unit Unit1; interface uses Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms, Dialogs, StdCtrls, untProcessEventThr, PsAPI, ComCtrls, StrUtils; type TForm1 = class(TForm) btnHide: TButton; edtProcessName: TEdit; procedure FormClose(Sender: TObject; var Action: TCloseAction); procedure btnHideClick(Sender: TObject); private { Private declarations } public { Public declarations } m_hCommDevice:THandle; m_hCommEvent:THandle; end; var Form1: TForm1; implementation uses Unit2, untConst; {$R *.dfm} procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction); var dwReturn:DWORD ; begin if(m_hCommDevice <> 0) then begin if(m_hCommEvent <> 0) then begin DeviceIoControl(m_hCommDevice, IO_DEREFERENCE_EVENT, nil, 0, nil, 0, dwReturn, nil); CloseHandle(m_hCommEvent); end; CloseHandle(m_hCommDevice); end; end; procedure TForm1.btnHideClick(Sender: TObject); var dwReturn: DWORD; proname:array [0..1023] of char; begin //创建设备 try m_hCommDevice := CreateFile('//./HideProcess', GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); except MessageBox(Handle, '创建设备失败', '隐藏进程启动', MB_OK + MB_ICONWARNING); end; //创建事件 try m_hCommEvent := CreateEvent(nil, false, false, nil); except CloseHandle(m_hCommDevice); MessageBox(Handle, '创建事件失败', '隐藏进程启动', MB_OK + MB_ICONWARNING); end; //发送事件句柄给驱动 DeviceIoControl(m_hCommDevice, IO_REFERENCE_EVENT, pointer(m_hCommEvent), 0, nil, 0, dwReturn, nil); StrPCopy(@proname, Trim(edtProcessName.Text)); DeviceIoControl(m_hCommDevice, IO_PASSBUF, @proname, sizeof(proname), nil, 0, dwReturn, nil); end; end.