dpctest.cpp

来自「实现了隐藏进程,使进程对任务管理器和进程查看器均不可见,使文件对资源管理器不可见」· C++ 代码 · 共 49 行

#include "DPCTest.h"
#include "..\HideDriver\HookInstall.h"

const int ThreadCount=1;
void DPCTest::Run()
{ 
	mHub = 1;
	
	//for(int i=0;i<ThreadCount;++i)
		PsCreateSystemThread(&hThread,THREAD_ALL_ACCESS,NULL,NULL,NULL,&ThreadFunc,this);

	DbgPrint("DPCTest running\n");
}
void DPCTest::Stop()
{
	//InterlockedDecrement((PLONG)&mHub);
	PKTHREAD myThread;
	NTSTATUS ret_status= NULL;
	ret_status = ObReferenceObjectByHandle(&hThread,THREAD_ALL_ACCESS,NULL,
		KernelMode,(PVOID*)(&myThread),NULL);
	
	mHub = 0;
	if(ret_status == STATUS_SUCCESS)
	{
		KeWaitForSingleObject(&myThread,Executive ,KernelMode ,FALSE,NULL);

		ObDereferenceObject(myThread);
	}
	else
		DbgPrint("ObReferenceObjectByHandle ERROR\n");

	ZwClose(hThread);
}

void ThreadFunc( void* pArguments )
{
	DbgPrint("Thread started\n");

	DPCTest* pThis = (DPCTest*)pArguments;
	long probe=0;
	do 
	{
//		EnumFilesInDir();
		probe = pThis->mHub;
	} 
	while(probe != 0);

	PsTerminateSystemThread( 0 );
}