Hack Forums
[.NET] [FREE] Most powerfull process protector [Not killable by CMD or Taskmgr with admin] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [FREE] Most powerfull process protector [Not killable by CMD or Taskmgr with admin] (/showthread.php?tid=4596751)

Pages: Pages 1 2 3

* - ๖ۣۜMrRoot - Dec 23, 2014

and what if you do Kill process tree?

* - Only3 - Dec 23, 2014

for all that say it can be kill i try it by accident and needed to restart as i cant kill it even with process explorer

* - He B TeMy - Dec 23, 2014

(Dec 23, 2014 10:22 AM)Only3 Wrote:  for all that say it can be kill i try it by accident and needed to restart as i cant kill it even with process explorer

I bet i can kill it with process explorer, just like i can kill eset with Process Hacker.

Edit: I got the code, i just never tested it..

* - CottleSilver - Dec 23, 2014

Send pm with no response, can someone send me the link with the source?

* - Malware - Dec 23, 2014

In process hacker, go to properties of the process and kill all of the threads

* - .cYRil. - Dec 23, 2014

Sounds like interestiing wanna check this out

* - Malware - Dec 23, 2014

Code
Public Class ProtectProcessNew
    Private Delegate Function VarPtrCallbackDelegate(ByVal address As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
    <DllImport("ntdll.dll")>
    Private Shared Function ZwSetInformationProcess(ByVal _1 As IntPtr, ByVal _2 As IntPtr, ByVal _3 As IntPtr, ByVal _4 As IntPtr) As IntPtr
    End Function
    <DllImport("user32.dll")>
    Private Shared Function CallWindowProcA(ByVal wndProc As VarPtrCallbackDelegate, ByRef var As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
    End Function
    Private Shared Function VarPtrCallback(ByVal address As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
      Return address
    End Function
    Public Shared Sub Protect()
      ZwSetInformationProcess(System.Diagnostics.Process.GetCurrentProcess().Handle, &H21&, CallWindowProcA(AddressOf VarPtrCallback, &H8000F129, 0, 0, 0), &H4&)
    End Sub
End Class


* - CottleSilver - Dec 24, 2014

Dose not work with windows 8 :) This is useless

* - TheExclusive - Dec 24, 2014

(Dec 22, 2014 10:42 AM)Odus Wrote:  False claims aside, you have no say in who you give this to since it isn't yours.

Code
Imports System.Runtime.InteropServices

Public Class ProtectExecutable
    Private Delegate Function VarPtrCallbackDelegate(ByVal address As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
    Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal wndProc As VarPtrCallbackDelegate, ByRef var As Short, _
      ByVal unused1 As Integer, ByVal unused2 As Integer, _
      ByVal unused3 As Integer) As Integer
    Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal wndProc As VarPtrCallbackDelegate, ByRef var As Integer, _
      ByVal unused1 As Integer, ByVal unused2 As Integer, _
      ByVal unused3 As Integer) As Integer
    Private Shared Function VarPtrCallback(ByVal address As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
      Return address
    End Function
    Private Shared Function VarPtr(ByRef var As Short) As Integer
      Return CallWindowProc(AddressOf VarPtrCallback, var, 0, 0, 0)
    End Function
    Private Shared Function VarPtr(ByRef var As Integer) As Integer
      Return CallWindowProc(AddressOf VarPtrCallback, var, 0, 0, 0)
    End Function

    <DllImport("Kernel32.dll")>
    Private Shared Function GetCurrentProcess() As IntPtr
    End Function

    <DllImport("ntdll.dll")>
    Private Shared Function ZwSetInformationProcess(ByVal _1 As IntPtr, ByVal _2 As IntPtr, ByVal _3 As IntPtr, ByVal _4 As IntPtr) As IntPtr
    End Function

    Public Shared Sub Main()
      ZwSetInformationProcess(GetCurrentProcess(), &H21&, VarPtr(&H8000F129), &H4&)
    End Sub
End Class

I never said i choose the one i send it to.
I have just send the direct link to every user that pmed me.

* - ali_m0000 - Dec 24, 2014

May I have the code please ?
I will pm u

Ooops I just discovered that I can't pm you
will you please pm me ?

* - nathan72389 - Dec 24, 2014

(Dec 24, 2014 06:32 PM)ali_m0000 Wrote:  May I have the code please ?
I will pm u

Ooops I just discovered that I can't pm you
will you please pm me ?

just signed up to leach something.
too bad you cant read because you would of seen that the code is posted in the post DIRECTLY before yours.

* - CottleSilver - Dec 25, 2014

Test on windows 8:
Spoiler (Click to View)

* - Menalix - Dec 25, 2014

Worst shit code......
It's so easy preventing process from being killed anyways, just unlist it with NtQuerySystemInformation hook.

* - nepHaXOr - May 28, 2015

Private me good method. Seems you are pro in this methods :D

* - AshleyUK - May 28, 2015

(May 28, 2015 08:30 PM)nepHaXOr Wrote:  Private me good method. Seems you are pro in this methods :D

You do realize the last post was 5 months ago. The post also says to PM him not to grave dig.