Hack Forums
[.NET] Hide Process From TaskManager - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] Hide Process From TaskManager (/showthread.php?tid=4794760)

Pages: Pages 1 2


Hide Process From TaskManager - xeinebiu - Apr 25, 2015

Hello guys ...
In this thread I want to show you a method how to hide your process from TASKMANAGER ...


  1. Open New Project

  2. Import Libraries
    Code
    Imports System.Reflection
    Imports System.Runtime.CompilerServices

  3. Form_Load
    In Form_Load Event add this code :
    Code
    Dim s As New OpenFileDialog
    s.ShowDialog()

    Dim filesbytes() As Byte = IO.File.ReadAllBytes(s.FileName)
    Dim x As New Threading.Thread(AddressOf RunFromMemory)
    x.TrySetApartmentState(Threading.ApartmentState.STA)
    x.Start(filesbytes)
    me.close


  4. Add this Sub
    Code
    Private Sub RunFromMemory(ByVal bytes As Byte()) 'not sure how it works :(
    Dim assembly As Assembly = assembly.Load(bytes)
    Dim entryPoint As MethodInfo = [assembly].EntryPoint
    Dim objectValue As Object = RuntimeHelpers.GetObjectValue([assembly].CreateInstance(entryPoint.Name))
    entryPoint.Invoke(RuntimeHelpers.GetObjectValue(objectValue), New Object() {New String() {"1"}})
    End Sub




This Sub will be called and all bytes you chosed will be run in memory and will be invisible in PROCESS List in TASKMANAGER ...
You can import the bytes to Resources and use them or any method you want ...
REMEBER , just the Program which you load to memory will be hidden ...



* - suffixx - Apr 26, 2015

Very nice :) Next time, I'll also hide my programms in Taskmanager :)

You also have code to block regedit, cmd and tskmrg?

greetings


* - Cecilia - Apr 26, 2015

This is simple reflection loading.
It is used in most crypters.

Smaller code below
C#:
PHP Code

<?php 
Assembly
.Load(bytes).EntryPoint.Invoke(null, new object[] { null }); 



* - Only3 - Apr 26, 2015

so what the point of it if once u close the loader it will be closed too


* - xeinebiu - Apr 26, 2015

(Apr 26, 2015 05:46 AM)Only3 Wrote:  so what the point of it if once u close the loader it will be closed too

Mabye you can try to make changes to the code ...


* - SadJc - Apr 26, 2015

Thank you very useful! I appreciate it.


* - comeback - Apr 27, 2015

if I choose server.exe , then server.exe will run automatic dan hide in task manager ??


* - xeinebiu - Apr 27, 2015

(Apr 27, 2015 03:07 AM)comeback Wrote:  if I choose server.exe , then server.exe will run automatic dan hide in task manager ??

yea it will be loaded in ram ... but user can close the loader from taskmanager ... this is not good ...


* - Illusionisten - Apr 29, 2015

IDK how this works but couldnt you just hide yourself instead of having exe 1 hiding your exe 2


* - Hopsin - Apr 30, 2015

(Apr 25, 2015 03:53 PM)xeinebiu Wrote:  Hello guys ...
In this thread I want to show you a method how to hide your process from TASKMANAGER ...


  1. Open New Project

  2. Import Libraries
    Code
    Imports System.Reflection
    Imports System.Runtime.CompilerServices

  3. Form_Load
    In Form_Load Event add this code :
    Code
    Dim s As New OpenFileDialog
    s.ShowDialog()

    Dim filesbytes() As Byte = IO.File.ReadAllBytes(s.FileName)
    Dim x As New Threading.Thread(AddressOf RunFromMemory)
    x.TrySetApartmentState(Threading.ApartmentState.STA)
    x.Start(filesbytes)
    me.close


  4. Add this Sub
    Code
    Private Sub RunFromMemory(ByVal bytes As Byte()) 'not sure how it works :(
    Dim assembly As Assembly = assembly.Load(bytes)
    Dim entryPoint As MethodInfo = [assembly].EntryPoint
    Dim objectValue As Object = RuntimeHelpers.GetObjectValue([assembly].CreateInstance(entryPoint.Name))
    entryPoint.Invoke(RuntimeHelpers.GetObjectValue(objectValue), New Object() {New String() {"1"}})
    End Sub




This Sub will be called and all bytes you chosed will be run in memory and will be invisible in PROCESS List in TASKMANAGER ...
You can import the bytes to Resources and use them or any method you want ...
REMEBER , just the Program which you load to memory will be hidden ...

I think i have seen this before. Nonetheless, many thanks OP for sharing. 👍


* - Moon Rock - Apr 30, 2015

I'm going to try this soon, thanks for sharing :Smile:


RE: Hide Process From TaskManager - Tom2565 - Jan 13, 2018

NO WORKING


System.BadImageFormatException


RE: Hide Process From TaskManager - radicalxfrosty - Jan 13, 2018

Thanks OP for sharing this method!
nicee


RE: Hide Process From TaskManager - Tom2565 - Jan 13, 2018

NO WORK BLYAT There was an error posting your reply: The message is too short. Please enter a message longer than 25 characters.


RE: Hide Process From TaskManager - Vyxn - Jan 13, 2018

(Jan 13, 2018 05:46 AM)Tom2565 Wrote:  NO WORK BLYAT There was an error posting your reply: The message is too short. Please enter a message longer than 25 characters.

You must be a programmer to make it work. :)