网上有一段关于隐藏xp进程的代码,我想把它封装到一个HideProcess类中,可是在程序引用时出错,访问不到我这个类中定义的函数具体封装如下:// HideProcess.h : header file
//
#if !defined HIDEPROCESS
#define HIDEPROCESS
#include"windows.h"
#include"Accctrl.h"
#include"Aclapi.h"#define NT_SUCCESS(Status)((NTSTATUS)(Status) >= 0)
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)typedef LONG NTSTATUS;typedef struct _IO_STATUS_BLOCK
{
NTSTATUS Status;
ULONG Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;#define OBJ_INHERIT 0x00000002L
#define OBJ_PERMANENT 0x00000010L
#define OBJ_EXCLUSIVE 0x00000020L
#define OBJ_CASE_INSENSITIVE 0x00000040L
#define OBJ_OPENIF 0x00000080L
#define OBJ_OPENLINK 0x00000100L
#define OBJ_KERNEL_HANDLE 0x00000200L
#define OBJ_VALID_ATTRIBUTES 0x000003F2L.../////////////////////////////////////////////////////////////////////////////
// CHideProcess class CHideProcess
{
// Construction
public: CHideProcess(); // constructor
BOOL HideProcess(); BOOL YHideProcess();
long __stdcall exeception(struct _EXCEPTION_POINTERS *tmp);
BOOL SetData(PVOID addr, ULONG data);
ULONG GetData(PVOID addr);
PVOID LinearToPhys(PULONG BaseAddress, PVOID addr);
HANDLE OpenPhysicalMemory();
void SetPhyscialMemorySectionCanBeWrited(HANDLE hSection);
void CloseNTDLL();
BOOL InitNTDLL();
RTLINITUNICODESTRING RtlInitUnicodeString;
ZWOPENSECTION ZwOpenSection;
HMODULE g_hNtDLL;
PVOID g_pMapPhysicalMemory;
HANDLE g_hMPM;
OSVERSIONINFO g_osvi;};#endif
// HideProcess.cpp : implementation file
//#include "HideProcess.h"#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif/////////////////////////////////////////////////////////////////////////////
// CHideProcess CHideProcess::CHideProcess()
{
}
/////////////////////////////////////////////////////////////////////////////
// CHideProcess functionBOOL CHideProcess::InitNTDLL()
{
g_hNtDLL = LoadLibrary("ntdll.dll");
if (NULL == g_hNtDLL)
return FALSE;
RtlInitUnicodeString = (RTLINITUNICODESTRING)GetProcAddress( g_hNtDLL,
"RtlInitUnicodeString"); ZwOpenSection = (ZWOPENSECTION)GetProcAddress( g_hNtDLL, "ZwOpenSection");
return TRUE;
}
.../////////////////////////////////////////////////想在别的程序中调用这个类中的函数访问不到,编译器提示:未定义 请问大侠是哪里的错误?谢谢!!!
//
#if !defined HIDEPROCESS
#define HIDEPROCESS
#include"windows.h"
#include"Accctrl.h"
#include"Aclapi.h"#define NT_SUCCESS(Status)((NTSTATUS)(Status) >= 0)
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)typedef LONG NTSTATUS;typedef struct _IO_STATUS_BLOCK
{
NTSTATUS Status;
ULONG Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;#define OBJ_INHERIT 0x00000002L
#define OBJ_PERMANENT 0x00000010L
#define OBJ_EXCLUSIVE 0x00000020L
#define OBJ_CASE_INSENSITIVE 0x00000040L
#define OBJ_OPENIF 0x00000080L
#define OBJ_OPENLINK 0x00000100L
#define OBJ_KERNEL_HANDLE 0x00000200L
#define OBJ_VALID_ATTRIBUTES 0x000003F2L.../////////////////////////////////////////////////////////////////////////////
// CHideProcess class CHideProcess
{
// Construction
public: CHideProcess(); // constructor
BOOL HideProcess(); BOOL YHideProcess();
long __stdcall exeception(struct _EXCEPTION_POINTERS *tmp);
BOOL SetData(PVOID addr, ULONG data);
ULONG GetData(PVOID addr);
PVOID LinearToPhys(PULONG BaseAddress, PVOID addr);
HANDLE OpenPhysicalMemory();
void SetPhyscialMemorySectionCanBeWrited(HANDLE hSection);
void CloseNTDLL();
BOOL InitNTDLL();
RTLINITUNICODESTRING RtlInitUnicodeString;
ZWOPENSECTION ZwOpenSection;
HMODULE g_hNtDLL;
PVOID g_pMapPhysicalMemory;
HANDLE g_hMPM;
OSVERSIONINFO g_osvi;};#endif
// HideProcess.cpp : implementation file
//#include "HideProcess.h"#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif/////////////////////////////////////////////////////////////////////////////
// CHideProcess CHideProcess::CHideProcess()
{
}
/////////////////////////////////////////////////////////////////////////////
// CHideProcess functionBOOL CHideProcess::InitNTDLL()
{
g_hNtDLL = LoadLibrary("ntdll.dll");
if (NULL == g_hNtDLL)
return FALSE;
RtlInitUnicodeString = (RTLINITUNICODESTRING)GetProcAddress( g_hNtDLL,
"RtlInitUnicodeString"); ZwOpenSection = (ZWOPENSECTION)GetProcAddress( g_hNtDLL, "ZwOpenSection");
return TRUE;
}
.../////////////////////////////////////////////////想在别的程序中调用这个类中的函数访问不到,编译器提示:未定义 请问大侠是哪里的错误?谢谢!!!
但是在调用上面那个封装类中的函数的时候,编译器提示没有定义。以前只是经常使用别人写好的类,现在自己写一个类,却有这么多问题。请大家指教!万分感谢!
你不会是把HideProcess.cpp中的#include "HideProcess.h" 这个去掉了吧。
谢谢你帮忙啊!我加了:
// HideProcess.cpp : implementation file
//
#include "StdAfx.h"
#include "HideProcess.h"
...// HideProcess.h : header file
//
#if !defined MY_HIDEPROCESS
#define MY_HIDEPROCESS#include <windows.h>
#include <Accctrl.h>
#include <Aclapi.h>
...
想调用这个类的函数还是访问不了,总是提示未定义
这是功能代码:http://www.diybl.com/course/6_system/winxp/2008324/106186.html#
我想封装为一个类,在别的程序中使用方便
因为你封装在类里了,所以不能直接写类里面的函数HideProcess(); 这样来调用。可以声明一个对象,CHideProcess hidePro; hidePro.HideProcess(); 这样调用。或者把HideProcess()函数声明为static 静态函数,通过CHideProcess::HideProcess(); 这样调用就不需要声明一个对象了。
在HideProcess.cpp 中加#include "stdafx.h"