commonfunc.cpp

在驱动下实现进程隐藏,在驱动下实现进程隐藏.

#include "stdafx.h"
#include "CommonFunc.h"
bool PackadgeParser(CString&  refBuf,
					CString&  refName,
					CString&  refUser,
					CString&  refProc)
/*++

Routine Description:

Arguments:

Return Value:

--*/
{
	int nFirstEndSymbol = refBuf.Find(L';',0);
	int nSecondEndSymbol = refBuf.Find(L';',nFirstEndSymbol+1);
	int nThirdEndSymbol = refBuf.Find(L';',nSecondEndSymbol+1);

	bool bad_search;
	bad_search =  nFirstEndSymbol == -1;
	bad_search |= nSecondEndSymbol == -1;
	bad_search |= nThirdEndSymbol == -1;
	if(bad_search)
		return false;

	int size = nFirstEndSymbol;
	refName = refBuf.Mid(0,nFirstEndSymbol);
	size = nSecondEndSymbol-nFirstEndSymbol -1;
	refUser = refBuf.Mid(nFirstEndSymbol+1,size);
	size = nThirdEndSymbol-nSecondEndSymbol -1;
	refProc = refBuf.Mid(nSecondEndSymbol+1,size);

	return true;
}