虽然我不知道icesword是什么样列举服务的，但估计最终也是通过历遍SCM内部的ServiceRecordList来检测。 为什么呢？看下面。 用附件中的InjectDLL.exe把hideservice.dll注入到Services.exe进程后就会把Alerter服务隐藏掉。用icesword也检测不出Alerter服务了。 代码原理很简单，就是在Services.exe进程找到ServiceRecordList表,将需要隐藏的服务从链表上断开。 既然icesword

HideService

Although I do not know what kind icesword enumerated services, it is estimated that by the end times calendar SCM internal ServiceRecordList to detect. Why? See below. The annex InjectDLL.exe put hideservice.dll injected into Ser vices.exe process af