How to create an invisible or protected process?

[Trond]

And what do you expect them to do if they actually need to terminate it (because it's hanging or something)?

[thanos]

And what do you expect them to do if they actually need to terminate it (because it's hanging or something)?

It will exists a "shutdown" procedure from inside the main application.
Regards.

Thanos

[ThorstenD]

Try to convert it to pb

Code: Select all

#define _WIN32_WINNT 0x0500

#include <windows.h>
#include <sddl.h>
#include <accctrl.h>
#include <stdio.h>
#include <conio.h>
#include <aclapi.h>

BOOL ProtectProcess(HANDLE hProcess);

void main(void)
{
	HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId());

	ProtectProcess(hProc);

	printf("SetProcessDacl - Keep a process from being closed by other applications.\nDeveloped by ANUBIS");

	while(TRUE)
	{
		Sleep(100);
	}

}

BOOL ProtectProcess(HANDLE hProcess)
{
	SECURITY_ATTRIBUTES sa;

	sa.nLength = sizeof(SECURITY_ATTRIBUTES);
	sa.bInheritHandle = FALSE;

	if (!ConvertStringSecurityDescriptorToSecurityDescriptor("D:P", SDDL_REVISION_1, &(sa.lpSecurityDescriptor), NULL))
		return FALSE;

	if (!SetKernelObjectSecurity(hProcess, DACL_SECURITY_INFORMATION, sa.lpSecurityDescriptor))
		return FALSE;

	return TRUE;

}

[thanos]

Try to convert it to pb

Thank you, but unfortunately my C knowledge is limited
Regards

Thanos

[Trond]

And what do you expect them to do if they actually need to terminate it (because it's hanging or something)?

It will exists a "shutdown" procedure from inside the main application.
Regards.

Thanos

Yes, but if something goes wrong and the program "stops responding"?

[thanos]

And what do you expect them to do if they actually need to terminate it (because it's hanging or something)?

It will exists a "shutdown" procedure from inside the main application.
Regards.

Thanos

Yes, but if something goes wrong and the program "stops responding"?

A very good question!
But, i will take this risk.
Regards.

Thanos

[Kaeru Gaman]

> i will take this risk.

make sure to properly inform your customers, to enable them to decide if they want to take this risk...

[thanos]

> i will take this risk.

make sure to properly inform your customers, to enable them to decide if they want to take this risk...

Indeed!
If someone knows the way to run a protected process please post.
Regards

Thanos

[Rings]

i did something so far (convert the c code below)
but it did not work here (XP) .
Don't know what goes wrong here,
perhaps someone can help..

Code: Select all

Lib=OpenLibrary(#PB_Any,"advapi32.dll")
If Lib
 Prototype.l ProtoConvertStringSecurityDescriptorToSecurityDescriptor(StringSecurityDescriptor.s,StringSDRevision.l,SecurityDescriptor.l,SecurityDescriptorSize.l)
 
 ConvertStringSecurityDescriptorToSecurityDescriptor.ProtoConvertStringSecurityDescriptorToSecurityDescriptor

  ;If Ansi
 ConvertStringSecurityDescriptorToSecurityDescriptor=GetFunction(lib,"ConvertStringSecurityDescriptorToSecurityDescriptorA")

   ;If UniCode
 ;ConvertStringSecurityDescriptorToSecurityDescriptor=GetFunction(lib,"ConvertStringSecurityDescriptorToSecurityDescriptorW")
   
 
 #SDDL_REVISION_1=1
 #DACL_SECURITY_INFORMATION = 4
 
 If ConvertStringSecurityDescriptorToSecurityDescriptor
  hProc = OpenProcess_(#PROCESS_ALL_ACCESS, #False, GetCurrentProcessId_())
  Debug hproc
  If hproc 
   sa.SECURITY_ATTRIBUTES 
   sa\nLength = SizeOf(SECURITY_ATTRIBUTES)
   sa\bInheritHandle = #False 
   sec.s
   sec="D:P"
   
   Result=ConvertStringSecurityDescriptorToSecurityDescriptor(sec, #SDDL_REVISION_1, @sa\lpSecurityDescriptor, 0)
   ;Debug L1
   Debug Result
   If Result
    Debug @sa\lpSecurityDescriptor
    Debug sa\lpSecurityDescriptor
    Result=SetKernelObjectSecurity_(hProc, #DACL_SECURITY_INFORMATION, sa\lpSecurityDescriptor)
    Debug Result
    If Result
     MessageRequester("info","open Taskmanager And kill me",0)
    
    EndIf
   
   EndIf
   Debug "ending normally..:"
   CloseHandle_(hproc)
  EndIf
 EndIf
 CloseLibrary(Lib)
EndIf
 

[ThorstenD]

i did something so far (convert the c code below)
but it did not work here (XP) .
Don't know what goes wrong here,
perhaps someone can help..

I has the same problem. Compieled with Pelles C it's works on my XP. The full source can be dl from here.

[thanos]

i did something so far (convert the c code below)
but it did not work here (XP) .
Don't know what goes wrong here,
perhaps someone can help..

I has the same problem. Compieled with Pelles C it's works on my XP. The full source can be dl from here.

I faced the same problem with Rings on Xp.
I downloaded and compiled the C code with PellesC but the process was not protected. I killed it with Process Explorer easily on my XP sp3.
Regards.

Thanos

[Comments1]

I'm playing around with this code right now and found out it doesnt work on my 64bit system
What may cause this and is it possible to work on bot 32/64 bit systems?