Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon. Entire thread

Hiding process

Name: Anonymous 2010-12-13 16:41

what is the best way to hide a process on windows?

so far my "application" injects itself into notepad.exe or paint.exe if one of them is running (by obtaining the pid then using WriteProcessMemory but now I'm looking for a better method

Name: Anonymous 2010-12-13 16:51

>>1
There are hundreds of ways of doing thing. Look into ring3 and ring0 rootkits. Ring3 ones just hook APIs, while ring0 ones either hook SSDT or manipulate system structures and install all kinds of hooks to maintain invisibility. In more extreme cases, the entire system can be virtualized if the CPU supports some ntive forms of virtualization.

If you just want to hide a process from another application, either obscure it somehow or use one of the off-the-shelf rootkits which work well-enough, if it's for your own personal usage (on your own computer that you control).

If those are not suitable enough for you, you can always just inject a dll, or map your code into another process and start a remote thread, effectively running two processes within one. (What is a process? Just a bunch of threads, a shared memory space, handles and some global process properties)

Newer Posts
Don't change these.
Name: Email:
Entire Thread Thread List