skdrv_regcomm.h

在windows下面通过驱动进行进程的隐藏

//SkDrv_RegComm.h
////////////////////////////////////////////////////////////////////////////////////////////////
// the file contains common declare for SnakeMontor
////////////////////////////////////////////////////////////////////////////////////////////////
// start at 2000/10/14, by snake.
////////////////////////////////////////////////////////////////////////////////////////////////

#ifndef _SK_MONTOR_COMMON_DECLARE_HEADER
#define _SK_MONTOR_COMMON_DECLARE_HEADER

#define MAXPROCNAMELEN 128

typedef struct _REG_LOGUNIT{
  ULONG dwProcessID;
  char processName[MAXPROCNAMELEN+1];
  ULONG dwAction;
  char chEnable;
  ULONG status;
  ULONG uStrInfoSize;
  ULONG uStrKeySize;
  char strOtherInfo[1]; //combound of 2. { [uStrKeySize+1] is keyname }, { [uStrInfoSize+1] is info size.}
}REG_LOGUNIT;

#define REG_ACTION_OPEN                 1
#define REG_ACTION_QUERY                2
#define REG_ACTION_QUERY_VALUE          4
#define REG_ACTION_ENUMERATE_VALUE      8
#define REG_ACTION_SET_VALUE            0x10
#define REG_ACTION_CREATE               0x20
#define REG_ACTION_DELETE_VALUE         0x40
#define REG_ACTION_CLOSE                0x80
#define REG_ACTION_DELETE               0x100
#define REG_ACTION_FLUSH                0x200
#define REG_ACTION_LOAD                 0x400
#define REG_ACTION_UNLOAD               0x800
#define REG_ACTION_ENUMERATE            0x1000
/*
#define REG_ACTION_ENUMERATE            0x2000
#define REG_ACTION_ENUMERATE            0x4000
#define REG_ACTION_ENUMERATE            0x8000
#define REG_ACTION_ENUMERATE            0x10000
#define REG_ACTION_ENUMERATE            0x20000
#define REG_ACTION_ENUMERATE            0x40000
#define REG_ACTION_ENUMERATE            0x80000
#define REG_ACTION_ENUMERATE            0x100000
#define REG_ACTION_ENUMERATE            0x200000
#define REG_ACTION_ENUMERATE            0x400000
#define REG_ACTION_ENUMERATE            0x800000
#define REG_ACTION_ENUMERATE            0x1000000
#define REG_ACTION_ENUMERATE            0x2000000
#define REG_ACTION_ENUMERATE            0x4000000
#define REG_ACTION_ENUMERATE            0x8000000
#define REG_ACTION_ENUMERATE            0x10000000
#define REG_ACTION_ENUMERATE            0x20000000
#define REG_ACTION_ENUMERATE            0x40000000
#define REG_ACTION_ENUMERATE            0x80000000
*/

#endif //_SK_MONTOR_COMMON_DECLARE_HEADER