进程相关函数HOOK代码VOID DisplayProcess() 列举进程

VOID DisplayThread() 列举线程

ULONG GetCidAddr() 列举进程所需要的Cid表

DWORD GetDllFunctionAddress() 主动防御中通过句柄得到路径

PVOID GetDriverBaseAdress() 获取指定驱动基址

DWORD GetPlantformDependentInfo () 获取平台信息

BOOL GetProcessName() 主防中通过句柄得到进程名

ULONG GetProcessType() 通过句柄得到进程类型

int GetProNum() 获取当前进程数量

PTHREAD_INFO GetThread() 获取线程信息

BOOL GoOrNot() 主防中让用户判断是否放行

VOID IsValidProcess() 记录进程信息

-Correlation function of the process HOOK code VOID DisplayProcess () listing process VOID DisplayThread () listing thread ULONG GetCidAddr () listing process needs Cid Table DWORD GetDllFunctionAddress () active defense be the path through the handle PVOID GetDriverBaseAdress () DWORD base address for the specified drive GetPlantformDependentInfo () to obtain platform information BOOL GetProcessName () handle to get through the main anti-process name ULONG GetProcessType () handle to get through the process of type int GetProNum () Get the current number of processes PTHREAD_INFO GetThread () Get thread information BOOL GoOrNot () primary prevention allows users to determine whether the release VOID IsValidProcess () record process information