BSOD after hiding processes - Windows compatibility issue?

[wisdeth14]

Hi @ZeroMemoryEx

Could you please help confirm what Windows versions/builds are supported?

I am on Windows 11, Version 23H2, Build 22631.4317, and experience BSOD or shutdown after some period of time (30min to several hours). Upon reboot, I see I have experienced a 0x109 bug (CRITICAL_STRUCTURE_CORRUPTION). I'm trying to assess if there's something wrong with my setup, or if this OS is just not supported.

Btw, assuming successful hide process operations without file corruption, does this project supporting hiding both a process and a child of that process? With brief experimentation, it seems I experience BSOD sooner when hiding child + parents.

Thank you!

[ZeroMemoryEx]

Hello @wisdeth14 ! First off, big thanks for the caffeine boost, i think my bloodstream is now 50% caffeine! 😅☕

So, the BSOD you're seeing is because PatchGuard detected a change in the process list. any modification there gets flagged, and PatchGuard crashes the system (I'll look into this further when I get some time, I have a few ideas to bypass it), in contrast, swapping the driver in memory and on disk doesn’t seem to trigger PatchGuard.

Thanks again for the coffee, If you have any other questions, feel free to ask!

[wisdeth14]

@ZeroMemoryEx Of course!

So as I understand, it has nothing to do with the Windows OS version, and this is expected behavior because PatchGuard will inevitably detect the modification of the process list? I see open-source solutions out there for disabling PatchGuard but those seem risky haha.

So I'll need another solution for hiding processes as I can't afford a system crash/reboot...I see your URootKit repo implements a different strategy but unfortunately I don't think that'll work for me as the process scanner I am trying to avoid will likely reject the DLL injection.

If you have any other ideas let me know, I'll keep my eye on updates to this repo meanwhile. Thanks!

[ZeroMemoryEx]

Hello @wisdeth14 ,

Yes, you’re correct, it has nothing to do with your OS version, and using open-source solutions to disable PatchGuard is indeed risky. they’re either complex to use or Microsoft would likely patch any such exploits.

Regarding URootKit, it works by injecting a DLL into the listing tool and hooking NtQuerySystemInformation to return a modified structure. This same approach can be implemented with a driver by registering a process creation callback whenever a listing tool process is opened. This method doesn't trigger PatchGuard since it only modifies structures inside a user-mode space.

When you mention "the process scanner," could you clarify what you mean? If you're trying to detect it, you can look for kernel objects in the kernel itself. Tools like ObjectExplorer let you do that as they allow you to enumerate all kernel objects, including the hidden ones. This might give you the visibility you need.

[wisdeth14]

Hi @ZeroMemoryEx,

It's kind of an unusual situation...in order to use an online service behind login, I am required to download and run third-party software on my device. This third-party software runs a process scanner application on my computer, it's entirely detectable but if I turn it off I'm unable to use the web service. The goal is to hide other processes running on my machine from this third-party process scanner.

I have previously tried DLL injection upon the executable I am trying to hide, a different third-party software, but this DLL injection seems to be rejected, unlike with other processes I can hide such as Task Manager. I assume they are implementing some form of DLL injection defense. I did use a basic naive approach however, maybe URootKit implements methods to overcome any defense mechanisms?

[ZeroMemoryEx]

Hello @wisdeth14 ,

The solution is simple, don't inject into Task Manager itself, but inject into the target process. However, you'll first need to reverse the software to see if it uses NtQuerySystemInformation or CreateToolhelp32Snapshot to list processes. Once you know this, you can create a DLL to hook and either hide or block these methods. As for the defense mechanism, it’s likely a protected process. You need to verify this, and if it is, you can use any PPL killer technique available to remove the protection before performing the injection.

[wisdeth14]

Hi @ZeroMemoryEx,

Yes understood I need to inject in the target process, upon running into these protections is where I began to give up this approach and look into kernel-level process hiding...

But if there are available open-source solutions that can overcome these protections, I should definitely return to this strategy! By chance any open-source solutions you would recommend? And would you happen to know if these techniques work fairly universally across any protections the process might implement?

Btw - know of any way I can 'verify' it is a protected process? I might have explained my Task Manager example poorly, I had mentioned it demonstrate that could I successfully inject into that process. On the other hand, injection into the target process failed, which led me to believe protections are in place.

Really appreciate this advice!

[ZeroMemoryEx]

Hello @wisdeth14,

You can determine if a process is protected or not using tools like Process Explorer. Here's how:

• Run Process Explorer as an administrator.
• Go to the process you're interested in.
• Right-click the process and choose Properties.
• Under the Security tab, check the Protected field.
• If it says No, the process is not protected.
• otherwise it is protected.

[ZeroMemoryEx]

process explorer

[wisdeth14]

@ZeroMemoryEx Awesome, I will give this strategy another go in the coming days once I get a chance. Thank you for the advice!!

[ZeroMemoryEx]

anytime !!