LVM_FINDITEM is not working for Task Manager

Thanks for your way around. But still my question is same.

As you can see you can kill all the process from task manager. I want to make my application on those category.

Do you have any idea.

Thanks

Vikas

Then a better solution would be to make your software a service. What I mean is the software that is listed in the Control Panel's Services applet. Most software that is not in the Task Manager are services.

No Mr. Sam. Basically I wants to protect my program from any one, just like anti virus. No one will not able to close my program from task manager.

For example you can see Kaspersky. No one can close avp.exe which is running by Kaspersky.


Thanks

Vikas

There is insufficient information in this thread to suggest alternatives.

Are the users that close the program not the owners of the computer and does the owner want the program to be protected?

Can you provide some sample or some link for implement it in c#?

Thanks

Vikas

There are more effective ways to protect a program from being closed using the task manager. Often the most effective way is to eliminate the need for users to want to get rid of the program. If the users that close the program are not the owners of the computer and the owners want the program to be protected then there are management things you can do instead of using a technical solution that you have used. There are many other tools like the task manager that people can use so they will of course do that.

Hi friends,

First of all I would like say thanks to all of you who has given reply over this post.

I have resolved LVM_FINDITEM problem, now I am able to hide process from task manager or delete process from task manager.

I have uploaded the code written in C#.

For anyone's help I have uploaded the code :

http://www.rajtuhin.com/CodeStore/CodePages/CodePage.aspx?codeid=89

Now I have resolved LVM_FindItem issues.


Thanks

Vikas

Hi,

Thanks for your suggestion.

Now I am using VirtualAllocEx, but getting zero from VirtualAllocEx function. Still not getting index from Task Manager.

I am providing my code and please let me know what I am doing wrong.

Here is code :

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Diagnostics;

namespace NonKilltest
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack=1)]
        public unsafe struct LVFINDINFO
        {
           
            public int flags;
            [MarshalAs(UnmanagedType.LPWStr)]
            //[MarshalAs(UnmanagedType.ByValArray, SizeConst = 11)]
            public string psz;
            //public IntPtr psz;
            //[MarshalAs(UnmanagedType.LPWStr)]
            public IntPtr lParam;
            public POINT pt;
            public int vkDirection;
        }
        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)]
        public unsafe struct POINT
        {
            public int x;
            public int y;
            public POINT(int X, int Y)
            {
                this.x = X;
                this.y = Y;
            }
        }
        const Int32 LVM_FINDITEMW = 0x1000 + 83;
        const Int32 LVFI_PARAM = 1;
        const Int32 LVFI_STRING = 2;
        const Int32 LVFI_PARTIAL = 8;
        const Int32 LVFI_WRAP = 32;
        const Int32 LVFI_NEARESTXY = 64;

        [DllImport("user32.dll", CallingConvention = CallingConvention.StdCall, EntryPoint = "SendMessage")]
        private static extern int SendMessage(IntPtr inWindow, uint inMsg, int
     wParam, IntPtr lParam);

        [DllImport("user32.dll", SetLastError = true)]
        static extern IntPtr FindWindow(string lpClassName, string lpWindowName);

        [DllImport("user32.dll", SetLastError = true)]
        static extern IntPtr FindWindowEx(IntPtr hwndParent, IntPtr hwndChildAfter, string lpszClass, string lpszWindow);

       
        [Flags]
        public enum AllocationType
        {
            Commit = 0x1000,
            Reserve = 0x2000,
            Decommit = 0x4000,
            Release = 0x8000,
            Reset = 0x80000,
            Physical = 0x400000,
            TopDown = 0x100000,
            WriteWatch = 0x200000,
            LargePages = 0x20000000
        }
        [Flags]
        public enum MemoryProtection
        {
            Execute = 0x10,
            ExecuteRead = 0x20,
            ExecuteReadWrite = 0x40,
            ExecuteWriteCopy = 0x80,
            NoAccess = 0x01,
            ReadOnly = 0x02,
            ReadWrite = 0x04,
            WriteCopy = 0x08,
            GuardModifierflag = 0x100,
            NoCacheModifierflag = 0x200,
            WriteCombineModifierflag = 0x400
           
        }

        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten);

        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress,
           uint dwSize, AllocationType flAllocationType, MemoryProtection flProtect);

       
        private void button1_Click(object sender, EventArgs e)
        {
            LVFINDINFO xFindInfo = new LVFINDINFO();
            xFindInfo.flags = LVFI_PARTIAL;
            xFindInfo.psz = "firefox.exe";
           
           
            IntPtr lhWndParent = FindWindow(null, "Windows Task Manager");
            int i;
            IntPtr lhWndDialog = new IntPtr();
            IntPtr lhWndProcessList = new IntPtr();
            IntPtr lhWndProcessHeader = new IntPtr();
            for (i = 1; i <= 7; i++)
            {
                lhWndDialog = FindWindowEx(lhWndParent, lhWndDialog, null, null);
                if (lhWndProcessList.ToInt32() == 0)
                    lhWndProcessList = FindWindowEx(lhWndDialog, new IntPtr(0), "SysListView32", "Processes");
                if (lhWndProcessHeader.ToInt32() == 0)
                    lhWndProcessHeader = FindWindowEx(lhWndProcessList, new IntPtr(0), "SysHeader32", null);
            }

            IntPtr codeBytesPtr;
            UIntPtr ppl;

            byte[] bb = StructureToByteArray(xFindInfo);

           //Getting 0 from VirtualAllocEx
            codeBytesPtr = VirtualAllocEx(lhWndProcessList, (IntPtr)0, (uint)Marshal.SizeOf(xFindInfo), AllocationType.Commit, MemoryProtection.ReadWrite);
            WriteProcessMemory(lhWndProcessList, codeBytesPtr, bb, (uint)Marshal.SizeOf(xFindInfo), out ppl);
           
            int index1 = SendMessage(lhWndProcessList, LVM_FINDITEMW, -1, codeBytesPtr);
            MessageBox.Show(index1.ToString());
                       
        }

        static byte[] StructureToByteArray(object obj)
        {

            int len = Marshal.SizeOf(obj);

            byte[] arr = new byte[len];

            IntPtr ptr = Marshal.AllocHGlobal(len);

            Marshal.StructureToPtr(obj, ptr, true);

            Marshal.Copy(ptr, arr, 0, len);

            Marshal.FreeHGlobal(ptr);

            return arr;

        }

        static void ByteArrayToStructure(byte[] bytearray, ref object obj)
        {

            int len = Marshal.SizeOf(obj);

            IntPtr i = Marshal.AllocHGlobal(len);

            Marshal.Copy(bytearray, 0, i, len);

            obj = Marshal.PtrToStructure(i, obj.GetType());

            Marshal.FreeHGlobal(i);

        }
    }
}

A Vulpes says, there is the problem of the data being in different address spaces.

You might know that it is possible to send a message to a control in another address space to get the text of the control. A simplified explanation of why that works is that some messages existed in 16-bit (yes 16-bit) Windows and there was no such thing as separate address spaces in Windows (16-bit Windows executed on top of DOS). So messages that existed in 16-bit Windows will work across address spaces. That is because Windows marshalls the data across address spaces for those messages. Or maybe it is becasue shared memory is used but I am nearly certain that I have read that it is due to marhallling.

Using VirtualAllocEx will probably work. I would be concerned about antivirus software that might consider that to be suspicious. Also some systems might have tighter security and therefore might not allow things such as VirtualAllocEx. So it depends on what you need to use this for.