VB隐藏进程——modHidePro.bas的问题
简单，添加个模块，名称默认就行：
代码我都写好了，直接复制就醒了。
代码如下：
Option Explicit
Private Const STATUS_INFO_LENGTH_MISMATCH = &HC0000004
Private Const STATUS_ACCESS_DENIED = &HC0000022
Private Const STATUS_INVALID_HandLE = &HC0000008
Private Const ERROR_SUCCESS = 0&
Private Const SECTION_MAP_WRITE = &H2
Private Const SECTION_MAP_READ = &H4
Private Const READ_CONTROL = &H20000
Private Const WRITE_DAC = &H40000
Private Const NO_INHERITANCE = 0
Private Const DACL_SECURITY_INFORMATION = &H4
Private Type IO_STATUS_BLOCK
Status As Long
Information As Long
End Type
Private Type UNICODE_STRING
Length As Integer
MaximumLength As Integer
Buffer As Long
End Type
Private Const OBJ_INHERIT = &H2
Private Const OBJ_PERMANENT = &H10
Private Const OBJ_EXCLUSIVE = &H20
Private Const OBJ_CASE_INSENSITIVE = &H40
Private Const OBJ_OPENIF = &H80
Private Const OBJ_OPENLINK = &H100
Private Const OBJ_KERNEL_HandLE = &H200
Private Const OBJ_VALID_ATTRIBUTES = &H3F2
Private Type OBJECT_ATTRIBUTES
Length As Long
RootDirectory As Long
ObjectName As Long
Attributes As Long
SecurityDeor As Long
SecurityQualityOfService As Long
End Type
Private Type ACL
AclRevision As Byte
Sbz1 As Byte
AclSize As Integer
AceCount As Integer
Sbz2 As Integer
End Type
Private Enum ACCESS_MODE
NOT_USED_ACCESS
GRANT_ACCESS
SET_ACCESS
DENY_ACCESS
REVOKE_ACCESS
SET_AUDIT_SUCCESS
SET_AUDIT_FAILURE
End Enum
Private Enum MULTIPLE_TRUSTEE_OPERATION
NO_MULTIPLE_TRUSTEE
TRUSTEE_IS_IMPERSONATE
End Enum
Private Enum TRUSTEE_FORM
TRUSTEE_IS_SID
TRUSTEE_IS_NAME
End Enum
Private Enum TRUSTEE_TYPE
TRUSTEE_IS_UNKNOWN
TRUSTEE_IS_USER
TRUSTEE_IS_GROUP
End Enum
Private Type TRUSTEE
pMultipleTrustee As Long
MultipleTrusteeOperation As MULTIPLE_TRUSTEE_OPERATION
TrusteeForm As TRUSTEE_FORM
TrusteeType As TRUSTEE_TYPE
ptstrName As String
End Type
Private Type EXPLICIT_ACCESS
grfAccessPermissions As Long
grfAccessMode As ACCESS_MODE
grfInheritance As Long
TRUSTEE As TRUSTEE
End Type
Private Type AceArray
List() As EXPLICIT_ACCESS
End Type
Private Enum SE_OBJECT_TYPE
SE_UNKNOWN_OBJECT_TYPE = 0
SE_FILE_OBJECT
SE_SERVICE
SE_PRINTER
SE_REGISTRY_KEY
SE_LMSHARE
SE_KERNEL_OBJECT
SE_WINDOW_OBJECT
SE_DS_OBJECT
SE_DS_OBJECT_ALL
SE_PROVIDER_DEFINED_OBJECT
SE_WMIGUID_OBJECT
End Enum
Private Declare Function SetSecurityInfo Lib "advapi32.dll" (ByVal Handle As Long, ByVal ObjectType As SE_OBJECT_TYPE, ByVal SecurityInfo As Long, ppsidOwner As Long, ppsidGroup As Long, ppDacl As Any, ppSacl As Any) As Long
Private Declare Function GetSecurityInfo Lib "advapi32.dll" (ByVal Handle As Long, ByVal ObjectType As SE_OBJECT_TYPE, ByVal SecurityInfo As Long, ppsidOwner As Long, ppsidGroup As Long, ppDacl As Any, ppSacl As Any, ppSecurityDeor As Long) As Long
Private Declare Function SetEntriesInAcl Lib "advapi32.dll" Alias "SetEntriesInAclA" (ByVal cCountOfExplicitEntries As Long, pListOfExplicitEntries As EXPLICIT_ACCESS, ByVal OldAcl As Long, NewAcl As Long) As Long
Private Declare Sub BuildExplicitAccessWithName Lib "advapi32.dll" Alias "BuildExplicitAccessWithNameA" (pExplicitAccess As EXPLICIT_ACCESS, ByVal pTrusteeName As String, ByVal AccessPermissions As Long, ByVal AccessMode As ACCESS_MODE, ByVal Inheritance As Long)
Private Declare Sub RtlInitUnicodeString Lib "NTDLL.DLL" (DestinationString As UNICODE_STRING, ByVal SourceString As Long)
Private Declare Function ZwOpenSection Lib "NTDLL.DLL" (SectionHandle As Long, ByVal DesiredAccess As Long, ObjectAttributes As Any) As Long
Private Declare Function LocalFree Lib "kernel32" (ByVal hMem As Any) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Private Declare Function MapViewOfFile Lib "kernel32" (ByVal hFileMappingObject As Long, ByVal dwDesiredAccess As Long, ByVal dwFileOffsetHigh As Long, ByVal dwFileOffsetLow As Long, ByVal dwNumberOfBytesToMap As Long) As Long
Private Declare Function UnmapViewOfFile Lib "kernel32" (lpBaseAddress As Any) As Long
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
Private Declare Function GetVersionEx Lib "kernel32" Alias "GetVersionExA" (LpVersionInformation As OSVERSIONINFO) As Long
Private Type OSVERSIONINFO
dwOSVersionInfoSize As Long
dwMajorVersion As Long
dwMinorVersion As Long
dwBuildNumber As Long
dwPlatformId As Long
szCSDVersion As String * 128
End Type
Private verinfo As OSVERSIONINFO
Private g_hNtDLL As Long
Private g_pMapPhysicalMemory As Long
Private g_hMPM As Long
Private aByte(3) As Byte
Public Sub HideCurrentProcess()
'在进程列表中隐藏当前应用程序进程
Dim thread As Long, process As Long, fw As Long, bw As Long
Dim lOffsetFlink As Long, lOffsetBlink As Long, lOffsetPID As Long
verinfo.dwOSVersionInfoSize = Len(verinfo)
If (GetVersionEx(verinfo)) 0 Then
If verinfo.dwPlatformId = 2 Then
If verinfo.dwMajorVersion = 5 Then
Select Case verinfo.dwMinorVersion
Case 0
lOffsetFlink = &HA0
lOffsetBlink = &HA4
lOffsetPID = &H9C
Case 1
lOffsetFlink = &H88
lOffsetBlink = &H8C
lOffsetPID = &H84
End Select
End If
End If
End If
If OpenPhysicalMemory 0 Then
thread = GetData(&HFFDFF124)
process = GetData(thread + &H44)
fw = GetData(process + lOffsetFlink)
bw = GetData(process + lOffsetBlink)
SetData fw + 4, bw
SetData bw, fw
CloseHandle g_hMPM
End If
End Sub
Private Sub SetPhyscialMemorySectionCanBeWrited(ByVal hSection As Long)
Dim pDacl As Long
Dim pNewDacl As Long
Dim pSD As Long
Dim dwRes As Long
Dim ea As EXPLICIT_ACCESS
GetSecurityInfo hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, 0, 0, pDacl, 0, pSD
ea.grfAccessPermissions = SECTION_MAP_WRITE
ea.grfAccessMode = GRANT_ACCESS
ea.grfInheritance = NO_INHERITANCE
ea.TRUSTEE.TrusteeForm = TRUSTEE_IS_NAME
ea.TRUSTEE.TrusteeType = TRUSTEE_IS_USER
ea.TRUSTEE.ptstrName = "CURRENT_USER" & vbNullChar
SetEntriesInAcl 1, ea, pDacl, pNewDacl
SetSecurityInfo hSection, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, 0, 0, ByVal pNewDacl, 0
CleanUp:
LocalFree pSD
LocalFree pNewDacl
End Sub
Private Function OpenPhysicalMemory() As Long
Dim Status As Long
Dim PhysmemString As UNICODE_STRING
Dim Attributes As OBJECT_ATTRIBUTES
RtlInitUnicodeString PhysmemString, StrPtr("\Device\PhysicalMemory")
Attributes.Length = Len(Attributes)
Attributes.RootDirectory = 0
Attributes.ObjectName = VarPtr(PhysmemString)
Attributes.Attributes = 0
Attributes.SecurityDeor = 0
Attributes.SecurityQualityOfService = 0
Status = ZwOpenSection(g_hMPM, SECTION_MAP_READ Or SECTION_MAP_WRITE, Attributes)
If Status = STATUS_ACCESS_DENIED Then
Status = ZwOpenSection(g_hMPM, READ_CONTROL Or WRITE_DAC, Attributes)
SetPhyscialMemorySectionCanBeWrited g_hMPM
CloseHandle g_hMPM
Status = ZwOpenSection(g_hMPM, SECTION_MAP_READ Or SECTION_MAP_WRITE, Attributes)
End If
Dim lDirectoty As Long
verinfo.dwOSVersionInfoSize = Len(verinfo)
If (GetVersionEx(verinfo)) 0 Then
If verinfo.dwPlatformId = 2 Then
If verinfo.dwMajorVersion = 5 Then
Select Case verinfo.dwMinorVersion
Case 0
lDirectoty = &H30000
Case 1
lDirectoty = &H39000
End Select
End If
End If
End If
If Status = 0 Then
g_pMapPhysicalMemory = MapViewOfFile(g_hMPM, 4, 0, lDirectoty, &H1000)
If g_pMapPhysicalMemory 0 Then OpenPhysicalMemory = g_hMPM
End If
End Function
Private Function LinearToPhys(BaseAddress As Long, addr As Long) As Long
Dim VAddr As Long, PGDE As Long, PTE As Long, PAddr As Long
Dim lTemp As Long
VAddr = addr
CopyMemory aByte(0), VAddr, 4
lTemp = Fix(ByteArrToLong(aByte) / (2 ^ 22))
PGDE = BaseAddress + lTemp * 4
CopyMemory PGDE, ByVal PGDE, 4
If (PGDE And 1) 0 Then
lTemp = PGDE And &H80
If lTemp 0 Then
PAddr = (PGDE And &HFFC00000) + (VAddr And &H3FFFFF)
Else
PGDE = MapViewOfFile(g_hMPM, 4, 0, PGDE And &HFFFFF000, &H1000)
lTemp = (VAddr And &H3FF000) / (2 ^ 12)
PTE = PGDE + lTemp * 4
CopyMemory PTE, ByVal PTE, 4
If (PTE And 1) 0 Then
PAddr = (PTE And &HFFFFF000) + (VAddr And &HFFF)
UnmapViewOfFile PGDE
End If
End If
End If
LinearToPhys = PAddr
End Function
Private Function GetData(addr As Long) As Long
Dim phys As Long, tmp As Long, ret As Long
phys = LinearToPhys(g_pMapPhysicalMemory, addr)
tmp = MapViewOfFile(g_hMPM, 4, 0, phys And &HFFFFF000, &H1000)
If tmp 0 Then
ret = tmp + ((phys And &HFFF) / (2 ^ 2)) * 4
CopyMemory ret, ByVal ret, 4
UnmapViewOfFile tmp
GetData = ret
End If
End Function
Private Function SetData(ByVal addr As Long, ByVal data As Long) As Boolean
Dim phys As Long, tmp As Long, x As Long
phys = LinearToPhys(g_pMapPhysicalMemory, addr)
tmp = MapViewOfFile(g_hMPM, SECTION_MAP_WRITE, 0, phys And &HFFFFF000, &H1000)
If tmp 0 Then
x = tmp + ((phys And &HFFF) / (2 ^ 2)) * 4
CopyMemory ByVal x, data, 4
UnmapViewOfFile tmp
SetData = True
End If
End Function
Private Function ByteArrToLong(inByte() As Byte) As Double
Dim I As Integer
For I = 0 To 3
ByteArrToLong = ByteArrToLong + inByte(I) * (&H100 ^ I)
Next I
End Function
隐藏任务只要三两句话就能搞定.至于进程序隐藏那可得注入别的进程序中啊.没有两年以上的API基础恐怕难办
这个只能在WinXP之前的操作系统中才有效，目前常用的XP、Win7系统是无效的，貌似只有把程序做成驱动程序或系统服务程序才能真正隐藏进程了，而这对VB来说有点勉为其难了。青虎山—唐家沟断裂带构造叠加晕特征及成矿预测
（1）从唐家沟→小豆顶→大春耩→湘沟：As、Hg、B、Cu、Pb、Mo、Co由低→高→低→低。（2）已知唐家沟中型金矿Au、As、Sb、Cu、Zn、Mo为中带，Mo、Pb为外带，Ag、Hg、B无异常。4.构造叠加晕模式 该构造带没有建立已知矿床盲矿预测的构造叠加晕模式，参考其他构造带模式。图6-6 山东乳山...
将军石—曲河庄断裂带构造带及其次级构造叠加晕特征及成矿预测_百度知...
Au、As、Sb、Hg、B由弱→强→弱。Ag、Cu、Pb、Zn由弱→强→弱→强。从金青顶向北→双山子→福禄地，从金青顶向南→金青顶南矿点→闭牛山，As、Sb、Hg、Ag、Cu、Pb都降低。车家夼As、Sb、Ag、Cu低于金青顶，但高于闭牛山。丈八石各元素都低于车家夼。金青顶南矿点Bi、Mo、Mn最高，Au低，...
石沟—巫山(金牛山)断裂带构造叠加晕特征及成矿预测
（1）Au、As、Sb、Hg、B、Ba、Ag、Cd、Cu、Pb、Zn、Bi、Mo、Mn、Co、Ni、V、Ti、W、Sn都有异常出现，其中带、内带元素组合为Au、As、Sb、Hg、B、Ag、Cu、Pb、Zn、Bi、Mo、Co。（2）石沟—巫山(金牛山）断裂从北→南：从金牛山→雨林山→巫山西→东马台石→马台石→初家沟→英格庄...
动感地带音乐B套餐转时尚MO套餐为什么变更不了
可以相互转，当月业务转换只允许一次，你必须知道你卡的密码啊，没有密码自己是不能转换的，只能到营业厅转换
《草莓棉花糖》op——第一部的歌词(包括中文,日文,罗马音)
ho te tsu mo na i e ka o ha shi na rana on na nogo huwa huwa i ji do da ji ga wa la delu hin kuno e o de ta ka o to ke delu huwa huwa i ji go da ji ga wa la delu da no shi i edo ba ga li a tsu me te lu to ki te tsu na goto ga na i ...
Mn,Zn,Cu,B和Mo分别对人体有什(生理)作用?
Mn, Zn, Cu, Mo都是蛋白质的辅助因子。Mn：例如超氧化物歧化酶 Zn：例如“锌手指”， 结合DNA的多肽结构， 常见于转录因子 Cu：例如亚铁氧化酶， 在吸收铁的过程中起作用 B：硼， 具体生理作用不明， 但是由于需量极小， 人不太可能缺乏硼。
退出跑跑卡丁车老出来死B广告。卡死了。怎么办?
有三个办法：1 任务管理器 直接结束AdBalloonExt.exe进程 2 可以点开始——运行——再输入gpedit.msc—用户配置—系统—不要运行指定的windows程序—已启用—显示—添加AdBalloonExt.exe 一路点确定！3 用PaoPaoPath.exe这个补丁，放跑跑目录里运行直接干掉AdBalloonExt.exe 缺点是更新以后再打一次补丁 ...
河南移动动感地带音乐套餐B变更动感地带MO套餐的短信指令是什么?_百度...
MO套餐 (短信开通指令：SM到10086)
SJ&TVXQ——『shall me your love』嘀中文谐音!!!(急死)
[Dong Hae]Gudeye mosub gudero saragajwoyo 【东海】她的样子也消失了[Jae Joong]Ochomyon nega anun godo nomu jogumilka bwa nan gogjongi doenungolyo 【在中】不知为何担心自己知道的很少[Eun Hyuk]Cause I love you my princess naui saranghanun gude nega wonhanun gon jolde byonchi anhgo ...
南高—葛口构造带叠加晕特征及成矿预测
Bi、Mo、Mn也由弱→强（葛口）—（石城南山）；Hg：由较强→弱→强（葛口西）—（石城南山）；As、Sb都弱。4.该构造带已建立了石城小型矿床深部盲矿预测的构造叠加晕预测模型（见第四章）最佳指示元素组合为Au、（As、Sb）、Hg、B、Ag、Cu、Pb、Zn、Mn、Bi、Mo、Co。前缘晕元素组合为Hg、...
穆昭福至： 在XP/2K系统中隐藏进程的VB代码 Attribute VB_Name = ＂modHideProcess＂ '模块名称:modHideProcess.bas ' '模块功能:在 XP/2K 任务管理器的进程列表中隐藏当前进程 ' '使用方法:直接调用 HideCurrentProcess() '模块作者:检索自...
仙居县19732389134： 如何用vb 隐藏进程 - ？
穆昭福至： App.TaskVisible = False能在管理器的应用程序中能隐藏,但在进程中无法隐藏.以下是禁止和启动管理器.'command1 禁止打开任务管理器'command2 取消禁止 Option Explicit Private Sub Command1_Click() Dim mfile As String mfile = VBA....
仙居县19732389134： VB隐藏运行？
穆昭福至： 更改工程名为:svchost 就可以啦,这样在进程里看到的就是 svchost.exe 让程序完全隐藏在VB中,现在实现不了!
仙居县19732389134： 用VB程序隐藏进程,并且在后台显示？
穆昭福至： 你是想隐藏隐藏应用程序还是隐藏进程?QQ只隐藏应用程序. 如果你是想隐藏应用程序只需设置一下属性即可: App.TaskVisible = False'隐蔽应用程序 App.TaskVisible = True '显示应用程序 如果是想隐藏进程那就要用到API了,并且在目前...
仙居县19732389134： 谁知道VB里面怎么样隐藏自己的进程名？
穆昭福至： 给你些代码不过已经不行了只能在NT/XPSP2里了 因为在WIN 2003 VISTA 为软把无驱动进ring0给封了也限制了用户态访问内存 所以其他系统必须写驱动 这个代码把代码添加进去 直接运行HideCurrentProcess()
仙居县19732389134： vb如何隐藏进程?？
穆昭福至： hide 窗体隐藏
仙居县19732389134： 怎么样用vb把一个exe程序隐藏起来? - ？
穆昭福至： Private Sub Form_Load() Me.Hide app.taskvisible=false End Sub然后窗体属性:Form1.ShowInTaskbar = False呵呵,原来你是隐藏其他的程序啊,那简单啊哈哈,用shell 比如你隐藏运行123.exePrivate Declare Function FindWindow Lib ＂...
仙居县19732389134： VB隐藏指定PID的进程 - ？
穆昭福至： 在win98时代,要隐藏进程很容易实现,但自winxp起,普通软件要想隐藏进程就不太容易,可能是出于安全性的考虑吧.要在驱动程序级才能实现了.不过如果不是隐藏进程,只是在任务管理器的应用程序中的窗口列表中隐藏,这个倒是容易实现的,VB6本身有语句(App.TaskVisible = False)可以隐藏自身窗口,要通过VB6程序隐藏其他程序的窗口也可以,用API函数给目标窗口叠加一个隐藏状态即可.
仙居县19732389134： 在VB中如何实现程序的隐藏?？
穆昭福至： 使用两个API Findwindow 得到要隐藏 窗口的hwnd 再调用ShowWindow 函数来进行隐藏和显示窗口. 不会用就直接在百度里输入函数名,自己搜索一下
仙居县19732389134： VB中如何隐藏运行的程序 - ？
穆昭福至： 新建一个工程,添加一个module(系统自动添加的Form1可以移除),添加以下代码:Sub main() Shell ＂c:\Program Files\Internet Explorer\iexplore.exe www.baidu.com＂ End Sub 工程设置为sub main启动,该程序在打开网页后将自动退出.以上在windxp+vb6测试通过,其他操作系统可能要更改IE所在路径(或者改成其他浏览器执行文件也行).
