Click here to Skip to main content
15,889,808 members
Home / Discussions / Managed C++/CLI
   

Managed C++/CLI

 
AnswerRe: help Pin
Christian Graus20-Aug-07 0:53
protectorChristian Graus20-Aug-07 0:53 
GeneralRe: help Pin
Russell'20-Aug-07 2:05
Russell'20-Aug-07 2:05 
GeneralRe: help Pin
Christian Graus20-Aug-07 15:01
protectorChristian Graus20-Aug-07 15:01 
AnswerRe: help Pin
Justin Perez20-Aug-07 11:15
Justin Perez20-Aug-07 11:15 
Questionhow to use several Form and use called her methods ? Pin
aefmaaradji19-Aug-07 10:54
aefmaaradji19-Aug-07 10:54 
AnswerRe: how to use several Form and use called her methods ? Pin
Christian Graus19-Aug-07 11:33
protectorChristian Graus19-Aug-07 11:33 
GeneralRe: how to use several Form and use called her methods ? [modified] Pin
aefmaaradji20-Aug-07 5:42
aefmaaradji20-Aug-07 5:42 
QuestionIdle Process under XP SP2! wrong pid? or a feature? Pin
xball17-Aug-07 13:19
xball17-Aug-07 13:19 
hello and sorry for my bad english!

i have written a windows driver to hide processes per DKOM (direct kernel object manipulation) with the help of the book "rootkits - Subverting the Windows Kernel".

a short description of the concept can be found on
http://www.rohitab.com/discuss/lofiversion/index.php/t23880.html

under xp sp2
------------
in the taskmanager the idle process has the pid 0, but in the kernel object EPROCESS the idle process has the pid 2153092480 and the name "ÿÿÿÿ" which should be a empty string.

output of the driver per DbgPrint
FLINK_OFFSET: 0x88, PID_OFFSET: 0x84, NAME_OFFSET: 0x174
0 - PID: 1832, Name: senddrv.exe
1 - PID: 2153092480, Name: ÿÿÿÿ
2 - PID: 1980, Name: procexp.exe
3 - PID: 984, Name: firefox.exe
4 - PID: 860, Name: regedit.exe
5 - PID: 624, Name: notepad.exe
6 - PID: 1708, Name: cmd.exe
7 - PID: 1496, Name: cmd.exe
8 - PID: 480, Name: notepad++.exe
9 - PID: 1520, Name: notepad++.exe
10 - PID: 1500, Name: taskmgr.exe
in this output many processes are hidden because before i test my driver Smile | :)

under win2000 sp4
-----------------
under win2000 the output is ok!
the idle process has the pid 0 and a empty string! so all ok!
FLINK_OFFSET: 0xA0, PID_OFFSET: 0x9C, NAME_OFFSET: 0x1FC
0 - PID: 1164, Name: senddrv.exe
1 - PID: 0, Name:
2 - PID: 8, Name: System
3 - PID: 180, Name: smss.exe
4 - PID: 208, Name: csrss.exe
5 - PID: 228, Name: winlogon.exe
6 - PID: 256, Name: services.exe
7 - PID: 268, Name: savedump.exe
8 - PID: 276, Name: lsass.exe
9 - PID: 392, Name: ati2evxx.exe
10 - PID: 448, Name: svchost.exe
11 - PID: 488, Name: svchost.exe
12 - PID: 536, Name: SPOOLSV.EXE
13 - PID: 564, Name: acs.exe
14 - PID: 596, Name: btwdins.exe
15 - PID: 620, Name: hidserv.exe
16 - PID: 692, Name: regsvc.exe
17 - PID: 712, Name: mstask.exe
18 - PID: 756, Name: SMAgent.exe
19 - PID: 788, Name: winmgmt.exe
20 - PID: 800, Name: svchost.exe
21 - PID: 980, Name: explorer.exe
22 - PID: 1144, Name: SynTPLpr.exe
23 - PID: 1160, Name: SynTPEnh.exe
24 - PID: 1176, Name: AGRSMMSG.exe
25 - PID: 1180, Name: ACU.exe
26 - PID: 1192, Name: reader_sl.exe
27 - PID: 1200, Name: internat.exe
28 - PID: 1220, Name: RMClock.exe
29 - PID: 1208, Name: BTTray.exe
30 - PID: 1308, Name: BTSTAC~1.EXE
31 - PID: 1236, Name: notepad++.exe
32 - PID: 1300, Name: cmd.exe
33 - PID: 1552, Name: cmd.exe
34 - PID: 628, Name: Dbgview.exe

has anyone experience with this peculiarity?
or is this a security feature from xp sp2?

my programm and driver can be downloaded from
http://lamp2.fh-stpoelten.ac.at/~tm041085/dkom.zip
AnswerRe: Idle Process under XP SP2! wrong pid? or a feature? Pin
George L. Jackson18-Aug-07 7:24
George L. Jackson18-Aug-07 7:24 
QuestionTCL and C++ codings Pin
ucharista17-Aug-07 8:32
ucharista17-Aug-07 8:32 
Questionhow the music files are being handled in a game Pin
saraswathy14316-Aug-07 17:33
saraswathy14316-Aug-07 17:33 
AnswerRe: how the music files are being handled in a game Pin
Mark Salsbery17-Aug-07 5:34
Mark Salsbery17-Aug-07 5:34 
QuestionAssembly probing Pin
KrunalC15-Aug-07 16:47
KrunalC15-Aug-07 16:47 
AnswerRe: Assembly probing Pin
George L. Jackson16-Aug-07 0:14
George L. Jackson16-Aug-07 0:14 
QuestionPrinting with GDI+ Pin
BuckBrown15-Aug-07 11:59
BuckBrown15-Aug-07 11:59 
AnswerRe: Printing with GDI+ Pin
Luc Pattyn15-Aug-07 12:10
sitebuilderLuc Pattyn15-Aug-07 12:10 
GeneralRe: Printing with GDI+ Pin
BuckBrown16-Aug-07 9:35
BuckBrown16-Aug-07 9:35 
GeneralRe: Printing with GDI+ Pin
Luc Pattyn16-Aug-07 10:41
sitebuilderLuc Pattyn16-Aug-07 10:41 
GeneralRe: Printing with GDI+ Pin
BuckBrown16-Aug-07 9:43
BuckBrown16-Aug-07 9:43 
GeneralRe: Printing with GDI+ Pin
Luc Pattyn16-Aug-07 10:34
sitebuilderLuc Pattyn16-Aug-07 10:34 
GeneralRe: Printing with GDI+ Pin
BuckBrown16-Aug-07 11:17
BuckBrown16-Aug-07 11:17 
GeneralRe: Printing with GDI+ Pin
Luc Pattyn16-Aug-07 11:24
sitebuilderLuc Pattyn16-Aug-07 11:24 
GeneralRe: Printing with GDI+ Pin
BuckBrown16-Aug-07 12:27
BuckBrown16-Aug-07 12:27 
GeneralRe: Printing with GDI+ Pin
Luc Pattyn16-Aug-07 12:50
sitebuilderLuc Pattyn16-Aug-07 12:50 
GeneralRe: Printing with GDI+ Pin
BuckBrown20-Aug-07 6:26
BuckBrown20-Aug-07 6:26 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.