[Razor Sharp]

Hey HF this is a simple method to stop your process from being stopped by any program. It works by finding out the processes .exe then checking if the process is running every two seconds. If the process is not running it starts the process up again. I am also working on Registry and file protection and will post them in the morning. This is by no way a finished product and is still very buggy. Any Ideas on how to improve it would be great 👍. Anyway the code is here:

Code

Imports System.ComponentModel

Module Module1
    Dim t() As Process

    Sub Find_exe(ByVal process_name As String)
      'finds the location of the executable
      For Each p As Process In Process.GetProcessesByName(process_name)
      Dim file As String
      Try
            file = p.Modules(0).FileName
      Catch ex As Win32Exception
            file = "n/a"
      End Try
      IsItRunning(file, process_name)
      Next
    End Sub

    Private Sub IsItRunning(ByVal file As String, ByVal process_name As String)
      While True
      t = Process.GetProcessesByName(process_name)
      If t.Count > 0 Then
            ' Process is running
            System.Threading.Thread.Sleep("2000")
      Else
            Process.Start(file)
            ' Process is not running
      End If
      End While
    End Sub
End Module

Usage:

Code

Find_exe("your_process_name")

If you get "file not found" errors just replace all the find_exe stuff with "Dim file = "your file directory""
Thanks for reading this
regards
Razor Sharp

[AEDEAD]

Hey HF this is a simple method to stop your process from being

---

crap, hit enter by accident :/ will post thread in 5 min

Um okay, I'll edit my post in 5 min.

[n0$f3ratu$]

Code

If Process.GetProcessesByName("file1").Length = 0 Then
    Process.Start(your path\"file1")
End If

[BlacksmithSec]

This is a bad approach - timed checks wont work and are inefficient
Still a nice share but thought i'd throw in my penny worth

[Razor Sharp]

This is a bad approach - timed checks wont work and are inefficient
Still a nice share but thought i'd throw in my penny worth

thanks for the reply, just wondering what would you use instead of time checks?

[Menalix]

I would rather just do a hook on NtOpenProcess, it's like 12 lines of code.

[Moon Rock]

Nice of you to share the code, however it doesn't seem proficient.

[The-One]

Although the code isn't reliable, as you can just kill the process using your code and before killing the original process , but the idea is a very good start. I'd say you take this code and try to improve it better (like, maybe injecting it into a system process?).

Good luck!

[cwood]

I would rather just do a hook on NtOpenProcess, it's like 12 lines of code.

Can you provide more information about this?

[Menalix]

Can you provide more information about this?

Well Alloc some memory in the Remote Process, Write your hookcode (gotta be asm) to it,
Get the Function address of NtOpenProcess or NtTerminateProcess on the remote process, write a Call or JMP and the offset to where you wrote the hook code.
Native hook done :) quite simple.

I personally hook NtOpenProcess to prevent anti-cheat from scanning for my cheat (hexui.com cheat)

[cwood]

how do I get the asm hookcode for ntopenprocess?

[Menalix]

how do I get the asm hookcode for ntopenprocess?

Well it's different from what you need. but you read up about asm.

This would return access denied for any process as an example

Code

MOV EAX, C0000022
RETN 8

[Zeivu~]

Thanks man this will be good for a crypter one day