Windows 9x process hidden

xiaoxiao2021-03-06  119

Windows 9x's process hidden with the heart studio original unauthorized, the purpose of reprinting the process hidden in Windows 9x is to let users in the task manager.

You cannot view and close the program to implement some key tasks.

The implementation process is relatively simple under Windows 9x, mainly calling a 32-bit API function:

RegisterServiceProcess, its function is:

Bool RegisterServiceProcess (DWORD DWPID, DWORD DWTYPE)

parameter:

DWPID: Process ID, NULL represents the current process

DWTYPE: RSP_SIMPLE_SERVICE is hidden, RSP_UNREGOSTER_SERVICE is hidden in cancellation process

Return Value: True: The call is successful, FALSE: Call failed

In addition, in order to automatically load the process with the system boot, you need to be in the startup item in the registry

Join your app, location:

/ HKEY_LOCAL_MACHINE / SOFTWARE / Microsoft / Windows / CurrentVersion / Run or RunServices

Since the registerServiceProcess function is an unapproved function under Windows 9x,

So only dynamically load, the specific details are as follows:

// Function Types for getProcAddress

Typedef Bool __stdcall (* pregisterService) (DWORD, DWORD);

// Get the OS VERSION INFORMATION

Osversion.dwosveionsInfosize = Sizeof (OsversionInfo);

GetversionEx (& OSVersion);

IF (Osversion.dwplatformID == Ver_Platform_Win32_WINDOWS)

{

Hkernel = loadLibrary ("kernel32.dll");

IF (Hkernel)

{

RegisterService = (PregisterService) GetProcaddress (Hkernel, "RegisterServiceProcess");

IF (RegisterService)

{

RegisterService (:: getCurrentProcessid (), RSP_SIMPLE_SERVICE);

}

Freelibrary (Hkernel);

Hkernel = NULL;

}

}

转载请注明原文地址:https://www.9cbs.com/read-125848.html

New Post(0)