Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Unkillable process

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
Deltron Z
Expert Cheater
Reputation: 1

Joined: 14 Jun 2009
Posts: 164
PostPosted: Tue Aug 04, 2009 3:58 am    Post subject: Unkillable process Reply with quote
Hi everybody, I haven't visited cheat engine forums for about a year now because my account was hacked, but nevermind, now I've got a new account, finally.

I found this source code while searching how to protect my process:
Code:
#include <Windows.h>
#include <stdio.h>

typedef void (__stdcall *RtlSetProcessIsCritical)(BOOL NewValue, BOOL* OldValue, BOOL IsWinlogon);

BOOL EnablePrivileges(TCHAR* lpszPriv)
{
    HANDLE hToken;
    LUID luid;
    TOKEN_PRIVILEGES TokenPrivileges;
    ZeroMemory(&TokenPrivileges, sizeof(TokenPrivileges));
   
   if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
      return FALSE;
   
    if (!LookupPrivilegeValue(NULL, lpszPriv, &luid))
   {
        CloseHandle(hToken);
      return FALSE;
    }
   
    TokenPrivileges.PrivilegeCount = 1;
    TokenPrivileges.Privileges[0].Luid = luid;
    TokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
   
    BOOL bRet = AdjustTokenPrivileges(hToken, FALSE, &TokenPrivileges, sizeof(TokenPrivileges), NULL, NULL);
    CloseHandle(hToken);
    return bRet;
}

BOOL ProtectProcess(BOOL isCritical)
{
   HINSTANCE hDLL;
   static RtlSetProcessIsCritical fSetCritical = NULL;
   
   hDLL = LoadLibraryA("ntdll.dll");
   if (hDLL != NULL)
   {
      if (!EnablePrivileges(SE_DEBUG_NAME))
         return FALSE;

      if (!fSetCritical)
      {
         fSetCritical = (RtlSetProcessIsCritical)GetProcAddress(hDLL, "RtlSetProcessIsCritical");

         if (!fSetCritical)
            return FALSE;
      }
      
      fSetCritical(isCritical, FALSE, FALSE);
      return TRUE;
   }
   
   return FALSE;
}

int main()
{
   printf("Protecting process...\n");
   printf("Process protection has %s!\n", (ProtectProcess(TRUE) ? "succeeded" : "failed"));
   getchar();
   printf("Unprotecting process...\n");
   printf("Process protection has %s!\n", (ProtectProcess(FALSE) ? "succeeded" : "failed"));
   getchar();

   return 0;
}

EnablePrivileges succeeds but the problem is that I get an error (the value of ESP was not properly saved) and then my computer crashes.
I opened this program in OllyDBG and followed RtlSetProcessIsCritical and found out it doesn't pop out the parameters (it uses RET instead of RET 0C), so I added 0x0C to ESP and I got no error, but when I tried terminating the process I crashed again, that's probably why I crashed after closing that error before.

I guess I can fix the parameters by declaring the function like this:
Code:
typedef void (__stdcall *RtlSetProcessIsCritical)(...);

then the compiler will generate add esp, 0x0C automatically.
The problem is finding out what's the problem in kernel mode, since I never touched anything related, drivers, kernel-mode debuggers or anything...

Are there other ways of protecting my process through user-mode?
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 475

Joined: 09 May 2003
Posts: 25976
Location: The netherlands
PostPosted: Tue Aug 04, 2009 8:18 am    Post subject: Reply with quote
RtlSetProcessIsCritical does what it is supposed to do
If a critical process is terminated, the system itself must terminate as well. Usually using a bsod

And protecting your process in another way not sure without using hooks
_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Deltron Z
Expert Cheater
Reputation: 1

Joined: 14 Jun 2009
Posts: 164
PostPosted: Tue Aug 04, 2009 10:16 am    Post subject: Reply with quote
Oh, I thought it just makes TerminateProcess (or anything) return an error, like in task manager when trying to terminate a system process it shows a message box.

I think I'll start learning about drivers and low-level hooks, recommand any tutorials about drivers?

Thanks.
Back to top
View user's profile Send private message
Anden100
Grandmaster Cheater
Reputation: 0

Joined: 20 Apr 2007
Posts: 668
PostPosted: Tue Aug 04, 2009 11:55 am    Post subject: Reply with quote
Deltron Z wrote:
Oh, I thought it just makes TerminateProcess (or anything) return an error, like in task manager when trying to terminate a system process it shows a message box.

I think I'll start learning about drivers and low-level hooks, recommand any tutorials about drivers?

Thanks.


Here is a hook of NtOpenProcess by the_undead:
http://somebastardstolemyname.wordpress.com/2008/10/04/c-ntopenprocess-hook/

He's blog has a few driver related posts
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites