Hack Forums
[C#] Block file removal with a simple trick - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] Block file removal with a simple trick (/showthread.php?tid=6086548)



Block file removal with a simple trick - Paskowsky - Jun 11, 2020

Block file removal with a simple trick

[Image: errormessage.png]


How it works?
  • Use “CreateFile” to get handle from file path

  • Look for processes where to “inject” the handle

  • Use “DuplicateHandle” to duplicate the original handle in the selected process

  • Close the original handle



You can check out the code in my blog post here!

Or directly on Gist!

Regards,
Paskowsky


RE: Block file removal with a simple trick - Accord - Jun 11, 2020

Another interesting release, great job paskowsky!!


RE: Block file removal with a simple trick - SaketSaket - Jun 11, 2020

Nice work... Keep posting... keep rocking...


RE: Block file removal with a simple trick - 7 - Jun 11, 2020

Yet another layer of simple persistence. Thanks OP


RE: Block file removal with a simple trick - FrenchTech - Jun 11, 2020

Interesting code! Thanks for sharing.


RE: Block file removal with a simple trick - VisualSoft - Jun 12, 2020

Interesting release, Keep up the good work.


RE: Block file removal with a simple trick - Klonopin - Jul 27, 2020

Great share OP!

interesting post, keep up with the grind


RE: Block file removal with a simple trick - tux1 - Jul 29, 2020

Interesting trick, thanks for sharing!


RE: Block file removal with a simple trick - Scapula™ - Jul 29, 2020

Nice trick, thanks for sharing.


RE: Block file removal with a simple trick - Freak_OG - Jul 30, 2020

this is great! Wow such rootkit many haxes, wow, thanks bro!


RE: Block file removal with a simple trick - Exalted - Jul 30, 2020

Interesting, thanks for sharing this OP. Keep them coming!