Cheat Engine

[Traps]

How can I make a process unkillable(like for example through taskmanager)

I thought about creating a couple seperate processes that monitor each other, and my main program. If my main program dies, one of the seperate process's will relaunch it, and if one of the serperate process's dies, the cooresponding sister process will relaunch it.

This is kinda lame in my opinion. Is there a way to hook the kernal level terminateprocess(). That would be the best route to go, but I have no clue how to do this in c#.

[Poent]

One of the ways I can think of to hide it would be to use a root-kit, I dont know too much about them, but I do know that many viruses use them to hide themselves and their files.

P.S.

.NET is the devil

[appalsap]

WRONG way: Enumerate the processes and restart if you find missing. This makes your process vulnerable to a suspend-kill attack.

RIGHT way: Use thread synchronization objects or a pipe to constantly verify that the sibling process is active and OK. This is not lame, and much more cleaner than hooking TerminateProcess (and there are many many ways to terminate a process, terminateprocess is just the easiest)

[the_undead]

And named pipes in .NET are incredibly simple. More so than in anything else.

[appalsap]

They can be anonymous (easier than named), if one process is to launch another, there are many ways they can share handles.

[linden]

Two process monitoring each other...too lame...
hooking terminateprocess is not good...one can still kill the process if he can open a process handle to it (i.e. inject buggy code to the victim process, nopping the code area, etc.).

The best way is still the rootkit technique... hook any one of these in the kernel: NtOpenProcess, PsLookupProcessByProcessId, ObOpenObjectByPointer, ObReferenceObjectByPointer; but can't be realized using c#

EDIT:
Ah! I came up with another idea! You really need a process?
If not, you might try implement everything into a DLL (a C# DLL?)
and then inject that DLL into winlogon.exe and run under the process context of winlogon.exe. Nobody would dare to terminate winlogon.exe, since terminating winlogon.exe means crashing windows

[the_undead]

Youre gonna have to write that DLL in something else :S