Hack Forums
[.NET] [FREE] Most powerfull process protector [Not killable by CMD or Taskmgr with admin] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [FREE] Most powerfull process protector [Not killable by CMD or Taskmgr with admin] (/showthread.php?tid=4596751)

Pages: Pages 1 2 3

[FREE] Most powerfull process protector [Not killable by CMD or Taskmgr with admin] - TheExclusive - Dec 22, 2014

[Excuse]
Sorry guys for my previous thread where i sold this source.
It was a stupid idea and i didn't knew i had to post it in marketplace.
I decide to give it away for free now.
PM me for the direct link of the project.

[Threat introduction]
There are a lot of process protector sources online.
I have seen some public sources that cause BSOD.
Or some that say's access denied when end process.
But they can easily be terminated or to suspicious.

[Process protector]
This process protector is so powerfull the taskmanager can't kill it even with admin rights.
I also tried to kill it with multiple script's but every time it fail to end the process.

[Scan]
- 100% FUD source


[Proof]
[img]http://s7.postimg.org/61uk8jqfd/proof.gif[/img]


Only tested with windows 7

* - ElementalTree - Dec 22, 2014

Would be nice with a working "proof" image

* - SIM-2137258 - Dec 22, 2014

I will pm me, your methods interest me thank you for sharing free :)

* - nathan72389 - Dec 22, 2014

easily killed.
just freeze and end the process or send it a error message.

* - Only3 - Dec 22, 2014

pm is worse then selling if u want to share post it else keep it private

* - TheExclusive - Dec 22, 2014

(Dec 22, 2014 08:41 AM)Only3 Wrote:  pm is worse then selling if u want to share post it else keep it private

I thought it would be easy to have a project, so you can just compile and done.

(Dec 22, 2014 07:57 AM)nathan72389 Wrote:  easily killed.
just freeze and end the process or send it a error message.

A normal user can't kill this.
Can you learn me how to do this ?

* - 0xfd - Dec 22, 2014

pm me please, thank you for sharing free :)

* - Cookie.Monster - Dec 22, 2014

Pmed you mate, could be nice to try out. :)

* - tweety - Dec 22, 2014

(Dec 22, 2014 08:45 AM)TheExclusive Wrote:  I thought it would be easy to have a project, so you can just compile and done.


A normal user can't kill this.
Can you learn me how to do this ?

[Image: d1542f3713.png] .

* - Odus - Dec 22, 2014

False claims aside, you have no say in who you give this to since it isn't yours.

Code
Imports System.Runtime.InteropServices

Public Class ProtectExecutable
    Private Delegate Function VarPtrCallbackDelegate(ByVal address As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
    Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal wndProc As VarPtrCallbackDelegate, ByRef var As Short, _
      ByVal unused1 As Integer, ByVal unused2 As Integer, _
      ByVal unused3 As Integer) As Integer
    Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal wndProc As VarPtrCallbackDelegate, ByRef var As Integer, _
      ByVal unused1 As Integer, ByVal unused2 As Integer, _
      ByVal unused3 As Integer) As Integer
    Private Shared Function VarPtrCallback(ByVal address As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
      Return address
    End Function
    Private Shared Function VarPtr(ByRef var As Short) As Integer
      Return CallWindowProc(AddressOf VarPtrCallback, var, 0, 0, 0)
    End Function
    Private Shared Function VarPtr(ByRef var As Integer) As Integer
      Return CallWindowProc(AddressOf VarPtrCallback, var, 0, 0, 0)
    End Function

    <DllImport("Kernel32.dll")>
    Private Shared Function GetCurrentProcess() As IntPtr
    End Function

    <DllImport("ntdll.dll")>
    Private Shared Function ZwSetInformationProcess(ByVal _1 As IntPtr, ByVal _2 As IntPtr, ByVal _3 As IntPtr, ByVal _4 As IntPtr) As IntPtr
    End Function

    Public Shared Sub Main()
      ZwSetInformationProcess(GetCurrentProcess(), &H21&, VarPtr(&H8000F129), &H4&)
    End Sub
End Class


* - Only3 - Dec 22, 2014

(Dec 22, 2014 10:42 AM)Odus Wrote:  False claims aside, you have no say in who you give this to since it isn't yours.

Code
Imports System.Runtime.InteropServices

Public Class ProtectExecutable
    Private Delegate Function VarPtrCallbackDelegate(ByVal address As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
    Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal wndProc As VarPtrCallbackDelegate, ByRef var As Short, _
      ByVal unused1 As Integer, ByVal unused2 As Integer, _
      ByVal unused3 As Integer) As Integer
    Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal wndProc As VarPtrCallbackDelegate, ByRef var As Integer, _
      ByVal unused1 As Integer, ByVal unused2 As Integer, _
      ByVal unused3 As Integer) As Integer
    Private Shared Function VarPtrCallback(ByVal address As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
      Return address
    End Function
    Private Shared Function VarPtr(ByRef var As Short) As Integer
      Return CallWindowProc(AddressOf VarPtrCallback, var, 0, 0, 0)
    End Function
    Private Shared Function VarPtr(ByRef var As Integer) As Integer
      Return CallWindowProc(AddressOf VarPtrCallback, var, 0, 0, 0)
    End Function

    <DllImport("Kernel32.dll")>
    Private Shared Function GetCurrentProcess() As IntPtr
    End Function

    <DllImport("ntdll.dll")>
    Private Shared Function ZwSetInformationProcess(ByVal _1 As IntPtr, ByVal _2 As IntPtr, ByVal _3 As IntPtr, ByVal _4 As IntPtr) As IntPtr
    End Function

    Public Shared Sub Main()
      ZwSetInformationProcess(GetCurrentProcess(), &H21&, VarPtr(&H8000F129), &H4&)
    End Sub
End Class

🙂 this is based on vb6 code which u can find on net

* - Odus - Dec 22, 2014

(Dec 22, 2014 11:29 AM)Only3 Wrote:  🙂 this is based on vb6 code which u can find on net

That's what I was thinking. It's the same one OP tried to sell for $10 in a previous thread.

* - Only3 - Dec 22, 2014

(Dec 22, 2014 11:45 AM)Odus Wrote:  That's what I was thinking. It's the same one OP tried to sell for $10 in a previous thread.

😁 well if its work i can agree with him good conversion 😏

* - Odus - Dec 22, 2014

(Dec 22, 2014 12:06 PM)Only3 Wrote:  😁 well if its work i can agree with him good conversion 😏

Really good conversion... Just not by him 😊

* - Only3 - Dec 22, 2014

(Dec 22, 2014 12:16 PM)Odus Wrote:  Really good conversion... Just not by him 😊

😁 https://fuckav.ru/showthread.php?t=18410 its early to decide that he copy it let wait for him