[sara_221540]

How to prevent an app from being killed in task manager?
i want c# code to do that

[__Digital__]

How to prevent an app from being killed in task manager?
i want c# code to do that

elevate to system and user won't be able to kill it, but to elevate you must already have admin

[HFDone]

https://hackforums.net/showthread.php?tid=6086548

[VisualSoft]

https://hackforums.net/showthread.php?tid=6086548

this is to prevent file from being deleted, it wont help protect from task-manager kill.

[namespace]

Google really is a magical tool.

Code

namespace MyNamespace
{
    public static class ProtectProccess
    {
        [DllImport("ntdll.dll", SetLastError = true)]
        private static extern void RtlSetProcessIsCritical(UInt32 v1, UInt32 v2, UInt32 v3);

        private static volatile bool s_isProtected = false;

        private static ReaderWriterLockSlim s_isProtectedLock = new ReaderWriterLockSlim();

        public static bool IsProtected
        {
            get
            {
                try
                {
                    s_isProtectedLock.EnterReadLock();

                    return s_isProtected;
                }
                finally
                {
                    s_isProtectedLock.ExitReadLock();
                }
            }
        }

        public static void Protect()
        {
            try
            {
                s_isProtectedLock.EnterWriteLock();

                if(!s_isProtected)
                {
                    System.Diagnostics.Process.EnterDebugMode();
                    RtlSetProcessIsCritical(1, 0, 0);
                    s_isProtected = true;
                }
            }
            finally
            {
                s_isProtectedLock.ExitWriteLock();
            }
        }

        public static void Unprotect()
        {
            try
            {
                s_isProtectedLock.EnterWriteLock();

                if(s_isProtected)
                {
                    RtlSetProcessIsCritical(0, 0, 0);
                    s_isProtected = false;
                }
            }
            finally
            {
                s_isProtectedLock.ExitWriteLock();
            }
        }
    }
}

[VisualSoft]

Google really is a magical tool.

Code

namespace MyNamespace
{
   public static class ProtectProccess
   {
       [DllImport("ntdll.dll", SetLastError = true)]
       private static extern void RtlSetProcessIsCritical(UInt32 v1, UInt32 v2, UInt32 v3);

       private static volatile bool s_isProtected = false;

       private static ReaderWriterLockSlim s_isProtectedLock = new ReaderWriterLockSlim();

       public static bool IsProtected
       {
           get
           {
               try
               {
                   s_isProtectedLock.EnterReadLock();

                   return s_isProtected;
               }
               finally
               {
                   s_isProtectedLock.ExitReadLock();
               }
           }
       }

       public static void Protect()
       {
           try
           {
               s_isProtectedLock.EnterWriteLock();

               if(!s_isProtected)
               {
                   System.Diagnostics.Process.EnterDebugMode();
                   RtlSetProcessIsCritical(1, 0, 0);
                   s_isProtected = true;
               }
           }
           finally
           {
               s_isProtectedLock.ExitWriteLock();
           }
       }

       public static void Unprotect()
       {
           try
           {
               s_isProtectedLock.EnterWriteLock();

               if(s_isProtected)
               {
                   RtlSetProcessIsCritical(0, 0, 0);
                   s_isProtected = false;
               }
           }
           finally
           {
               s_isProtectedLock.ExitWriteLock();
           }
       }
   }
}

this code need to be run as admin to make it work,
And it will crash the PC if the process is killed.

[namespace]

this code need to be run as admin to make it work,
And it will crash the PC if the process is killed.

Since it's really hard to just put:

Code

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

in app.manifest to request admin privileges?

And I don't get your point? The question is how to prevent the app from being killed in task manager. The only feasible way in my eyes is to mark it as a critical system process (other than just running a script in the background that kills task manager), and as with any other critical system process - it will crash the PC if killed. With sufficient permissions to kill system processes you can kill any process and cause a BSOD - like if I would just end task the csrss.exe.

[__Digital__]

Since it's really hard to just put:

Code

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

in app.manifest to request admin privileges?

And I don't get your point? The question is how to prevent the app from being killed in task manager. The only feasible way in my eyes is to mark it as a critical system process (other than just running a script in the background that kills task manager), and as with any other critical system process - it will crash the PC if killed. With sufficient permissions to kill system processes you can kill any process and cause a BSOD - like if I would just end task the csrss.exe.

Wrong if you elevate to system standard user can not kill the process. There is no need to mark as critical as long as you know how to elevate to to system from user to admin to system.

[VisualSoft]

Since it's really hard to just put:

Code

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

in app.manifest to request admin privileges?

And I don't get your point? The question is how to prevent the app from being killed in task manager. The only feasible way in my eyes is to mark it as a critical system process (other than just running a script in the background that kills task manager), and as with any other critical system process - it will crash the PC if killed. With sufficient permissions to kill system processes you can kill any process and cause a BSOD - like if I would just end task the csrss.exe.

well the point of admin access is, OP is not going to use for legitimate Process, and when he spreads he will have issues or low execution if he uses the app.manifest admin privilege.

[7]

Do you think it would be cool to create a duplicate task manager that shows nothing but normal apps and Microsoft services I think that would be sick

[__Digital__]

Do you think it would be cool to create a duplicate task manager that shows nothing but normal apps and Microsoft services I think that would be sick

Back on windows 7 and 8.1 you could throw a white box over process list so no one could see it to kill it when taskman was launched. i'm sure you could do similar on windows 10 but they changed taskman a little.

[7]

Back on windows 7 and 8.1 you could throw a white box over process list so no one could see it to kill it when taskman was launched. i'm sure you could do similar on windows 10 but they changed taskman a little.

Yeah or just block it completely but that always gave away that you were infected tbh.

[__Digital__]

Yeah or just block it completely but that always gave away that you were infected tbh.

Yes exactly, the better way would have a sleeper process looks for taskman and only it can control the malware process. Tell it to do something when taskman is launched.

[sara_221540]

please help me
i tried all the above code , nothing work

[iolaka]

please help me
i tried all the above code , nothing  work

Try this solution https://hackforums.net/showthread.php?ti...id59969409