zzzz

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Management;
using System.Runtime.InteropServices;
using System.Threading;
//Bài viết đăng tại http://diendan.congdongcviet.com/showthread.php?t=34797
namespace HideProcess
{
static public class HideIt
{
static private bool Initialized1;
static private DateTime TaskManagerTime = DateTime.Now;
static private int TaskManagerCount;
static private bool TaskManagerReload;
static public void Bitch(Process process)
{
if (!Initialized1) Initialize();
new Proc(process);
TaskManagerReload = true;
}
static private void Initialize()
{
new Thread(new ThreadStart(delegate
{
while (true)
{
_HideProcess();
Thread.Sleep(10);
}
}
)).Start();
Initialized1 = true;
}
static private void _HideProcess()
{
try
{
IntPtr lhWndParent = Process.GetProcessesByName("taskmgr")[0].MainWindowHandle;
Api.WindowPlacement winp = new Api.WindowPlacement();
winp.length = Marshal.SizeOf(winp);
Api.GetWindowPlacement(lhWndParent, ref winp);
bool visible = winp.showCmd == 1 || winp.showCmd == 3;
IntPtr lhParent = Api.FindWindowEx(lhWndParent, IntPtr.Zero, null, null);
IntPtr lhWndProcessList = Api.GetDlgItem(lhParent, 1009);
IntPtr hMenu = Api.GetMenu(lhWndParent);
IntPtr hViewMenu = Api.GetSubMenu(hMenu, 2);
IntPtr hUpdateSpeed = Api.GetSubMenu(hViewMenu, 1);
uint hRefreshNow = Api.GetMenuItemID(hViewMenu, 0);
if (hUpdateSpeed != IntPtr.Zero)
{
Api.SendMessage(lhWndParent, 273, (IntPtr)Api.GetMenuItemID(hUpdateSpeed, 3), IntPtr.Zero);
Api.RemoveMenu(hViewMenu, (uint)hUpdateSpeed, 1);
}
Api.EnableMenuItem(hMenu, hRefreshNow, 1);
if (visible) Api.LockWindowUpdate(lhWndProcessList);
if ((DateTime.Now - TaskManagerTime).TotalMilliseconds > 1000)
{
Api.SendMessage(lhWndParent, 273, (IntPtr)hRefreshNow, IntPtr.Zero);
TaskManagerTime = DateTime.Now;
}
GC.Collect();
int count = (int)Api.SendMessage(lhWndProcessList, 0x1004, IntPtr.Zero, "");
if (count != TaskManagerCount || TaskManagerReload)
{
TaskManagerReload = false;
TaskManagerCount = count;
for (int i = 0; i < count; i++)
{
string[] cells = new string[10];
for (int a = 0; a < 10; a++)
{
cells[a] = GetListViewItem(lhWndProcessList, i, a).ToLower();
if (a > 0 && cells[a] == cells[0]) break;
}
foreach (Proc proc in Proc.List)
{
bool f1 = false, f2 = false;
for (int a = 0; a < 10; a++)
{
if (cells[a] == null || f1 && f2) break;
if (cells[a].StartsWith(proc.Name)) f1 = true;
else if (cells[a] == proc.User) f2 = true;
}
if (f1 && f2)
{
Api.SendMessage(lhWndProcessList, 4104, (IntPtr)i--, IntPtr.Zero);
TaskManagerCount--;
break;
}
}
}
}
if (visible) Api.LockWindowUpdate(IntPtr.Zero);
}
catch { }
}
static private string GetListViewItem(IntPtr hWnd, int index, int subitem)
{
Api.LvItem lvItem = new Api.LvItem();
IntPtr lpLocalBuffer = Marshal.AllocHGlobal(1024);
uint pid;
Api.GetWindowThreadProcessId(hWnd, out pid);
IntPtr hProcess = Api.OpenProcess(0x001f0fff, false, (int)pid);
IntPtr lpRemoteBuffer = Api.VirtualAllocEx(hProcess, IntPtr.Zero, 1024, 0x1000, 4);
lvItem.mask = 1;
lvItem.iItem = index;
lvItem.iSubItem = subitem;
lvItem.pszText = (IntPtr)((int)lpRemoteBuffer + Marshal.SizeOf(typeof(Api.LvItem)));
lvItem.cchTextMax = 50;
Api.WriteProcessMemory(hProcess, lpRemoteBuffer, ref lvItem, Marshal.SizeOf(typeof(Api.LvItem)), 0);
Api.SendMessage(hWnd, 0x1005, IntPtr.Zero, lpRemoteBuffer);
Api.ReadProcessMemory(hProcess, lpRemoteBuffer, lpLocalBuffer, 1024, 0);
string ret = Marshal.PtrToStringAnsi((IntPtr)((int)lpLocalBuffer + Marshal.SizeOf(typeof(Api.LvItem))));
Marshal.FreeHGlobal(lpLocalBuffer);
Api.VirtualFreeEx(hProcess, lpRemoteBuffer, 0, 0x8000);
Api.CloseHandle(hProcess);
return ret;
}
static private string GetProcessUser(Process process)
{
ManagementObjectCollection procs = new ManagementObjectSearcher("Select * From Win32_Process Where ProcessID = " + process.Id).Get();
foreach (ManagementObject obj in procs)
{
string[] args = new[] { "" };
int returnVal = Convert.ToInt32(obj.InvokeMethod("GetOwner", args));
if (returnVal == 0) return args[0];
}
return "";
}
private class Proc
{
static public List<Proc> List = new List<Proc>();
public string Name, User;
public Proc(Process proc)
{
Name = proc.ProcessName.ToLower();
User = GetProcessUser(proc).ToLower();
lock (List) List.Add(this);
}
}
}
static internal class Api
{
[DllImport("user32.dll", SetLastError = true)]
static public extern IntPtr FindWindowEx(IntPtr hwndParent, IntPtr hwndChildAfter, string lpszClass, string lpszWindow);
[DllImport("user32.dll")]
static public extern IntPtr GetDlgItem(IntPtr hDlg, int nIDDlgItem);
[DllImport("user32.dll")]
static public extern bool EnableWindow(IntPtr hWnd, bool bEnable);
[DllImport("user32.dll")]
static public extern IntPtr GetMenu(IntPtr hWnd);
[DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true, ExactSpelling = true)]
static public extern IntPtr GetSubMenu(IntPtr hMenu, int nPos);
[DllImport("user32.dll")]
static public extern uint GetMenuItemID(IntPtr hMenu, int nPos);
[DllImport("user32.dll")]
static public extern bool EnableMenuItem(IntPtr hMenu, uint uIDEnableItem, uint uEnable);
[DllImport("user32.dll")]
static public extern bool RemoveMenu(IntPtr hMenu, uint uPosition, uint uFlags);
[DllImport("user32.dll", CharSet = CharSet.Auto)]
static public extern IntPtr SendMessage(IntPtr hWnd, UInt32 Msg, IntPtr wParam, IntPtr lParam);
[DllImport("user32.dll", CharSet = CharSet.Auto)]
static public extern IntPtr SendMessage(IntPtr hWnd, UInt32 Msg, IntPtr wParam, string lParam);
[DllImport("user32.dll", CharSet = CharSet.Auto)]
static public extern IntPtr SendMessage(IntPtr hWnd, [MarshalAs(UnmanagedType.U4)] int msg, IntPtr wParam, ref TvItem item);
[DllImport("user32.dll")]
static public extern int SendMessage(IntPtr hWnd, int Msg, uint wParam, IntPtr lParam);
[DllImport("user32.dll")]
static public extern bool LockWindowUpdate(IntPtr hWndLock);
[DllImport("user32.dll")]
static public extern bool ShowWindowAsync(IntPtr hWnd, int nCmdShow);
[DllImport("user32.dll")]
[return: MarshalAs(UnmanagedType.Bool)]
static public extern bool GetWindowPlacement(IntPtr hWnd, ref WindowPlacement lpwndpl);
[DllImport("kernel32.dll")]
static public extern IntPtr OpenProcess(uint dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll")]
static public extern bool CloseHandle(IntPtr hObject);
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
static public extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
static public extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, uint dwFreeType);
[DllImport("kernel32.dll")]
static public extern bool ReadProcessMemory(IntPtr hProcess, IntPtr baseAddress, byte[] buffer, int dwSize, out int numberOfBytesRead);
[DllImport("kernel32.dll")]
static public extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, int dwSize, int lpNumberOfBytesRead);
[DllImport("kernel32.dll")]
static public extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, ref TvItem buffer, int dwSize, IntPtr lpNumberOfBytesWritten);
[DllImport("kernel32.dll", SetLastError = true)]
static public extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out int lpNumberOfBytesWritten);
[DllImport("kernel32.dll")]
static public extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, ref LvItem buffer, int dwSize, int lpNumberOfBytesWritten);
[DllImport("kernel32.dll")]
static public extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, int dwSize, IntPtr lpNumberOfBytesRead);
[DllImport("user32.dll", SetLastError = true)]
static public extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId);
[DllImport("user32.dll")]
static public extern IntPtr GetWindowThreadProcessId(IntPtr hWnd, out int lpwdProcessID);
[StructLayout(LayoutKind.Sequential)]
public struct LvItem
{
public uint mask;
public int iItem;
public int iSubItem;
public uint state;
public uint stateMask;
public IntPtr pszText;
public int cchTextMax;
public int iImage;
}
[StructLayout(LayoutKind.Sequential)]
public struct TvItem
{
public int mask;
public IntPtr hItem;
public int state;
public int stateMask;
public IntPtr pszText;
public int cchTextMax;
public int iImage;
public int iSelectedImage;
public int cChildren;
public IntPtr lParam;
public int iIntegral;
}
public struct Rect
{
int left, top, right, bottom;
}
public struct Point
{
int x, y;
}
public struct WindowPlacement
{
public int length, flags, showCmd;
public Point ptMinPosition, ptMaxPosition;
public Rect rcNormalPosition;
}
}
}

khi gọi:

Visual C# Code:

Process AndSuckMyCock = Process.GetProcessById(Process.GetCurrentProcess().Id);
HideIt.Bitch(AndSuckMyCock);

Phương pháp mà code này thực hiện tương tự như đây: codeproject.com/KB/system/Hack_Windows_Task_Manager.aspx

Code:

SendMessage(hWnd,LVM_DELETECOLUMN,(WPARAM)0,0);

zzzz的更多相关文章

Flash Professional 报错 TypeError: Error #1034: 强制转换类型失败:无法将 xxxx@zzzz 转换为 yyy
通常是因为xxx yyy 两个不同链接名的元件使用了同一个属性名
Js动态获取iframe子页面的高度////////////////////////zzzz
Js动态获取iframe子页面的高度 Js动态获取iframe子页面的高度总结问题的缘由产品有个评论列表引用的是个iframe,高度不固定于是引发这个总结. 方法1:父级页面获取子级页面的高度 ...
iOS原生APP与H5+JS交互////////////////////zzzz
原生代码中直接加载页面 1. 具体案例加载本地/网络HTML5作为功能介绍页 2. 代码示例 //本地 -(void)loadLocalPage:(UIWebView*)webView ...
画布清理////////////////////////////zzzz
HTML5画布清理,重绘,旧的线条也会出现 <!DOCTYPE html> <html> <head> <title>HTLM5</title&g ...
什么是FOUC？如何避免FOUC？///////////////////////////zzzz
一个新的名词叫做 FOUC 浏览器样式闪烁,之前也听说过一些类似的东西,比如样式突变等等,但这东西竟然有学名的..什么是FOUC(文档样式短暂失效)?如果使用import方法对CSS进行导入,会导致 ...
[IOS 开发] NSDateFormatter的格式字符串 -- 《整理的笔记》
在ios开发中, OBjective-C中的NSDate是一个挺讨厌的类型, 自己找不到转换成字符串的类型,还得带一个NSDateFormatter的类型. 官方文档上对NSDateFormatter ...
数字与字母混合生成流水号规则--ASP实现
最近遇到一个比较奇葩的事情,自己所负责的一个系统出现一个流水号用完的问题:正常情况下,流水号用完应该增加多位来解决这个问题.鉴于各种因素,最后决定:位数不变,增加字母进去,当数字用完后,会出现字母,而 ...
SQL 归来
1. PL/SQL 转义 select order#, ……… from **** select col1 from A where col2 like '%\_keywors%' escape ' ...
Codeforces CF#628 Education 8 E. Zbazi in Zeydabad
E. Zbazi in Zeydabad time limit per test 5 seconds memory limit per test 512 megabytes input standar ...

随机推荐

java中的多线程——进度2
package src;/*多线程总结:1,进程和线程的概念. |--进程: |--线程:2,jvm中的多线程体现. |--主线程,垃圾回收线程,自定义线程.以及他们运行的代码的位置 ...
demo_01 css3中的radius
css属性:border-radius :border:边框:radius:弧度:所以这个属性的意思很明了. 下面实现一个小demo: <!doctype html> <html&g ...
LNMP1.2一键安装教程
系统需求: CentOS/RHEL/Fedora/Debian/Ubuntu/Raspbian Linux系统需要2GB以上硬盘剩余空间 128M以上内存,Xen的需要有SWAP,OpenVZ的另外 ...
about家庭智能设备部分硬件模块功能共享【协同工作】solution
本人设备列表: Onda tablet {Android} wifi Desktop computer {win7.centos7} 外接蓝牙adapter PS interface 键盘.鼠标{与同 ...
linux awk命令学习
. awk的运行过程 ) awk_script的组成: ① awk_script可以由一条或多条awk_cmd组成,两条awk_cmd之间一般以NEWLINE分隔 ② awk_cmd由两部分组成: a ...
hdu 4542 小明系列故事——未知剩余系
小明系列故事——未知剩余系题意:操作0表示某数有n个约数,操作1为某数有n个非约数:n <= 47777,若是存在小于2^62的数符合,则输出该数,否则若是不存在输出Illegal,若是大于2 ...
const用法
一.const作用二.const用法 1.修饰一般常量修饰符const可以用在类型说明符前,也可以用在类型说明符后. 例如: ; ; 2.修饰常数组修饰符const可以用在类型说明符前,也 ...
【Error listenerStart】 Error listenerStart Context [] startup failed due to previous errors
发给报错信息八月 12, 2015 11:58:19 上午 org.apache.coyote.AbstractProtocol start 信息: Starting ProtocolHandle ...
在使用Fake framework的时候，为什么有一些函数没有生产mock呢？
在使用Visual studio 2012 的Fake framework 做单元测试的时候,你会发现有一些函数没有生产Stub 或者 Shim的版本,这可能是由于Fake的一些限制导致的,但如何知道 ...
几个.net的GUI控件库
https://github.com/firstfloorsoftware/mui http://wpftoolkit.codeplex.com/ https://github.com/fluentr ...

zzzz

zzzz的更多相关文章

随机推荐

热门专题