55 lines
1.1 KiB
C++
55 lines
1.1 KiB
C++
#pragma once
|
|
#include "Base.h"
|
|
#define MAX_PROCESS_HANDLE_RESULTS 256
|
|
|
|
typedef struct _PROCESS_BASIC_INFORMATION_CUSTOM
|
|
{
|
|
NTSTATUS ExitStatus;
|
|
PVOID PebBaseAddress;
|
|
ULONG_PTR AffinityMask;
|
|
LONG BasePriority;
|
|
ULONG_PTR UniqueProcessId;
|
|
ULONG_PTR InheritedFromUniqueProcessId;
|
|
|
|
} PROCESS_BASIC_INFORMATION_CUSTOM,
|
|
* PPROCESS_BASIC_INFORMATION_CUSTOM;
|
|
|
|
typedef struct _PROCESS_HANDLE_RESULT
|
|
{
|
|
DWORD ProcessId;
|
|
DWORD TargetProcessId;
|
|
ULONG_PTR HandleValue;
|
|
ULONG GrantedAccess;
|
|
char ProcessName[MAX_PATH];
|
|
|
|
} PROCESS_HANDLE_RESULT;
|
|
|
|
typedef struct _PROCESS_HANDLE_RESULTS
|
|
{
|
|
DWORD Count;
|
|
PROCESS_HANDLE_RESULT Items[MAX_PROCESS_HANDLE_RESULTS];
|
|
|
|
} PROCESS_HANDLE_RESULTS;
|
|
|
|
|
|
|
|
namespace active_check
|
|
{
|
|
//检测向日葵进程
|
|
auto check_awesun_process() -> bool;
|
|
|
|
//检测Todesk进程
|
|
auto check_todesk_process() -> bool;
|
|
|
|
//检测连连控进程
|
|
auto check_asklink_process() -> bool;
|
|
|
|
//检测网易UU远程进程
|
|
auto check_uu_remote_process() -> bool;
|
|
|
|
//检测远程软件进程
|
|
auto check_remote_app_process() -> bool;
|
|
|
|
//检测已打开的进程句柄的进程
|
|
auto ScanProcessHandles(DWORD CurrentProcessId, PROCESS_HANDLE_RESULTS* Results)->BOOL;
|
|
} |