kbhook

不错的后门代码，用了一些驱动技术来隐藏进程，隐藏注册表，希望对大家有所帮助(good backdoor code, used some technology-driven process to conceal, hide the registry, and I hope to help everyone)

这是一个通过注册表列举正在运行进程的源码。通过修改主机名可以列举远程主机进程。(This is a listed by the registry is the process of running FOSS. By modifying the host name could give remote host process.)

Visual C++案例开发集锦第六章\获取网卡地址的程序源码,值得一看！(Visual C++ case development highlights Chapter to obtain the Ethernet address of the program source code, worth a visit!)

启动并控制其它Exe程序CntrlOtherPrcss,很不错的vc源码，希望能对大家有所帮助(Start and control other Exe program CntrlOtherPrcss, very good vc source, I hope you can help)

通过内存映射对象实现程序和进程间的内存共享。(Implement programs and memory sharing between processes through a memory-mapped object.)

SelfDelete(可以删除自身的VC++源码(巳通过了调试)) 为了实现程序自删除功能，我们可以通过多进程的方法解决这个问题。可执行文件在结束返回前，创建一个运行命令窗口的新进程（在Windows98中为Command进程，在Windows2000/XP中为CMD进程），当然该命令窗口以隐藏方式执行，并通过传递参数执行删除功能。为了避免可执行文件的映像还在内存中就执行删除，需要把当前进程设置为实时优先级，而命令窗口进程设置为很低的IDLE优先级，这样首先可执行文件结束返回，再运行命令窗口的删除命令，就实现了该文件自身的删除功能。 (SelfDelete (you can delete its own VC++ source code (had passed debugging)) In order to achieve the program from the delete function, we can multi-process methods to solve this problem. Return before the end of the executable file, run the command window to create a new process (in Windows98 process for the Command, in Windows2000/XP process for CMD), of course, the command window to hide the manner and to perform delete functions by passing a parameter . In order to avoid the executable file image still in memory on the implementation of delete, you need to set the current process for real-time priority, and the command window to set the process priority to low IDLE, so the end of the first return to the executable file, then run the command window delete command, the file itself to achieve the delete function. )

显示当前系统运行的进程，并能够查看进程中所加载的模块(show the system process and modules)

VC++ 禁止运行程序的多个实例，程序根据主窗口类名和主窗口名判断是否已经有实例存在，如果存在就将其激活，并显示出来，如果是最小化的就还原窗口；如果有实例存在，则返回False并退出。 (VC++ prohibits running the program multiple instances of the program under the main window class name and the main window name to determine whether there are examples exist, if it will activate and show, if it is minimized to restore the window if examples exist, Returns False and exit.)

建立带有NT Service程序的模板 (The template for creating the app with NT Service)

VC++获取到Windows开机运行的时间，不是开机时间，而是从开机后到现在的运行时间，也就是一次开机所运行的时间，如果关机了，可能就不准确了。(The VC++ get to the Windows boot running time is not boot time, but from the boot to the running time, which is the time you turn on the running time, shutdown, and may not be accurate.)