This one you will like :) -- Very useful for RATs or programs that need protection! :)
I use this code in the RAT I am coding in this very moment! Basically once the file has been executed it will set the PROCESS_IS_CRITICAL flag onto itself so if someone /something tries to kill it, the computer will blue screen!
http://pastebin.com/7AM6JZJE
Code Public Sub ProtectMe()
MsgBox("Press OK to set the process as critical!")
If Protection.SetProcessIsCritical(True) Then
MsgBox("The process is now critical, press OK to unsecure it!")
Protection.SetProcessIsCritical(False)
Else
MsgBox("Failed to protect the process, did it run as administrator?")
End If
End Sub
If you liked this don't forget to leave some feedback 🎉
Its good that you show/share projects and source but why not put them into a single thread.
(Sep 27, 2014 04:29 AM)TheBarret Wrote: Its good that you show/share projects and source but why not put them into a single thread.
I realize I should have, I just found went through my files, then once I found something interesting I posted the source, then went through more 😵
(Sep 27, 2014 05:19 AM)xNeaples Wrote: Actually this is a very nice method, thank you.
Its not new mate, if you try search (oh its so hard to use search..) you will get 10's (if not 100's) of threads that explain this method.
(Sep 27, 2014 06:11 AM)IcYSeptember Wrote: Don't forget to turn this protection off when the user is shutting down, so that he/she doesn't get a BSOD every time they shutdown their computer.
I could write some code for that, but I'm too lazy. I might change my mind in a bit.
That is what I am doing:
AddHandler Microsoft.Win32.SystemEvents.SessionEnding, AddressOf HandleSessionEnding
In Sub HandleSessionEnding, add the code:
Protection.SetProcessIsCritical(False)
(Sep 27, 2014 07:37 AM)ninjahood Wrote: thanks. it works if run as admin only. is it possible to make it works without run as admin?
No, I am afraid not -- It has to be run as administrator to get the required privileges.
(Sep 27, 2014 10:00 AM)IcYSeptember Wrote: That's good.
And also, there are process persistence methods similar to this that don't require administrator privileges. I've got some code written in my (as of now) private C++ loader. The process can't be killed by a normal user if it's run by a normal user, but can be killed by an administrator (but the bot will restart). But if the bot is run as administrator, or bypasses UAC, then the bot can't be killed by a user or an administrator by using normal tools.
That sounds like an amazing program you got there m8!
(Sep 27, 2014 10:18 AM)IcYSeptember Wrote: Meh. It's nothing special.
I haven't been able to work on it lately because I've been working on customer's private malware.
But there's a lot of code already in that project, so...I don't want to give up on it.
Yea I definitely understand that :)! - Keep up the good work bro!
(Sep 27, 2014 12:18 PM)Menalix Wrote: This is probally the most stupid function ever and is quite old.
Well, it might come in handy for some people :)
(Sep 27, 2014 12:24 PM)Professor Proton Wrote: Well, it might come in handy for some people :)
Told ya its gonna bite you in the ass, but your a stubborn lil twat.
Again, why P/Invoke GetCurrentProcess, you have it within .net, just why?
One question, do you come from a background of vb6?
(Sep 27, 2014 01:36 PM)HeBTeMy Wrote: Again, why P/Invoke GetCurrentProcess, you have it within .net, just why?
One question, do you come from a background of vb6?
Yes, when I first started programming, I programmed VB6, and did it for a while :P
It is a habit for me to use P/Invokes..
(Sep 27, 2014 12:55 PM)TheBarret Wrote: Told ya its gonna bite you in the ass, but your a stubborn lil twat.
I still love you too TheBarret! <3 xoxo
(Sep 28, 2014 07:43 AM)IAmNotHere Wrote: Sorry, but this is fucked code. This ruined my pc once.
right as the title say it will do 😊
(Sep 28, 2014 07:43 AM)IAmNotHere Wrote: Sorry, but this is fucked code. This ruined my pc once.
Haha :) - It shouldn't ruin your pc if you use it properly
^^
(Sep 29, 2014 09:51 AM)IAmNotHere Wrote: I think you better code some decent persistence instead of destroying a pc and not having the bot at all, because the pc owner has to do a disk format.
It shouldn't destory your computer at all, just cause blue screen if the process is forcibly closed.
(Sep 29, 2014 01:08 PM)IAmNotHere Wrote: Not true: there is good change your logoff scripts will crash.
Have never had a problem myself. Anyways, you do what you wanna do.
|
