cobraTM

make process anti kill c#

Oct 26th, 2016
48
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C# 2.07 KB | None | 0 0
  1. //imports
  2. using System.Collections.Generic;
  3. using System.Runtime.InteropServices;
  4. using System.Security.AccessControl;
  5. using System.ComponentModel;
  6. using System.Security.Principal;
  7. ////////////////////////////////////
  8. [DllImport("advapi32.dll", SetLastError = true)]
  9.         static extern bool GetKernelObjectSecurity(IntPtr Handle, int securityInformation, [Out] byte[] pSecurityDescriptor,
  10.         uint nLength, out uint lpnLengthNeeded);
  11.         [DllImport("advapi32.dll", SetLastError = true)]
  12.         static extern bool SetKernelObjectSecurity(IntPtr Handle, int securityInformation, [In] byte[] pSecurityDescriptor);
  13.         [DllImport("kernel32.dll")]
  14.         static extern IntPtr GetCurrentProcess();
  15.          RawSecurityDescriptor GetProcessSecurityDescriptor(IntPtr processHandle)
  16.         {
  17.             byte[] psd = new byte[0];
  18.             uint bufSizeNeeded;
  19.             GetKernelObjectSecurity(processHandle, 0x00000004, psd, 0, out bufSizeNeeded);
  20.             if (bufSizeNeeded < 0 || bufSizeNeeded > short.MaxValue)
  21.                 throw new Win32Exception();
  22.             if (!GetKernelObjectSecurity(processHandle, 0x00000004,
  23.             psd = new byte[bufSizeNeeded], bufSizeNeeded, out bufSizeNeeded))
  24.                 throw new Win32Exception();
  25.             return new RawSecurityDescriptor(psd, 0);
  26.         }
  27.         void SetProcessSecurityDescriptor(IntPtr processHandle, RawSecurityDescriptor dacl)
  28.         {
  29.             byte[] rawsd = new byte[dacl.BinaryLength];
  30.             dacl.GetBinaryForm(rawsd, 0);
  31.             if (!SetKernelObjectSecurity(processHandle, 0x00000004, rawsd))
  32.                 throw new Win32Exception();
  33.         }
  34.  
  35.  
  36. //using
  37.  //put this code in main entrypoint
  38.  
  39. IntPtr hProcess = GetCurrentProcess();
  40.             var dacl = GetProcessSecurityDescriptor(hProcess);
  41.             dacl.DiscretionaryAcl.InsertAce(0, new CommonAce(AceFlags.None, AceQualifier.AccessDenied, (int)(0x000f0000 | 0x00100000 | 0xFFF), new SecurityIdentifier(WellKnownSidType.WorldSid, null), false, null));
  42.             SetProcessSecurityDescriptor(hProcess, dacl);
Add Comment
Please, Sign In to add comment