Re: Using the DDK.

Tech-Archive recommends: Fix windows errors by optimizing your registry

I told you what I am “really” trying to do.

I have read up on protections that certain software use to hide themselves
from process enumeration.
They are able to access the PEPROCESS structure and change the linked-list
pointers to omit themselves, so when the list is enumerated, they do not
appear, even to debuggers.

My current project may not REQUIRE this type of protection, since it is just
my own toy, and no one is going to try to hack it (probably), but that isn’t
the point.

I have an interest in software security and I wish to attempt this method of
hiding my process, specifically so I know I can do it.

I know the PEPROCESS is not documented and changes often, which is why I am
going to have an external file the driver can read which will give it the
offsets of the things it needs to change, so with new versions of Windows®
(or service packs), the user will be able to update this information and not
worry about it crashing.


It is really very simple, and I only need use of this one function, or
possible others if there turns out to be a need for them.

But how do I make a driver then, if a regular .dll will not cut it?


L. Spiro
.

Relevant Pages

  • Re: Using the DDK.
    ... > I have read up on protections that certain software use to hide ... > from process enumeration. ... > They are able to access the PEPROCESS structure and change the ... Berlin, Germany ...
    (microsoft.public.development.device.drivers)
  • Re: nve related LOR triggered by lots of small packets, and a hard hang
    ... The new nfehas several protections for watchdog timeout errors ... reported on the driver. ... adding the same to loader.conf did not help with the PXE boot. ...
    (freebsd-current)