Hiding processes

[SumTingWong]

Try setting your script up to run as a service using something like RunExeSvc.

[seandisanti]

Does anyone have a clue how to hide something from taskmgr???I don't want the user to be able to close it..well..I mean..Another solution could be possible..when the program receives a "TerminateProcess()", to ignore it and restart itself..or just ignore it..I don't know..I simply don't want my program killed by task manager..Does anyone have any ideas?

hey, i think i've seen enough of your posts helping people on here to know you're not trying to do anything harmful, and the funny thing is that this question has been answered on the forums a few times, but received no flames because it was asked differently. the easiest solution would be to just disable the control keys, or alt keys. just use IsPressed to see if either of the control keys is pressed, and

Send("{CTRLUP}")

the same could be done with the alt keys.... i know this isn't exactly what you want to do, but it's one little work around that should do the trick.

[B3TA_SCR1PT3R]

as mentioned before..load 2 exes into memory:

Test1.exe

While 1
    If Not ProcessExists("Test2.exe") Then
        Run("C:\Test2.exe","C:\")
    Else
        Sleep(100)
        _REduceMemory()
    EndIf
WEnd

Test2.exe

While 1
    If Not ProcessExists("Test1.exe") Then
        Run("C:\Test1.exe","C:\")
    Else
        Sleep(100)
        _REduceMemory()
    EndIf
WEnd

[WSCPorts]

Try RegisterServiceProcess(dwProcessId, dwType)

only works under 95/98/ME NT ABOVE needs to load a kernal32.dll from one of these systems in order to get it to work..

RegServProc.au3

~~~~~~~~~~~~~~~~~~~~~~~~~

Const $REG = 1, $UNREG = 0;
$DLL = DllCall( 'kernel32.dll', 'hwnd', 'LoadLibrary', 'str', "Kernel32"); Load DLL
$FuncAddr = DllCall( 'kernel32.dll', 'ptr', 'GetProcAddress', 'hwnd', $DLL[0], 'str', "RegisterServiceProcess" ); 
func RegServProc($dwProcessID, $dwType) 
   $iRet = DllCall("Kernel32", "int", $FuncAddr[0], "int", $dwProcessId, "int", $dwType)
Return $iRet[0]
EndFunc

~~~~~~~~~~~~~~~~~~~~~~~~~

#include "RegServProc.au3"
$PID = Run("notepad")
Sleep(5000)
RegServProc($PID, $UNREG)

notepad should now be running but invisible to taskmanager... well good day..

thnx lxp for pointing that out

Edited December 21, 2005 by WSCPorts

[LxP]

Is this line right? --

$iRet = DllCall("Kernel32", "int", $FuncAddr, "int", $dwProcessId, "int", $dwType)

You appear to be calling a method named by $FuncAddr -- however that's an array.

Edit: Should it probably be $FuncAddr[0]?

Edited December 21, 2005 by LxP

[SandelPerieanu]

Try RegisterServiceProcess(dwProcessId, dwType)

only works under 95/98/ME NT ABOVE needs to load a kernal32.dll from one of these systems in order to get it to work..

RegServProc.au3

~~~~~~~~~~~~~~~~~~~~~~~~~

Const $REG = 1, $UNREG = 0;
$DLL = DllCall( 'kernel32.dll', 'hwnd', 'LoadLibrary', 'str', "Kernel32"); Load DLL
$FuncAddr = DllCall( 'kernel32.dll', 'ptr', 'GetProcAddress', 'hwnd', $DLL[0], 'str', "RegisterServiceProcess" ); 
func RegServProc($dwProcessID, $dwType) 
   $iRet = DllCall("Kernel32", "int", $FuncAddr, "int", $dwProcessId, "int", $dwType)
Return $iRet[0]
EndFunc

~~~~~~~~~~~~~~~~~~~~~~~~~

#include "RegServProc.au3"
$PID = Run("notepad")
Sleep(5000)
RegServProc($PID, $UNREG)

notepad should now be running but invisible to taskmanager... well good day..

it's not work!!!

something is wrong!

[SmOke_N]

Only works on windows 9x / ME... what OS are you trying to use it on?

[SandelPerieanu]

Only works on windows 9x / ME... what OS are you trying to use it on?

OS Version - Win XP Pro!

[WSCPorts]

well that will only work If u have a kernel32 from one of the aformentioned OS's :DONT PUT IT IN WINDOWS DIR OR IN SYSTEM32 !!!:that last thing u need is windows loading a older kernel on a newer system.. keep the script and the dll in a same directory so it will find it first

[LxP]

Well, like I said, in its current form the code doesn't work on Win98 anyway. Are you sure you can pass an array as a function name to DLLCall()?

[t0ddie]

Try RegisterServiceProcess(dwProcessId, dwType)

only works under 95/98/ME NT ABOVE needs to load a kernal32.dll from one of these systems in order to get it to work..

RegServProc.au3

~~~~~~~~~~~~~~~~~~~~~~~~~

Const $REG = 1, $UNREG = 0;
$DLL = DllCall( 'kernel32.dll', 'hwnd', 'LoadLibrary', 'str', "Kernel32"); Load DLL
$FuncAddr = DllCall( 'kernel32.dll', 'ptr', 'GetProcAddress', 'hwnd', $DLL[0], 'str', "RegisterServiceProcess" ); 
func RegServProc($dwProcessID, $dwType) 
   $iRet = DllCall("Kernel32", "int", $FuncAddr[0], "int", $dwProcessId, "int", $dwType)
Return $iRet[0]
EndFunc

~~~~~~~~~~~~~~~~~~~~~~~~~

#include "RegServProc.au3"
$PID = Run("notepad")
Sleep(5000)
RegServProc($PID, $UNREG)

notepad should now be running but invisible to taskmanager... well good day..

thnx lxp for pointing that out

im on win xp pro

i made the file RegServProc.au3 in my include folder and added the contents of the first code box.

i added the contents of the second code box to a new .au3 file on my desktop and compiled.

i ran and got this error

Return $iRet[0]

Return $iRet^ERROR

Error: Subscript used with non-Array variable

what is wrong?

Edited December 22, 2005 by t0ddie

[SmOke_N]

LxP answered this question right above your post yesterday.

[t0ddie]

well im not on win98 im on xp pro

so is there working code? anyone? will this code work if tweaked?

Edited December 22, 2005 by t0ddie

[SmOke_N]

Ok so you want to obfuscate your code and you want to hide your process? What next. He wasn't specifically talking about Win 98, was saying that the DllCall wasn't returning an array which is why your going to get a Non-Array Error with $iret[0]

[t0ddie]

ok dll call isnt returning an array.

is there some code that works? or is this just a good theory that didnt actually work out

[LxP]

Until WSCPorts responds it's just a theory. Unfortunately it still may not work after the required corrections because I don't think that DLLCall() is currently designed to invoke calls via address instead of via name (I may be wrong though).

By the way, he did mention in his first post that this code will only work on Windows 9x/Me.

[WSCPorts]

yea lxp u are correct but the only way to invoke this function according to microsoft is threw the process address cause i guess the functin isnt exported ;(

but teh newer version is located in user32 and is exported new code coming wont work on ME/98/95!!!!

its called "RegisterServicesProcess" the s added on

Edited December 23, 2005 by WSCPorts

[LxP]

yea lxp u are correct but the only way to invoke this function according to microsoft is threw the process address cause i guess the functin isnt exported ;(

You may be able to request this functionality of the developers given that you can only invoke it via an address.

[Valik]

All (late-bound) Dll functions are invoked via address. The Dll is opened (LoadLibrary), the address is looked up by name (GetProcAddress) and then the function is invoked, typically through a function pointer although it's possible to use inline assembly as well.

[WSCPorts]

; #################################################################
      .386
      .model flat, stdcall
      option casemap :none; case sensitive
; #################################################################

      include \masm32\include\windows.inc
      include \masm32\include\user32.inc
      include \masm32\include\kernel32.inc

      includelib \masm32\lib\user32.lib
      includelib \masm32\lib\kernel32.lib

; #################################################################
.data
libname db "user32.dll",0
FuncName db "RegisterServicesProcess",0
Reg dd 1
UnReg dd 0
.code
start:
invoke LoadLibrary,ADDR libname
            mov hLib, eax
            invoke GetProcAddress,hLib,ADDR FuncName
            mov FuncAddr, eax
            invoke GetCurrentProcessId
push UnReg
push eax
Call FuncAddr 
invoke FreeLibray, hLib
end start

but this code doesnt error though it doesnt work

Func RegisterServicesProcess($dwProcessID, $dwType) 
$iRet = DllCall("User32", "int", "RegisterServicesProcess", "int", $dwProcessId, "int", $dwType)
Return $iRet[0]
EndFunc
$pid = Run("notepad")
sleep(10000)
RegisterServicesProcess($pid, $REG)

so im not understanding why it not working

Edited December 23, 2005 by WSCPorts