[Original] A simple Windows hook-hides specific processes in the Process Manager

A simple Windows hook-hides specific processes in the Process Manager 

(Applicable platform: Windows 2000 SP4, Windows XP SP2)

 

There are many methods to shield the process name in the task manager, which can be done at ring0 level.Article:

Modify the linked list of kernel processes and intercept kernel APIs. Here I only provide the implementation under Win32, the original

Is the most common Windows Hook mechanism. Implementation language Win32 assembly (masm32 ):

 

0. Process Resource Acquisition and generate "working" threads in dllentry:

MoV eax, _ hinstance
MoV hinstance, eax

. If _ dwreason = dll_process_attach

. If cutme = 0
MoV cutme, 1
. Else
Invoke createthread, null, 0, ADDR ctprocex, 0 ,/
ADDR tid
. Endif
. Elseif _ dwreason = dll_process_detach
. If oldlvproc = 0
JMP quit
. Endif
Invoke setwindowlong, HlV, gwl_wndproc ,/
Oldlvproc

. Endif

1. After wh_callwndproc is caught, the default message processing process of the list control is changed.

To monitor any list to insert messages:

; **************************************** *****************************
Newlvproc proc uses esi edi ebx hwnd, umsg, wparam, lparam
Local retbyte: DWORD

MoV eax, umsg
. If eax = lvm_insertitemw
Assume ESI: PTR lv_item
MoV ESI, lparam
MoV EBX, [esi]. psztext

Invoke widechartomultibyte, cp_acp, 0 ,/
EBX,-1, ADDR Buf ,/
Sizeof Buf, null, null
Assume ESI: Nothing
Invoke lstrcmp, ADDR Buf, ADDR stxt
. If eax = 0

. Else
Invoke callwindowproc, oldlvproc ,/
Hwnd, umsg, wparam, lparam
RET
. Endif
. Elseif eax = lvm_setitemw
Assume ESI: PTR lv_item
MoV ESI, lparam
MoV EBX, [esi]. psztext

Invoke widechartomultibyte, cp_acp, 0 ,/
EBX,-1, ADDR Buf ,/
Sizeof Buf, null, null
Assume ESI: Nothing
Invoke lstrcmp, ADDR Buf, ADDR stxt
. If eax = 0

. Else
Invoke callwindowproc, oldlvproc ,/
Hwnd, umsg, wparam, lparam

RET
. Endif
. Else
Invoke callwindowproc, oldlvproc, hwnd, umsg ,/
Wparam, lparam
RET
. Endif

XOR eax, eax
RET

Newlvproc endp
; **************************************** *****************************
Ctprocex proc uses esi edi ebx _ PM
Local II: DWORD
Local lvfi: lv_findinfo
 
MoV lvfi. Flags, lvfi_string
Lea eax, stxt
MoV lvfi. psz, eax
 
Invoke sendmessage, HlV, lvm_finditem,-1, ADDR lvfi
. If eax! = 0 ffffffffh
MoV II, eax
Invoke sendmessage, HlV, lvm_deleteitem, II, 0
. Endif

MoV lvfi. Flags, lvfi_string
Lea eax, stxt2
MoV lvfi. psz, eax
 
Invoke sendmessage, HlV, lvm_finditem,-1, ADDR lvfi
. If eax! = 0 ffffffffh
MoV II, eax
Invoke sendmessage, HlV, lvm_deleteitem, II, 0
. Endif

Invoke setwindowlong, HlV, gwl_wndproc, ADDR newlvproc
MoV oldlvproc, eax
Quit:
RET

Ctprocex endp
; **************************************** *****************************

(Note: when Windows XP SP2 executable file protection is enabled, exceptions may occur when you exit)