易语言枚举隐藏进程源码

易语言枚举隐藏进程源码系统结构:枚举进程,提升进程权限,提升进程权限,隐藏进程,取进程EProcess,十六文本至长整数,读物理内存,写物理内存,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,OpenProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValue,AdjustTokenPrivileges,GetProcessMemoryInfo,api_LookupPrivilegeValue,api_AdjustTokenPrivileges,api_GetCurrentProcess,api_OpenProcessToken,GetModuleBaseNameA,GetCurrentProcessId,ZwQuerySystemInformation,取指针_字节集,RtlMoveMemory2,RtlMoveMemory3,StrToInt64ExA,NtSystemDebugControl, ======窗口程序集1 || ||------__启动窗口_创建完毕 || ||------_时钟1_周期事件 || ||------_按钮1_被单击 || || ======程序集1 || ||------枚举进程 || ||------提升进程权限 || || ======程序集2 || ||------提升进程权限 || ||------隐藏进程 || ||------取进程EProcess || ||------十六文本至长整数 || ||------读物理内存 || ||------写物理内存 || || ======调用的Dll || ||---[dll]------CreateToolhelp32Snapshot || ||---[dll]------Process32First || ||---[dll]------Process32Next || ||---[dll]------CloseHandle || ||---[dll]------OpenProcess || ||---[dll]------GetCurrentProcess || ||---[dll]------OpenProcessToken || ||---[dll]------LookupPrivilegeValue || ||---[dll]------AdjustTokenPrivileges || ||---[dll]------GetProcessMemoryInfo || ||---[dll]------api_LookupPrivilegeValue || ||---[dll]------api_AdjustTokenPrivileges || ||---[dll]------api_GetCurrentProcess || ||---[dll]------api_OpenProcessToken || ||---[dll]------GetModuleBaseNameA || ||---[dll]------GetCurrentProcessId || ||---[dll]------ZwQuerySystemInformation || ||---[dll]------取指针_字节集 || ||---[dll]------RtlMoveMemory2 || ||---[dll]------RtlMoveMemory3 || ||---[dll]------StrToInt64ExA || ||---[dll]------NtSystemDebugControl 调用的DLL命令: .DLL命令CreateToolhelp32Snapshot,整数型,"kernel32.dll","CreateToolhelp32Snapshot" .参数lFlags,整数型 .参数lProcessID,整数型 .DLL命令Process32First,整数型,"kernel32.dll","Process32First",,取进程快照第一个进程信息返回内存指针 .参数快照句柄,整数型 .参数进程信息,进程信息32 .DLL命令Process32Next,整数型,"kernel32.dll","Process32Next" .参数快照句柄,整数型 .参数进程信息,进程信息32 .DLL命令CloseHandle,整数型,"kernel32.dll","CloseHandle" .参数对象句柄,整数型 .DLL命令OpenProcess,整数型,"kernel32.dll","OpenProcess" .参数访问级别,整数型,,2035711完全访问 .参数子进程继承,整数型,,0为子进程继承 .参数进程ID,整数型,,要打开的进程标识 .DLL命令GetCurrentProcess,整数型,"kernel32.dll","GetCurrentProcess" .DLL命令OpenProcessToken,整数型,"advapi32.dll","OpenProcessToken" .参数ProcessHandle,整数型 .参数DesiredAccess,整数型 .参数TokenHandle,整数型,传址 .DLL命令LookupPrivilegeValue,逻辑型,"advapi32.dll","LookupPrivilegeValueA" .参数lpSystemName,文本型 .参数lpName,文本型 .参数lpLuid,LuID,传址 .DLL命令AdjustTokenPrivileges,逻辑型,"advapi32.dll","AdjustTokenPrivileges" .参数TokenHandle,整数型 .参数DisableAllPrivileges,整数型 .参数NewState,TOKEN_PRIVILEGES,传址 .参数BufferLength,整数型 .参数PreviousState,TOKEN_PRIVILEGES,传址 .参数ReturnLength,整数型,传址 .DLL命令GetProcessMemoryInfo,整数型,"Psapi.dll","GetProcessMemoryInfo" .参数Process,整数型 .参数ppsmemCounters,PROCESS_MEMORY_COUNTERS,传址 .参数cb,整数型 .DLL命令api_LookupPrivilegeValue,逻辑型,"advapi32.dll","LookupPrivilegeValueA" .参数lpSystemName,文本型 .参数lpName,文本型 .参数lpLuid,LuID,传址 .DLL命令api_AdjustTokenPrivileges,逻辑型,"advapi32.dll","AdjustTokenPrivileges" .参数TokenHandle,整数型 .参数DisableAllPrivileges,整数型 .参数NewState,TOKEN_PRIVILEGES,传址 .参数BufferLength,整数型 .参数PreviousState,TOKEN_PRIVILEGES,传址 .参数ReturnLength,整数型,传址 .DLL命令api_GetCurrentProcess,整数型,"kernel32.dll","GetCurrentProcess" .DLL命令api_OpenProcessToken,整数型,"advapi32.dll","OpenProcessToken" .参数ProcessHandle,整数型 .参数DesiredAccess,整数型 .参数TokenHandle,整数型,传址 .DLL命令GetModuleBaseNameA,整数型,"Psapi.dll","GetModuleBaseNameA" .参数hProcess,整数型 .参数hMod,整数型 .参数szProcessName,文本型,传址 .参数nSize,整数型 .DLL命令GetCurrentProcessId,整数型,"kernel32.dll","GetCurrentProcessId" .DLL命令ZwQuerySystemInformation,整数型,"ntdll.dll","ZwQuerySystemInformation" .参数SystemInformationClass,整数型,,未知类型：SYSTEM_INFORMATION_CLASS。 .参数SystemInformation,字节集,,any .参数SystemInformationLength,整数型 .参数ReturnLength,整数型,传址 .DLL命令取指针_字节集,整数型,,"lstrcpyn" .参数欲取其指针,字节集,传址 .参数欲取其指针,字节集,传址 .参数保留,整数型,,0 .DLL命令RtlMoveMemory2,整数型,,"RtlMoveMemory" .参数dest,SYSTEM_HANDLE_INFORMATION .参数Source,整数型 .参数len,,,284 .DLL命令RtlMoveMemory3,整数型,,"RtlMoveMemory" .参数dest,整数型,传址 .参数Source,整数型 .参数len,,,4 .DLL命令StrToInt64ExA,整数型,"shlwapi.dll","StrToInt64ExA",,64-bitinteger .参数pszString,文本型 .参数dwFlags,整数型,,1为16进制，0为10进制 .参数piRet,长整数型,传址 .DLL命令NtSystemDebugControl,整数型,"ntdll.dll","NtSystemDebugControl" .参数Command,整数型,,8 .参数InputBuffer,字节集 .参数InputBufferLength,整数型 .参数OutputBuffer,整数型 .参数OutputBufferLength,整数型 .参数ReturnLength,整数型,传址