轻松找出隐藏在系统中的进程

最新推荐文章于 2026-06-06 18:55:36 发布

原创最新推荐文章于 2026-06-06 18:55:36 发布 · 2.4k 阅读

1 ·

本内容遵循CC 4.0 BY-SA版权协议

标签

#query #path #c

ASM/WTL/MFC/QT 专栏收录该内容

285 篇文章

订阅专栏

本文提供了一个无需驱动支持的C++程序示例，用于查找Windows系统中可能被隐藏的进程PID。该程序通过枚举所有进程并尝试获取其详细信息来发现未在任务管理器中显示的进程。

好久没写代码了，无意间看到的，先收藏起来~~~

// Easy to Find Hided PID Code // Author: Finback Jun.6,2006 <Finbackcpp@hotmail.com> // NOTE: Tthis code needn't any driver supported #include <windows.h> #include <stdio.h> #include "psapi.h" #pragma comment(lib,"psapi.lib") int main(int argc, char* argv[]) { printf("/nEasy to Find Hided PID Code /n"); printf("Author: Finback Jun.6,2006 <Finbackcpp@hotmail.com> /n"); printf("NOTE this code needn't any driver supported /n"); printf(" /n"); DWORD aProcesses[1024], cbNeeded; if ( !EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) ) return 0; DWORD cProcesses = cbNeeded / sizeof(DWORD); DWORD PidFor; for ( PidFor = 0x0c; PidFor < 0xFFFF; PidFor +=1 ) { HANDLE hProcess = OpenProcess( PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, PidFor ); if (hProcess) { BOOL sHide = false; unsigned int i; char szName[MAX_PATH]="<Unknown>"; HMODULE hModule; for ( i = 1; i <= cProcesses; i++ ) { if (PidFor == aProcesses[i]) { sHide = true; break; } } if(EnumProcessModules(hProcess,&hModule,sizeof(hModule),&cbNeeded)) { GetModuleFileNameEx(hProcess,hModule,szName,sizeof(szName)); printf("%-5d - %16s %s/n", PidFor, szName, (sHide) ? "" : "--[Hidden]--"); } else { GetProcessImageFileName(hProcess,szName,sizeof(szName)); printf("%-5d - %16s %s/n", PidFor, szName, "--[Zombie]--"); } } CloseHandle( hProcess ); } return 0; }

cl /O2 EasyToFind.cpp BufferOverFlowU.lib

link EasyToFind.obj /subsystem:console

运行效果:

运行效果