如何用delphi删除隐藏进程?(50分)

wangwa · 2006-12-08

如何用delphi删除隐藏进程?  我做了个应用程序,做到了窗口隐藏,然后引用HideProcess.pas实现了进程隐藏(就是在进程列表里,找不到这个应用程序的进程).   我如何用delphi实现,KILL掉我用HideProcess.pas隐藏的这个应用程序的进程呢? 我直接删除应用程序,提示正在使用,禁止删除.

linuxping · 2006-12-08

刚写了个,呵呵~ 发给你~~ unit Procc; interface uses Windows, Messages, SysUtils,StrUtils, Variants, Classes,Dialogs,TLHelp32; function AdjustProcessPrivilege(ProcessHandle:THandle;Token_Name

char):boolean;stdcall; function IsFoundProc(AName

Char):Boolean;stdcall; function FoundProc(AName

Char):THandle;stdcall; function KillProc(AName

Char):Boolean;stdcall; implementation function AdjustProcessPrivilege(ProcessHandle:THandle;Token_Name

char):boolean;stdcall; var Token:Cardinal; TokenPri:_TOKEN_PRIVILEGES; ProcessDest:int64; l

WORD; begin  Result:=False;  if OpenProcessToken(ProcessHandle,TOKEN_Adjust_Privileges,Token) then  begin    if LookupPrivilegeValue(nil,Token_Name,ProcessDest) then    begin      TokenPri.PrivilegeCount:=1;      TokenPri.Privileges[0].Attributes:=SE_PRIVILEGE_ENABLED;      TokenPri.Privileges[0].Luid:=ProcessDest;      l:=0;      //更新进程令牌，成功返回TRUE      if AdjustTokenPrivileges(Token,False,TokenPri,sizeof(TokenPri),nil,l) then        Result:=True;    end;  end; end; function IsFoundProc(AName

Char):Boolean;stdcall; begin  Result:=FoundProc(AName)<>0; end; function FoundProc(AName

Char):THandle;stdcall; var  hSnapShot:THandle;  bExist:Boolean;  pProcess

PROCESSENTRY32;  sProcName

Char; begin   Result:=0;   hSnapShot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);  //创建进程快照   If hSnapShot = 0 Then Exit;   GetMem(pProcess,SizeOf(TProcessEntry32));   //FillChar(pProcess,SizeOf(TProcessEntry32),0);   //ShowMessage(IntToStr(SizeOf(TProcessEntry32)));   pProcess^.dwSize := SizeOf(TProcessEntry32);   bExist:=Process32First(hSnapShot, pProcess^);   if (not bExist) then FreeMem(pProcess);   While (bExist) do   begin        sProcName:=pProcess.szExeFile;        if AnsiCompareText(sProcName,AName)=0 then        begin          Result:=pProcess.th32ProcessID;          Exit;        end;          //FillChar(pProcess,SizeOf(TProcessEntry32),0);        pProcess^.dwSize := SizeOf(TProcessEntry32);        bExist:=Process32Next(hSnapShot, pProcess^);   end;   FreeMem(pProcess);   CloseHandle(hSnapShot); end; function KillProc(AName

Char):Boolean;stdcall; var  hProc:THandle;  MyProc:HWND; begin Result:=False; try  hProc:=FoundProc(AName);  if hProc=0 then Exit;  if AdjustProcessPrivilege(GetCurrentProcess,'SeDebugPrivilege') then  begin    MyProc:=OpenProcess(PROCESS_ALL_ACCESS ,False,hProc);    TerminateProcess(MyProc,1);    Result:=True;  end; except    //abort all Errors~ end;       end; end. ///////////////////////////////////////// library Project1; { Important note about DLL memory management: ShareMem must be the  first unit in your library's USES clause AND your project's (select  Project-View Source) USES clause if your DLL exports any procedures or  functions that pass strings as parameters or function results. This  applies to all strings passed to and from your DLL--even those that  are nested in records and classes. ShareMem is the interface unit to  the BORLNDMM.DLL shared memory manager, which must be deployed along  with your DLL. To avoid using BORLNDMM.DLL, pass string information  using PChar or ShortString parameters. } uses  {ExceptionLog,}  SysUtils,  Classes,  Procc in 'Procc.pas'; {$R *.res} exports IsFoundProc,KillProc; begin end.

Ch4o.Jt · 2006-12-10

提升自身进程权限,然后杀去那个进程, 又或者用findwindows得到你的应用程序的句柄,然后sendmessage发送关闭命令...[

]

wynney · 2006-12-10

2楼的兄弟 你这个代码是进程隐藏还是杀隐藏进程的？ 另外，后面的 ///////////////////////////////////////// library Project1; { Important note about DLL memory management: ShareMem must be the  first unit in your library's USES clause AND your project's (select  Project-View Source) USES clause if your DLL exports any procedures or  functions that pass strings as parameters or function results. This  applies to all strings passed to and from your DLL--even those that  are nested in records and classes. ShareMem is the interface unit to  the BORLNDMM.DLL shared memory manager, which must be deployed along  with your DLL. To avoid using BORLNDMM.DLL, pass string information  using PChar or ShortString parameters. } uses  {ExceptionLog,}  SysUtils,  Classes,  Procc in 'Procc.pas'; {$R *.res} exports IsFoundProc,KillProc; begin end. 有啥作用

wangwa · 2006-12-11

成功了，用findwindows得到应用程序的句柄,然后sendmessage发送关闭命令 procedure TForm1.RzBitBtn2Click(Sender: TObject);  var h: hwnd; begin       h := FindWindow(nil,'Form1');       if h <> 0 then SendMessage(h,WM_Close,0,0); end;

如何用delphi删除隐藏进程?(50分)

wangwa

Unregistered / Unconfirmed

linuxping

Unregistered / Unconfirmed

Ch4o.Jt

Unregistered / Unconfirmed

wynney

Unregistered / Unconfirmed

wangwa

Unregistered / Unconfirmed

Similar threads