windows hook之进程防杀（任务管理器）

任务管理器防杀指定进程

minihook使用指南

1、原理

注入dll到任务管理，hook OpenProcessAPI实现进程信息获取操作，达到进程防杀

2、dll实现

#include "pch.h"
#include <Windows.h>
#include "../include/minihook/MinHook.h"
#include <TlHelp32.h>
#include <set>


#ifdef _WIN64
    #pragma comment(lib,"../include/minihook/libMinHook.x64.lib")
#else
    #pragma comment(lib,"../include/minihook/libMinHook.x86.lib")
#endif // _WIN64

std::set<DWORD> g_setPid = {
   1024};
typedef HANDLE(WINAPI* OldOpenProcess)(DWORD, BOOL, DWORD);
OldOpenProcess fpOldOpenProcess = NULL;



HANDLE WINAPI MyOpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId)
{
   
    if (!g_setPid.empty()) {
   
        auto setPid = g_setPid;
        if (setPid.find(dwProcessId) != setPid.end()) {
   
            // set error code
            SetLastError(ERROR_ACCESS_DENIED);
            return NULL;
        }
    }
    return fpOldOpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId);
}

void HookOpenProcess() {
   
    if (MH_Initialize() == MB_OK)
    {
   
        MH_CreateHook