[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 187
  • Last Modified:

remove proc entry from tskmgr tab in NT

Ive read all of of the questions regarding making a process invsible on nt in the taskman but I still do not have a working solution. Are there any surefire ways to do this without madshi's codehook that now forbids hooking of certain system calls?
Can someone give me a working example in delphi?

Thanks,
Alloc
0
alloc
Asked:
alloc
1 Solution
 
calinutzCommented:
listening
0
 
rbohacCommented:
I spent quite a bit of time trying to find a solution to this one myself. I ended up finding this:

http://www.codeproject.com/system/preventclose.asp

the source files contain a folder called "HookNTQuerySystemInformation"

Compile the DLL and call it like so...

(**************************************************************************

        SetProcessHook hooks NTQuerySystemInformation in Windows XP/2000/NT
        and hides the application from the process list
       
***************************************************************************)
procedure SetProcessHook;
var SetHookFn: function(ProcessID:LongInt):Integer; CDecl;
begin
  FDLLHandle := LoadLibrary('HookNTQSI.dll');
  if FDllHandle <> 0 then begin
    @SetHookFn := GetProcAddress(FDLLHandle,'Hook');
    if @SetHookFn <> nil then
      begin
      SetHookFn(GetCurrentProcessId);
      ProcessHookLoaded := True;
      end;
  end;
end;

procedure UnSetProcessHook;
var UnSetHookFn: function:Integer; CDecl;
begin
  if not ProcessHookLoaded then exit;
  if FDllHandle <> 0 then begin
    @UnSetHookFn := GetProcAddress(FDLLHandle,'UnHook');
    if @UnSetHookFn <> nil then
      UnSetHookFn;
  FreeLibrary(FDLLHandle);
  end;
end;
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now