重庆分公司,新征程启航
为企业提供网站建设、域名注册、服务器等服务
专门针对任务管理器。
创新互联建站是一家专业提供洪江管理区企业网站建设,专注与做网站、成都网站建设、H5网站设计、小程序制作等业务。10年已为洪江管理区众多企业、政府机构等服务。创新互联专业网站建设公司优惠进行中。
思路:将kernel32的TerminateProcess的首字节改为HC3,使TerminateProcess失效。
Private Declare Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function CreateToolhelpSnapshot Lib "kernel32" Alias "CreateToolhelp32Snapshot" (ByVal lFlags As Long, ByVal lProcessID As Long) As Long
Private Declare Function ProcessFirst Lib "kernel32" Alias "Process32First" (ByVal hSnapShot As Long, uProcess As PROCESSENTRY32) As Long
Private Declare Function ProcessNext Lib "kernel32" Alias "Process32Next" (ByVal hSnapShot As Long, uProcess As PROCESSENTRY32) As Long '
Private Declare Function ShowWindow Lib "user32" (ByVal hwnd As Long, ByVal nCmdShow As Long) As Long
Private Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
Private Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Private Const TH32CS_SNAPPROCESS = H2
Private Const TH32CS_SNAPheaplist = H1
Private Const TH32CS_SNAPthread = H4
Private Const TH32CS_SNAPmodule = H8
Private Const TH32CS_SNAPall = TH32CS_SNAPPROCESS + TH32CS_SNAPheaplist + TH32CS_SNAPthread + TH32CS_SNAPmodule
Private Const MAX_PATH As Integer = 260
Private Const PROCESS_ALL_ACCESS = H100000 + HF0000 + HFFF
Private Type PROCESSENTRY32
dwSize As Long
cntUseage As Long
th32ProcessID As Long
th32DefaultHeapID As Long
th32ModuleID As Long
cntThreads As Long
th32ParentProcessID As Long
pcPriClassBase As Long
swFlags As Long
szExeFile As String * 1024
End Type
Private Sub AntiKill()
On Error Resume Next
Dim MySnapHandle As Long
Dim hProcess As Long
Dim ProcessInfo As PROCESSENTRY32
Dim Addr As Long, hMod As Long
Dim ASM(0) As Byte
Dim sProcess As String
ASM(0) = HC3 'retn
hMod = GetModuleHandle("kernel32")
Addr = GetProcAddress(hMod, "TerminateProcess")
'Debug.Print Hex(Addr)
MySnapHandle = CreateToolhelpSnapshot(TH32CS_SNAPPROCESS, 0)
ProcessInfo.dwSize = Len(ProcessInfo)
If ProcessFirst(MySnapHandle, ProcessInfo) 0 Then
Do
sProcess = Left(LCase(ProcessInfo.szExeFile), InStr(ProcessInfo.szExeFile, ".") + 3)
If sProcess = "taskmgr.exe" Then
hProcess = OpenProcess(PROCESS_ALL_ACCESS, False, ProcessInfo.th32ProcessID)
'Debug.Print hProcess
WriteProcessMemory hProcess, ByVal Addr, ByVal VarPtr(ASM(0)), 1, 0
'Debug.Print Err.LastDllError
CloseHandle hProcess
End If
Loop While ProcessNext(MySnapHandle, ProcessInfo) 0
End If
CloseHandle MySnapHandle
Err.Clear
End Sub
现在多是在form_load里验证的,你打开第二次也只是暂时的,后面让他关闭就行了.
form_load之前windows form就已经生成... 把你程序读入内存就算这个程序已经被打开开始执行了...不管你放那里都是会打开第二次的...
要让他结束直接用Application.Exit()就行了.
判断有以下几种可能:
1.你用其他程序打开或正在修改test.txt.
2.你在程序该步骤之前的过程中,访问(读写)过该文件:
如果是这种情况,有两种解决办法:
1.修改访问该文件创建对象的申明:
一般来说是
Dim fs As New FileStream("x:\x\x.txt", FileMode.OpenOrCreate, FileAccess.Read, FileShare.ReadWrite)
重点是最后一个参数, FileShare.ReadWrite, 这个参数代表创建这个对象使用文件的同时,允许其他程序读/写该文件. 这样声明就不会产生共享冲突.
2.在之前过程的最后,CLOSE/DISPOSE掉访问文件的对象.
对象名=NOTHING,或者 对象名.CLOSE/DISPOSE,都OK.
你确定没有用hide把窗口关闭。。。如果有用请关闭。。。
如果没有,你可以试用kill来关闭窗口看看。