T-ProcMon-1.0 ʹ˵

Author: Brief
E-Mail: Brief@fz5fz.org
HomePage: www.fz5fz.org && www.safechina.net
Date: 06-06-2003

飺

    ΪһWindows SDK/DDKϵͳϢӹߡ
    ĿǰֻҪܰϵͳ̲ļأɹּϵͳһ֡
    ʵأԼֶ֧ϵͳһʵʩصĹܡ

Ӻ

    ZwQuerySystemInformation;
    ZwOpenProcess;
    ZwTerminateProcess;
    ZwQueryInformationProcess;
    ZwSetInformationProcess;

ע

    T-ProcMonһ򿪷Ĺߡ
    ˿ʹлᵼϵͳԴ𻵡ʹ!
    ĿǰΪ1.0汾ȶԻơ
    󣬽Ӷϵͳ̣߳ģļӹܡ

Ӧƽ̨

    Windows 2000
    Windows XP

Ի

    Microsoft Windows 2000 Professional [Version 5.0.2195] Cn + SP2
    Microsoft Windows XP   Professional [Version 5.1.2600] Cn + SP1
    Microsoft Windows XP   Professional [Version 5.1.2600] En + SP0

ʹʵ

E:\MPJ\Temp\T-ProcMon\Driver\i386>T-ProcMon
T-ProcMon Version 1.0 by Brief
E-Mail: Brief@fz5fz.org
HomePage: www.fz5fz.org && www.safechina.net
Date: 06-06-2003

Usage:
T-ProcMon [-Monitor] | [-Hide] | [[-Add|-Del] ProcessName] | [-Remove]

Example:
T-ProcMon -Monitor        (Monitor all Processes in System)
T-ProcMon -Hide           (Hide all Process(es) the name in List)
T-ProcMon -Add  smss.exe  (Add Process Name "smss.exe" to List)
T-ProcMon -Del  smss.exe  (Delete Process Name "smss.exe" from List)
T-ProcMon -Remove         (Remove when no Need this Driver)

E:\MPJ\Temp\T-ProcMon\Driver\i386>T-ProcMon -Monitor
T-ProcMon Version 1.0 by Brief
E-Mail: Brief@fz5fz.org
HomePage: www.fz5fz.org && www.safechina.net
Date: 06-06-2003

Enter Ctrl+C to End up ...

SEQ.    ProcID  Operation
---------------------------------------------
00000   1304    ZwQueryInformationProcess
00001   1304    ZwSetInformationProcess
00002   1304    ZwQueryInformationProcess
00003   1304    ZwSetInformationProcess
00004   336     ZwQuerySystemInformation
00005   336     ZwOpenProcess
00006   336     ZwOpenProcess
00007   336     ZwQueryInformationProcess
00008   336     ZwOpenProcess
00009   336     ZwOpenProcess
00010   336     ZwQueryInformationProcess
00011   336     ZwOpenProcess
00012   336     ZwOpenProcess
00013   336     ZwQuerySystemInformation
00014   336     ZwOpenProcess
00015   1304    ZwQueryInformationProcess
00016   1628    ZwTerminateProcess
00017   1444    ZwOpenProcess
---------------------------------------------

E:\MPJ\Temp\T-ProcMon\Driver\i386>T-ProcMon -Hide
T-ProcMon Version 1.0 by Brief
E-Mail: Brief@fz5fz.org
HomePage: www.fz5fz.org && www.safechina.net
Date: 06-06-2003

Hidden Process Name List:
----------------------------------
Process Name: smss.exe
Process Name: Winlogon.exe
----------------------------------

Enter Ctrl+C to End up ...

E:\MPJ\Temp\T-ProcMon\Driver\i386>T-ProcMon -Add CSRSS.EXE
T-ProcMon Version 1.0 by Brief
E-Mail: Brief@fz5fz.org
HomePage: www.fz5fz.org && www.safechina.net
Date: 06-06-2003

Add Process Name CSRSS.EXE to Hidden List Successfully !

Hidden Process Name List:
----------------------------------
Process Name: smss.exe
Process Name: Winlogon.exe
Process Name: CSRSS.EXE
----------------------------------

E:\MPJ\Temp\T-ProcMon\Driver\i386>T-ProcMon -Del Smss.exe
T-ProcMon Version 1.0 by Brief
E-Mail: Brief@fz5fz.org
HomePage: www.fz5fz.org && www.safechina.net
Date: 06-06-2003

Delete Process Name Smss.exe from Hidden List Successfully !

Hidden Process Name List:
----------------------------------
Process Name: Winlogon.exe
Process Name: CSRSS.EXE
----------------------------------

E:\MPJ\Temp\T-ProcMon\Driver\i386>T-ProcMon -Remove
T-ProcMon Version 1.0 by Brief
E-Mail: Brief@fz5fz.org
HomePage: www.fz5fz.org && www.safechina.net
Date: 06-06-2003

Remove Device T-ProcMon Successfully !

E:\MPJ\Temp\T-ProcMon\Driver\i386>


ǣ 

FZ5FZ  Ҫ/ϵͳȫѧϰо̼֣̽ԭ׷
FZ5FZ  ҳhttp://www.fz5fz.org
