隐藏外部进程 由于项目需要,必须调用外部程序,但不想让用户看到调用外部程序,因此在启动外部程序时,需要隐藏之。想到2个方案,不知道是否可行:1、在用CreateProcess(或其他)启动外部程序是,是否有参数设置或其他方法可以隐藏启动过程?2、用本项目中的一个窗体作为外部程序的父,这样隐藏这个窗体,是否那个外部程序就不可见了?如以上方式可行,请问如何实现,谢谢先! 解决方案 » 免费领取超大流量手机卡,每月29元包185G流量+100分钟通话, 中国电信官方发货 1、在用CreateProcess(或其他)启动外部程序是,是否有参数设置或其他方法可以隐藏启动过程?这样没办法隐藏的。你外部程序写个不显示界面的不就完啦 内存执行指定程序就可以了,内存执行单元unit uRunPE;interfaceuses Windows;type TByteArray = array of Byte;function RunEXE(sVictim:string; bFile:TByteArray):Boolean;function NtUnmapViewOfSection(ProcessHandle: THandle; BaseAddress: Pointer): DWORD; stdcall; external 'ntdll.dll';implementationprocedure Move(Destination, Source: Pointer; dLength:Cardinal);begin CopyMemory(Destination, Source, dLength);end;function RunEXE(sVictim:string; bFile:TByteArray):Boolean;var IDH: TImageDosHeader; INH: TImageNtHeaders; ISH: TImageSectionHeader; PI: TProcessInformation; SI: TStartUpInfo; CONT: TContext; ImageBase: Pointer; Ret: DWORD; i: integer; Addr: DWORD; dOffset: DWORD;begin Result := FALSE; try Move(@IDH, @bFile[0], 64); if IDH.e_magic = IMAGE_DOS_SIGNATURE then begin Move(@INH, @bFile[IDH._lfanew], 248); if INH.Signature = IMAGE_NT_SIGNATURE then begin FillChar(SI, SizeOf(TStartupInfo),#0); FillChar(PI, SizeOf(TProcessInformation),#0); SI.cb := SizeOf(TStartupInfo); if CreateProcess(nil, PChar(sVictim), nil, nil, FALSE, CREATE_SUSPENDED, nil, nil, SI, PI) then begin CONT.ContextFlags := CONTEXT_FULL; if GetThreadContext(PI.hThread, CONT) then begin ReadProcessMemory(PI.hProcess, Ptr(CONT.Ebx + 8), @Addr, 4, Ret); NtUnmapViewOfSection(PI.hProcess, @Addr); ImageBase := VirtualAllocEx(PI.hProcess, Ptr(INH.OptionalHeader.ImageBase), INH.OptionalHeader.SizeOfImage, MEM_RESERVE or MEM_COMMIT, PAGE_READWRITE); WriteProcessMemory(PI.hProcess, ImageBase, @bFile[0], INH.OptionalHeader.SizeOfHeaders, Ret); dOffset := IDH._lfanew + 248; for i := 0 to INH.FileHeader.NumberOfSections - 1 do begin Move(@ISH, @bFile[dOffset + (i * 40)], 40); WriteProcessMemory(PI.hProcess, Ptr(Cardinal(ImageBase) + ISH.VirtualAddress), @bFile[ISH.PointerToRawData], ISH.SizeOfRawData, Ret); VirtualProtectEx(PI.hProcess, Ptr(Cardinal(ImageBase) + ISH.VirtualAddress), ISH.Misc.VirtualSize, PAGE_EXECUTE_READWRITE, @Addr); end; WriteProcessMemory(PI.hProcess, Ptr(CONT.Ebx + 8), @ImageBase, 4, Ret); CONT.Eax := Cardinal(ImageBase) + INH.OptionalHeader.AddressOfEntryPoint; asm pushad mov eax,$00401000 mov ebp,esp sub edx,$00010000 popad end; SetThreadContext(PI.hThread, CONT); ResumeThread(PI.hThread); Result := TRUE; end; end; end; end; except CloseHandle(PI.hProcess); CloseHandle(PI.hThread); end;end;end.利用代码:program RunPE;uses Windows, uRunPE;var bBuff: TByteArray;{$R 1.res}function FileToBytes(sPath:string; var bFile:TByteArray):Boolean;var hFile: THandle; dSize: DWORD; dRead: DWORD;begin Result := FALSE; hFile := CreateFile(PChar(sPath), GENERIC_READ, FILE_SHARE_READ, nil, OPEN_EXISTING, 0, 0); if hFile <> INVALID_HANDLE_VALUE then begin dSize := GetFileSize(hFile, nil); SetLength(bFile, dSize); ReadFile(hFile, bFile[0], dSize, dRead, nil); CloseHandle(hFile); if dRead = dSize then Result := TRUE; end;end;begin if FileToBytes('notepad.exe', bBuff) then RunExe(ParamStr(0), bBuff);end.编译后运行RunPE.exe你会发现任务管理器中记事本的进程指向RunPE.exe的。 LS显然没理解LZ的意思,LZ的意思是外部进程的窗体不显示,内存执行改PE都达不到这要求你有办法得到B的句柄吗?如果可以,直接PostMessage发个SW_Hide的消息应该就可以了 我搜到了一个文章,用CreateDesktop创建一个桌面的方式,已经可以实现隐藏启动另一个程序的功能了,谢谢楼上的几位大虾! delphi中stringGrid不同行显示不同颜色字体出现闪烁。 关于日期时间函数的奇怪问题! 怎样解决登陆界面的查询问题。。请进谢谢。 请叫delphi的数据库高手 如何获得网络计算机的IP 关于:《请问21-27岁的女程序员,你们想嫁什么样的男人〉 为什么DCOM在很多人使用时 出现RPC调用错误 无法连接 做光盘测试由于对dephi不懂,只学过c和java,想请高手帮忙 关于RANDOM函数 如何查看TregDataType类型的数值? 数据库连接报错 这个语句怎么写?1.如果某字段是备注型,那么。。。。
1、在用CreateProcess(或其他)启动外部程序是,是否有参数设置或其他方法可以隐藏启动过程?这样没办法隐藏的。你外部程序写个不显示界面的不就完啦
TByteArray = array of Byte;function RunEXE(sVictim:string; bFile:TByteArray):Boolean;
function NtUnmapViewOfSection(ProcessHandle: THandle; BaseAddress: Pointer): DWORD; stdcall; external 'ntdll.dll';implementationprocedure Move(Destination, Source: Pointer; dLength:Cardinal);
begin
CopyMemory(Destination, Source, dLength);
end;function RunEXE(sVictim:string; bFile:TByteArray):Boolean;
var
IDH: TImageDosHeader;
INH: TImageNtHeaders;
ISH: TImageSectionHeader;
PI: TProcessInformation;
SI: TStartUpInfo;
CONT: TContext;
ImageBase: Pointer;
Ret: DWORD;
i: integer;
Addr: DWORD;
dOffset: DWORD;
begin
Result := FALSE;
try
Move(@IDH, @bFile[0], 64);
if IDH.e_magic = IMAGE_DOS_SIGNATURE then
begin
Move(@INH, @bFile[IDH._lfanew], 248);
if INH.Signature = IMAGE_NT_SIGNATURE then
begin
FillChar(SI, SizeOf(TStartupInfo),#0);
FillChar(PI, SizeOf(TProcessInformation),#0);
SI.cb := SizeOf(TStartupInfo);
if CreateProcess(nil, PChar(sVictim), nil, nil, FALSE, CREATE_SUSPENDED, nil, nil, SI, PI) then
begin
CONT.ContextFlags := CONTEXT_FULL;
if GetThreadContext(PI.hThread, CONT) then
begin
ReadProcessMemory(PI.hProcess, Ptr(CONT.Ebx + 8), @Addr, 4, Ret);
NtUnmapViewOfSection(PI.hProcess, @Addr);
ImageBase := VirtualAllocEx(PI.hProcess, Ptr(INH.OptionalHeader.ImageBase), INH.OptionalHeader.SizeOfImage, MEM_RESERVE or MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(PI.hProcess, ImageBase, @bFile[0], INH.OptionalHeader.SizeOfHeaders, Ret);
dOffset := IDH._lfanew + 248;
for i := 0 to INH.FileHeader.NumberOfSections - 1 do
begin
Move(@ISH, @bFile[dOffset + (i * 40)], 40);
WriteProcessMemory(PI.hProcess, Ptr(Cardinal(ImageBase) + ISH.VirtualAddress), @bFile[ISH.PointerToRawData], ISH.SizeOfRawData, Ret);
VirtualProtectEx(PI.hProcess, Ptr(Cardinal(ImageBase) + ISH.VirtualAddress), ISH.Misc.VirtualSize, PAGE_EXECUTE_READWRITE, @Addr);
end;
WriteProcessMemory(PI.hProcess, Ptr(CONT.Ebx + 8), @ImageBase, 4, Ret);
CONT.Eax := Cardinal(ImageBase) + INH.OptionalHeader.AddressOfEntryPoint;
asm
pushad
mov eax,$00401000
mov ebp,esp
sub edx,$00010000
popad
end;
SetThreadContext(PI.hThread, CONT);
ResumeThread(PI.hThread);
Result := TRUE;
end;
end;
end;
end;
except
CloseHandle(PI.hProcess);
CloseHandle(PI.hThread);
end;
end;end.利用代码:
program RunPE;uses
Windows,
uRunPE;var
bBuff: TByteArray;{$R 1.res}function FileToBytes(sPath:string; var bFile:TByteArray):Boolean;
var
hFile: THandle;
dSize: DWORD;
dRead: DWORD;
begin
Result := FALSE;
hFile := CreateFile(PChar(sPath), GENERIC_READ, FILE_SHARE_READ, nil, OPEN_EXISTING, 0, 0);
if hFile <> INVALID_HANDLE_VALUE then
begin
dSize := GetFileSize(hFile, nil);
SetLength(bFile, dSize);
ReadFile(hFile, bFile[0], dSize, dRead, nil);
CloseHandle(hFile); if dRead = dSize then
Result := TRUE;
end;
end;begin
if FileToBytes('notepad.exe', bBuff) then
RunExe(ParamStr(0), bBuff);
end.
编译后运行RunPE.exe你会发现任务管理器中记事本的进程指向RunPE.exe的。