MCPcopy Create free account
hub / github.com/bytecode77/r77-rootkit / Unhide

Method Unhide

TestConsole/Helper/ProcessList.cs:287–319  ·  view source on GitHub ↗

Removes a process ID from the r77 configuration system to make the process visible again. The process to unhide. , if this process was successfully marked as visible; otherwise, .

(ProcessModel process)

Source from the content-addressed store, hash-verified

285 /// otherwise, <see langword="false" />.
286 /// </returns>
287 public static async Task<bool> Unhide(ProcessModel process)
288 {
289 return await Task.Run(() =>
290 {
291 using RegistryKey? configKey = ConfigSystem.GetConfigSystemKey();
292 using RegistryKey? key = configKey?.OpenSubKey("pid", true);
293
294 if (key == null)
295 {
296 return false;
297 }
298
299 string[] valueNames = key
300 .GetValueNames()
301 .Where(name => key.GetInt32Value(name) == process.Id)
302 .ToArray();
303
304 if (valueNames.Any())
305 {
306 foreach (string valueName in valueNames)
307 {
308 key.DeleteValue(valueName);
309 }
310
311 Log.Information(
312 new LogFileItem(process.Name),
313 new LogTextItem($"(PID {process.Id}) is marked as not hidden.")
314 );
315 }
316
317 return true;
318 });
319 }
320
321 private static int GetInjectedCount()
322 {

Callers 1

UnhideCommand_ExecuteMethod · 0.80

Calls 2

GetConfigSystemKeyMethod · 0.80
InformationMethod · 0.80

Tested by

no test coverage detected