Dll进程注入 一种简单的方法隐藏进程 在dll中运行代码,The simplest ways to hide a process is to have no process Basically what you need to do is place your meaningful code in a DLL, inject that DLL in an inconspicuous process (like Explorer.exe) and run your code. This can

NP启动后通过WriteProcessMemory跟CreateRemoteThread向所有进程注入代码（除了系统进程smss.exe），代码通过np自己的LoadLibrary向目标进程加载npggNT.des。npggNT.des一旦加载就马上开始干“坏事”，挂钩(HOOK)系统关键函数如OpenProcess,ReadProcessMemory,WriteProcessMemory,PostMessage等等。 挂钩方法是通过改写系统函数头，在函数开始JMP到npggNT.des中的