windows下ZwQuerySystemInformation隐藏进程,给出c++代码
时间: 2023-06-24 20:03:59 浏览: 104
以下是一个简单的 C++ 代码示例,演示了如何使用 `ZwQuerySystemInformation` 函数来遍历系统中的进程并隐藏指定进程。
注意:这仅是一个示例代码,仅供学习和参考。在实际使用中,请确保您已经理解代码的含义,并且不要滥用这个功能。
```cpp
#include <Windows.h>
#include <iostream>
typedef NTSTATUS(WINAPI* pfnZwQuerySystemInformation)(ULONG, PVOID, ULONG, PULONG);
int main()
{
// 要隐藏的进程名
const wchar_t* processName = L"Demo.exe";
// 加载 ntdll.dll 并获取 ZwQuerySystemInformation 函数地址
HMODULE ntdll = LoadLibrary(L"ntdll.dll");
pfnZwQuerySystemInformation ZwQuerySystemInformation = (pfnZwQuerySystemInformation)GetProcAddress(ntdll, "ZwQuerySystemInformation");
if (ZwQuerySystemInformation == nullptr)
{
std::cerr << "Failed to get ZwQuerySystemInformation address." << std::endl;
return 1;
}
// 获取系统进程信息
ULONG bufferSize = 0;
ZwQuerySystemInformation(SystemProcessInformation, nullptr, 0, &bufferSize);
PVOID buffer = VirtualAlloc(nullptr, bufferSize, MEM_COMMIT, PAGE_READWRITE);
if (buffer == nullptr)
{
std::cerr << "Failed to allocate memory." << std::endl;
return 1;
}
ULONG returnLength;
NTSTATUS status = ZwQuerySystemInformation(SystemProcessInformation, buffer, bufferSize, &returnLength);
if (status != STATUS_SUCCESS)
{
std::cerr << "Failed to get system process information." << std::endl;
VirtualFree(buffer, 0, MEM_RELEASE);
return 1;
}
// 遍历进程信息并隐藏指定进程
PSYSTEM_PROCESS_INFORMATION current = (PSYSTEM_PROCESS_INFORMATION)buffer;
PSYSTEM_PROCESS_INFORMATION previous = nullptr;
while (current != nullptr)
{
if (wcscmp(current->ImageName.Buffer, processName) == 0)
{
// 隐藏进程
if (previous != nullptr)
{
previous->NextEntryOffset += current->NextEntryOffset;
}
else
{
// 如果是第一个进程,则需要更新 ProcessInfoListHead 指针
((PSYSTEM_PROCESS_INFORMATION)buffer)->NextEntryOffset = current->NextEntryOffset;
}
}
// 移动到下一个进程
previous = current;
current = (PSYSTEM_PROCESS_INFORMATION)((PUCHAR)current + current->NextEntryOffset);
}
// 释放内存并退出
VirtualFree(buffer, 0, MEM_RELEASE);
return 0;
}
```