Skip to content

Process Operations

Jump to bottom
Ido Veltzman edited this page Jan 14, 2024 · 7 revisions

Process Protection

Protecting processes from killing and dumping using PsProcessType obcallback that runs every time a handle to a process is requested. This feature is not enabled when the driver is loaded reflectively.

Function Signature

OB_PREOP_CALLBACK_STATUS OnPreOpenProcess(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION Info)

RegistrationContext [PVOID]			    -- Unused.
Info		    [POB_PRE_OPERATION_INFORMATION] -- Contains important information such as process name, handle to the process, process type, etc.

Usage Example

# Protect process
NidhoggClient.exe process add <PID>

# Unprotect process
NidhoggClient.exe process remove <PID>

How It Works

The function begins by checking if the operation is a kernel handle operation. If it is, it returns OB_PREOP_SUCCESS.

Next, it checks if there are any protected processes. If there are none, it returns OB_PREOP_SUCCESS.

The function then gets the process ID of the process object in the Info structure.

It checks if the process ID is in the list of protected processes. If it is, it removes the following permissions from the process:

  • PROCESS_VM_OPERATION: The ability to perform virtual memory operations.
  • PROCESS_VM_READ: The ability to read from the process's virtual memory.
  • PROCESS_CREATE_THREAD: The ability to create a new thread in the process.
  • PROCESS_DUP_HANDLE: The ability to duplicate the process's handles.
  • PROCESS_TERMINATE: The ability to terminate the process. Finally, it returns OB_PREOP_SUCCESS.

Process Hiding

Hiding processes by removing the entry from from the process links list. This operation is not PatchGuard safe.

Function Signature

NTSTATUS ProcessUtils::HideProcess(ULONG pid)

pid [ULONG] -- PID to hide.

Usage Example

# Hiding process
NidhoggClient.exe process hide <PID>

# Unhiding process
NidhoggClient.exe process unhide <PID>

How It Works

The function begins by getting the offsets of the ActiveProcessLinks and ProcessLock in the EPROCESS structure. If either of these operations fail, it returns STATUS_UNSUCCESSFUL.

Next, it looks up the process by the provided PID. If this operation fails, it returns the status of the operation.

The function then gets the list entry of the process in the process list and the lock of the process list.

It acquires the process list lock to avoid accessing problems.

The function then adds the process to the list of hidden processes. If this operation fails, it releases the process list lock, dereferences the process object, and returns STATUS_UNSUCCESSFUL.

The function then removes the process from the process list, releases the process list lock, and dereferences the process object.

Finally, it returns the status of the operation. If the operation was successful, it means that the process was successfully hidden. If the status is STATUS_UNSUCCESSFUL, it means that the process was not hidden.

Clone this wiki locally