Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon. Entire thread

Hiding process

Name: Anonymous 2010-12-13 16:41

what is the best way to hide a process on windows?

so far my "application" injects itself into notepad.exe or paint.exe if one of them is running (by obtaining the pid then using WriteProcessMemory but now I'm looking for a better method

Name: Anonymous 2010-12-13 17:40

>>5
Of course not, but just like in any OS, if you have SYSTEM or root priviledges, you can load drives or other kinds of loadable kernel modules. I don't see a problem with this. I actually see a problem with Microsoft trying to make signing drivers mandatory for NT 6 (Vista,Win7) and their anti-kernel hooking code called Patchguard. However, in reality those measures only affect AV companies and most users that care about those things just disable mandatory driver signature checking and/or hack patchguard themselves to get you the same level of control you had with NT5. Malware writers were also not very bothered by signed drivers and patchguard - their ways of bypassing it included hooking the bootloader and hiding themselves even before Windows is started (and/or hooking into the system as it loads and disable security measures that way) or in less evil ways by adding their own root CA's or in a rather interesting recent twist, having their botnets collect private keys and sometimes they even manage to get keys from legitimate companies (realtek lost some keys last time i remember) and then just sign their drivers with those stolen keys. So in the end, the only losers here are some AV companies and some customers.

Name: Anonymous 2010-12-13 21:14

>>7
Realtek's key was obtained through humans.

Newer Posts
Don't change these.
Name: Email:
Entire Thread Thread List