81 Commits

Author	SHA1	Message	Date
JKornev	331952e7fc	Improved looking for EPROCESS::ActiveProcessLinks algo	2021-08-28 02:11:47 +03:00
JKornev	59439bae79	Added a test that validates hiding processes	2021-08-25 02:10:52 +03:00
JKornev	f47f5439da	Fixed an issue where Zydis breaks a project language determination algo on github	2021-08-24 23:55:28 +03:00
JKornev	5a678ce3c4	Fixed a bug with a process initialization flag in PsMonitor	2021-08-24 23:27:25 +03:00
JKornev	536a3ec3e8	Hiding a process from PspCidTable on Windows Vista and 7	2021-08-24 03:51:43 +03:00
JKornev	0c01afa4e1	Improved hiding from PspCidTable, works for new processes (win 8+)	2021-08-23 02:31:47 +03:00
JKornev	42644b71f5	The first working implementation of the hiding PspCidTable stuff (Win8+)	2021-08-21 23:22:51 +03:00
JKornev	1b76e90ada	Optimized process table access	2021-08-15 03:18:53 +03:00
JKornev	328b318794	Added a kernel analyzer module that looks for non-exported objects in the ntoskrnl	2021-08-12 01:42:32 +03:00
JKornev	0f7caba5fe	A small refactoring in a driver source structure	2021-08-11 23:48:11 +03:00
JKornev	69ac0d0aaf	Added Zydis disassembler to a driver	2021-08-11 03:40:08 +03:00
JKornev	1424bee8ee	Added a test for a process hiding	2021-07-31 02:56:13 +03:00
JKornev	206258a6fe	Added a cache to routine that looks for ActiveProcessLinks offset	2021-07-30 22:44:57 +03:00
JKornev	9e89ad1da0	Added an ability to configure hiding processes over a registry	2021-07-30 13:37:41 +03:00
JKornev	a2e5e8e901	Process table optimization for hidden processes	2021-07-30 03:08:33 +03:00
JKornev	2ec973a008	Improvements for /query request	2021-07-29 16:53:39 +03:00
JKornev	9d3db08314	Implemented /unhide support for processes	2021-07-29 03:27:09 +03:00
JKornev	0628ceb520	Fix for reference leak and output in a driver	2021-07-29 01:00:45 +03:00
JKornev	3f5350a750	Kernel mode hiding process implementation	2021-07-28 22:30:35 +03:00
JKornev	8a9f37e8f2	Kernel level configuration for hidden processes	2021-07-25 23:15:32 +03:00
JKornev	9767366010	Added a usermode interface for hiding processes	2021-07-25 21:37:27 +03:00
JKornev	1e965bbe2d	Different small fixed	2021-07-24 15:31:02 +03:00
JKornev	7e1d00c2dd	Fixed compilation errors on x64 arch	2021-07-05 01:30:25 +03:00
JKornev	8d6a72c644	Updated to WDK 10 and Windows 10 SDK	2021-01-21 02:48:11 +03:00
JKornev	c2ac4b3d61	Registry filter fix	2019-06-09 23:26:37 +03:00
Jora Kornev	8e4dd95562	Update PsMonitor.c ... Fix for log output (thx to hsheep)	2019-04-19 12:08:50 +03:00
JKornev	7ad8dcaad3	Windows 10 path normalization fix	2018-12-20 02:54:26 +03:00
JKornev	0e9e814c28	Threads protection fix	2018-12-20 02:53:44 +03:00
JKornev	01bba71d6d	Logging improvements	2018-12-03 00:57:11 +03:00
Jora Kornev	8494048e63	Update PsTable.c	2017-10-04 11:32:51 +03:00
LEON	3dcbc53707	Err VS2015: Redeclaration proc info size ... Hello! Redeclaration in process information length (SIZE_T size) make troubles with building solution on VS2015, commenting trouble line - make compilation project great again :) Thank you for attention, with best regards.	2017-10-03 22:03:56 +03:00
JKornev	8e2e30d069	Removed unused project settings	2017-06-02 21:02:21 +03:00
JKornev	5b3cf5932f	Improved support of the HKLM\System\CurrentControlSet tree	2017-04-02 03:08:16 +03:00
JKornev	aed77ac670	Hardcoded exclusion for the system process	2017-02-18 16:39:47 +03:00
JKornev	d2af2c51e0	Fixes for Code Analysis artifacts	2017-02-03 01:56:00 +03:00
JKornev	da777eb050	Memory leak fixes #3 (Verifier tests)	2017-01-31 23:03:37 +03:00
JKornev	1db58b922c	Memory leak fixes #2 (Verifier tests)	2017-01-30 22:41:24 +03:00
JKornev	ca63ce3d31	Memory leak fixes (Verifier tests)	2017-01-29 18:43:42 +03:00
JKornev	c3705478b1	Stealth mode first steps	2016-12-30 19:57:54 +03:00
JKornev	fbae5ffa57	Fix for possible IRQL violations	2016-12-29 22:49:07 +03:00
JKornev	67355c72c4	Fix for BSOD and vmware.conf	2016-12-28 00:31:03 +03:00
JKornev	8a9ba43e23	Added valid error codes	2016-12-27 00:52:30 +03:00
JKornev	32f2da5145	Fix for status output	2016-12-27 00:33:22 +03:00
JKornev	1b643e5e84	Configs installation to registry	2016-12-25 23:57:05 +03:00
JKornev	432a731aac	hiddencli supports install\uninstall stuff	2016-12-23 23:31:31 +03:00
JKornev	4f3e364d72	/install and /uninstall commands	2016-12-23 03:05:34 +03:00
JKornev	93ea859610	Load configs improvements	2016-12-22 00:05:40 +03:00
JKornev	f24aca20ec	Comments update	2016-12-21 23:44:44 +03:00
JKornev	79cec65cf2	Driver loads configs from registry	2016-12-18 21:12:42 +03:00
JKornev	7c522d760f	Added new cli mode /multi	2016-12-15 02:30:31 +03:00