check hidden process

  #include <windows.h>
#include "psapi.h"
#pragma comment(lib,"psapi.lib")
int main ( int argc , char * argv [])
{
printf
( "/nEasy to Find Hided PID Code /n" );
printf
( "Author: Finback Jun.6,2006 <Finbackcpp@hotmail.com> /n" );
printf
( "NOTE???this code needn't any driver supported /n" );
printf
( " /n" );
DWORD aProcesses
[ 1024 ], cbNeeded ;
if (! EnumProcesses ( aProcesses , sizeof ( aProcesses ), & cbNeeded ))
return 0 ;
DWORD cProcesses
= cbNeeded / sizeof ( DWORD );
DWORD
PidFor ;
for ( PidFor = 0x0c ; PidFor < 0xFFFF ; PidFor += 4 )
{
HANDLE hProcess
= OpenProcess ( PROCESS_QUERY_INFORMATION |
PROCESS_VM_READ
,
FALSE
, PidFor );
if ( hProcess )
{
BOOL sHide
= false ;
unsigned int i ;
char szName [ MAX_PATH ] = "<Unknown>" ;
HMODULE hModule
;

for ( i = 1 ; i < = cProcesses ; i ++)
{
if ( PidFor == aProcesses [ i ])
{
sHide
= true ;
break ;
}
}
if ( EnumProcessModules ( hProcess , & hModule , sizeof ( hModule ),
& cbNeeded ))
{
GetModuleFileNameEx ( hProcess , hModule , szName , sizeof ( szName ));
printf
( "%-5d - %16s %s/n" , PidFor , szName ,
( sHide ) ? "" : "--[Hidden]--" );
}
else
{
GetProcessImageFileName ( hProcess , szName , sizeof ( szName ));
printf
( "%-5d - %16s %s/n" , PidFor , szName , "--[Zombie]--" );
}
}
CloseHandle ( hProcess );
}
return 0 ;
}
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值