Shulou(Shulou.com)06/01 Report--

A simple HOOK OpenProcess function to prevent the task manager from using OpenProcess to get a handle to the process we want to protect,

So that the task manager can not end the process using TerminateProcess.

When we HOOK to OpenProcess, we need to determine whether the opened process is the process we want to protect in our MyOpenProcess, if it simply returns the error code 0, if not, call the real OpenProcess in our MyOpenProcess,

The judgment is like this,

First get the handle of the window from the name of our process window involving API FindWindow

Then through the handle of our window, we get the process of creating the window ID, which involves API GetWindowThreadProcessId

The ID obtained here is the real ID that we want to protect the process, and the task manager getting ID is the third parameter,

So there is the following code,

/ / to get the window handle system API function to protect the title of the process, use:: to distinguish it from the class extension function.

/ / use TEXT macros, HWND window handles,

HANDLE WINAPI MyOpenProcess (DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwProcessId)

{

HWND HProtect =:: FindWindow (NULL,TEXT ("Windows current all processes"))

If (! HProtect)

{

Return (pRealOpenProcess (dwDesiredAccess,bInheritHandle,dwProcessId))

} / / if it does not exist, call return

/ / get the ID of the process that created this window, save it in & ProtectId address,

DWORD ProtectId; / / find the creator of a window (thread or process)

GetWindowThreadProcessId (HProtect,&ProtectId)

If (ProtectId = = dwProcessId) / / dwProcessId is the process ID to be terminated by the task manager

{

Return 0There is an error code 0 if it ends our process.

}

Return (pRealOpenProcess (dwDesiredAccess,bInheritHandle,dwProcessId))

}

That's it.

Among them, HOOK technology uses code like this already written before IAT HOOK,

DLL injection also uses a simple remote thread injection technique previously written,

Demo,

Open the task manager and use the DLL injection tool to inject the DLL, which has the simple function of protecting the process,

Then use the task manager to end the process we protected in DLL, there is no response at this time, the process is not terminated,

Why not play a box?

Because the task manager seems to call OpenProcess all the time, if you use the MessageBox function, it will play all the time, of course, the effect is not good.

If you want to pop up the box, you can HOOK the TerminateProcess function, implement it in TerminateProcess,

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.