windows - How to prevent my process from CreateToolhelp32Snapshot? -

-

is there way prevent process detecting process using createtoolhelp32snapshot?

if in environment need protect users these users need non-admin users , can create service or task runs different user cannot killed.

if absolutely need hide process , chosen method injection & hooking there @ least 6 things need hook in user-mode:

  • the toolhelp api
  • the nt4 process api in psapi.dll
  • the undocumented native nt api
  • the terminal server api
  • performance counters
  • wmi

a "better" solution remove process psactiveprocesshead list need in kernel-mode , means writing custom driver. if go down route program labeled malware/rootkit security tools (and rightly so).


Comments

Post a Comment

Popular posts from this blog

ZeroMQ on Windows, with Qt Creator -

-
i have installed zmq link given below on windows 7. http://zeromq.org/distro:microsoft-windows 1) have c++ project in qt-creator , i'm using zmq c++ binding (zhelpers.hpp etc). 2) have added .lib installed zmq folder qtcreator 3) while compiling, compiler looks _imp__zmq_verion, in .dll files present in .lib have __imp_zmq_version. 4) causing undefined reference zmq_version. anyone else faced problem , has solution ?
Read more

unity3d - Unity SceneManager.LoadScene quits application -

-
i have 2 different scenes 1 named 'main' , other 'game' both added scenes in load. when use scenemanager.loadscene("game"); works no problem when tried return main scene code if (input.getkeydown (keycode.escape)) { scenemanager.loadscene("main"); } strangely game quits. thanks. sorry interruption. somewhere on other script found code. if (input.getkeydown (keycode.escape)) { application.quit (); } that's bad, know...
Read more

python - Error while using APScheduler: 'NoneType' object has no attribute 'now' -

-
i have python app hosting on heroku. use apscheduler call function every day @ time. strange thing 1 time function runs after while have following error log: exception in thread apscheduler (most raised during interpreter shutdown): 2017-09-06t15:03:28.347848+00:00 app[web.1]: traceback (most recent call last): 2017-09-06t15:03:28.347858+00:00 app[web.1]: file "/app/.heroku/python/lib/python2.7/threading.py", line 810, in __bootstrap_inner 2017-09-06t15:03:28.347859+00:00 app[web.1]: file "/app/.heroku/python/lib/python2.7/threading.py", line 763, in run 2017-09-06t15:03:28.347861+00:00 app[web.1]: file "/app/.heroku/python/lib/python2.7/site-packages/apscheduler/schedulers/blocking.py", line 27, in _main_loop 2017-09-06t15:03:28.348167+00:00 app[web.1]: <type 'exceptions.attributeerror'>: 'nonetype' object has no attribute 'now' any guesses? the full code long here key parts: def startdayauto(): global ...
Read more