在网上发现这个 也不知道真的假的 大家研究研究
#include "stdafx.h"
#include <windows.h>
#include "psapi.h"

#pragma comment(lib,"psapi.lib")

int main(int argc, char* argv[])
{



printf("\nEasy to Find Hided PID Code \n");
printf("Author: Finback Jun.6,2006 <Finbackcpp@hotmail.com> \n");
printf("NOTE：this code needn't any driver supported \n");
printf(" \n");


DWORD aProcesses[1024], cbNeeded;

if ( !EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) )
return 0;
DWORD cProcesses = cbNeeded / sizeof(DWORD);

DWORD PidFor;
for ( PidFor = 0x0c; PidFor < 0xFFFF; PidFor +=4 )
{
HANDLE hProcess = OpenProcess( PROCESS_QUERY_INFORMATION |
PROCESS_VM_READ,
FALSE, PidFor );

if (hProcess)
{
BOOL sHide = false;
unsigned int i;
char szName[MAX_PATH]="<Unknown>";
HMODULE hModule;

for ( i = 1; i <= cProcesses; i++ )
{
if (PidFor == aProcesses)
{
sHide = true;
break;
}

}

if(EnumProcessModules(hProcess,&hModule,sizeof(hModule),&cbNeeded))
{
GetModuleFileNameEx(hProcess,hModule,szName,sizeof(szName));
printf("%-5d - %16s %s\n", PidFor, szName, (sHide) ? "" : "--[Hidden]--");
}
else
{
GetProcessImageFileName(hProcess,szName,sizeof(szName));
printf("%-5d - %16s %s\n", PidFor, szName, "--[Zombie]--");
}

}

CloseHandle( hProcess );
}

return 0;
}

有点错误 正在解决中``