cn

最新推荐文章于 2024-09-03 14:42:05 发布

阅读量151

点赞数

CC 4.0 BY-SA版权

本文链接：https://blog.youkuaiyun.com/w395115323/article/details/89346027

本文详细介绍了如何使用C++实现进程守护功能，并通过动态库加载和GetProcAddress函数获取目标函数地址，进而对指定进程进行保护操作。重点阐述了如何在不依赖于特定操作系统的情况下，实现对进程的灵活管理和控制。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

进程守护

private class SetPID
        {
            public delegate void SETPID(uint iPID);
            [DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
            public static extern SETPID GetProcAddress(IntPtr hModule, string procName);
        }

        [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        public static extern uint GetCurrentProcessId();

        private delegate int HookProc(int nCode, Int32 wParam, IntPtr lParam);
        [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true, ExactSpelling = true)]
        private static extern HookProc GetProcAddress(IntPtr hModule, string procName);

        [DllImport("kernel32.dll", CallingConvention = CallingConvention.StdCall)]
        private static extern IntPtr LoadLibrary(string sComName);
        [DllImport("user32.dll", CallingConvention = CallingConvention.StdCall)]
        private static extern IntPtr SetWindowsHookEx(int idHook, HookProc lpfn, IntPtr pInstance, int threadId);
        [DllImport("user32.dll", CallingConvention = CallingConvention.StdCall)]
        private static extern bool UnhookWindowsHookEx(IntPtr pHookHandle);

        private const string NKCore = "NKCore.dll";
        private const int WH_GETMESSAGE = 3;

        public static bool ProtectProcess(uint processID, out IntPtr iHookProcedure)
        {
            //创建VC++核心动态库
            string path = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, NKCore);
            if (!File.Exists(path))
            {
                AppRuntime.CreateFileFromResource(false, "Rocky.Resources.NKCore.dll", path);
            }
            IntPtr pInstance = LoadLibrary(NKCore);
            SetPID.SETPID pGPA = SetPID.GetProcAddress(pInstance, "SetPID");
            if (pGPA == null)
            {
                iHookProcedure = IntPtr.Zero;
                return false;
            }
            pGPA(processID);
            HookProc HookProcedure = GetProcAddress(pInstance, "MsgProc");
            iHookProcedure = SetWindowsHookEx(WH_GETMESSAGE, HookProcedure, pInstance, 0);
            return iHookProcedure != IntPtr.Zero;
        }

        public static bool UnprotectProcess(ref IntPtr iHookProcedure)
        {
            return UnhookWindowsHookEx(iHookProcedure);
        }