+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] ANTI KILL PROCESS HACKER [SR] VB.NET API (/showthread.php?tid=4787672)
Pages: Pages
1
2
ANTI KILL PROCESS HACKER [SR] VB.NET API - xVipX - Apr 20, 2015
hello today i have coding simple class to bypass process hacker by found window visible & child & setwindowtext & enable butoun and use timer very easy !
image : )
[img]http://up.dev-point.com/uploads1/cda83ae148cf1.gif[/img]
class
http://pastebin.com/wnZC5T2G
use :
Code
Dim x As New prote
x.pass()* - EagleEye - Apr 20, 2015
nice share good code btw , its good way ... i may use it in my future projects
* - Only3 - Apr 20, 2015
what normal person do when he see that his process hacker doesnt work
* - LethalNET - Apr 20, 2015
this could be done to task manager too, winapi is very useful.
good work op although the code could be improved its a unique release :)
* - xVipX - Apr 20, 2015
(Apr 20, 2015 12:19 PM)Only3 Wrote: what normal person do when he see that his process hacker doesnt workyes i will put class to bypass taskmng + bsod
this gifte to y bro y the best in this : )
* - Ninja - Apr 20, 2015
(Apr 20, 2015 12:21 PM)LethalNET Wrote: this could be done to task manager too, winapi is very useful.
good work op although the code could be improved its a unique release :)
Unique? I saw at least 5 other threads this month about anti process killers.
* - LethalNET - Apr 20, 2015
(Apr 20, 2015 03:14 PM)Tyranitar Wrote: Unique? I saw at least 5 other threads this month about anti process killers.
The method its using is what I'm saying is a unique release, instead of setting the process as critical or admin only its uses a completely different approach.
I'm not so active in these subforums so I may have overlooked but I haven't seen this posted anywhere here.
I'm not saying the concept of process protection is unique only the method he is using.
* - Cecilia - Apr 20, 2015
(Apr 20, 2015 04:24 PM)LethalNET Wrote: The method its using is what I'm saying is a unique release, instead of setting the process as critical or admin only its uses a completely different approach.
I'm not so active in these subforums so I may have overlooked but I haven't seen this posted anywhere here.
I'm not saying the concept of process protection is unique only the method he is using.
Anyone remember that .net 'rootkit' that removed the process from taskmanager using winapi stuff?
Its not unique at all, its been done before with plenty of things.
* - nuk - Apr 20, 2015
(Apr 20, 2015 07:27 PM)LaPanthere Wrote: Anyone remember that .net 'rootkit' that removed the process from taskmanager using winapi stuff?
Its not unique at all, its been done before with plenty of things.
Is there really such a thing as a TRUE .net ring-0 Rootkit? ...I'm just wondering because I didn't think that was possible? Would be interesting to take a look at the source to something like that.
* - Vigor - Apr 20, 2015
(Apr 20, 2015 07:27 PM)LaPanthere Wrote: Anyone remember that .net 'rootkit' that removed the process from taskmanager using winapi stuff?
Its not unique at all, its been done before with plenty of things.
Yaaa I remember that. I was the one that originally posted, coded, and released that. The very first one. :)
* - Moon Rock - Apr 20, 2015
Hmm, code seems pretty long but if it does the job then I don't see a problem.
* - Ninja - Apr 21, 2015
Who calls their PC "COBRAxXx-PC", lol.
* - GhostCode - Apr 21, 2015
(Apr 20, 2015 10:03 PM)nuk Wrote: Is there really such a thing as a TRUE .net ring-0 Rootkit? ...I'm just wondering because I didn't think that was possible? Would be interesting to take a look at the source to something like that.
A ring0 rootkit is not possible in C#/VB.Net.
A ring3 rootkit is theoretically possible in .net, tho its tricky to code, but it is possible.
It requires knowledge about remote process hooking, code injection etc.
Many people called 'Darkfire' a rootkit in .net.
Its not a rootkit at all.. ;]
* - Cecilia - Apr 21, 2015
(Apr 21, 2015 04:51 AM)GhostCode Wrote: A ring0 rootkit is not possible in C#/VB.Net.
A ring3 rootkit is theoretically possible in .net, tho its tricky to code, but it is possible.
It requires knowledge about remote process hooking, code injection etc.
Many people called 'Darkfire' a rootkit in .net.
Its not a rootkit at all.. ;]
Thats the one I thought of when I saw this thread.
Exactly, its not a rootkit at all, just a trick or two.
(Apr 21, 2015 04:51 AM)GhostCode Wrote: A ring0 rootkit is not possible in C#/VB.Net.
A ring3 rootkit is theoretically possible in .net, tho its tricky to code, but it is possible.
It requires knowledge about remote process hooking, code injection etc.
Many people called 'Darkfire' a rootkit in .net.
Its not a rootkit at all.. ;]
Thats the one I thought of when I saw this thread.
Exactly, its not a rootkit at all, just a trick or two.
* - He B TeMy - Apr 21, 2015
This has nothing to do with a rootkit, it's just "tampering" with processhacker.