Recompile r77 with PROCESS_EXCLUSIONS

bytecode77 / r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

https://bytecode77.com/r77-rootkit

BSD 2-Clause "Simplified" License

1.55k stars 382 forks source link

Recompile r77 with PROCESS_EXCLUSIONS #45

Closed joy300loy300 closed 10 months ago

joy300loy300 commented 11 months ago

Hi, please tell me how I can compile r77 again with the constants, I need the injections not to affect explorer.exe and bash.exe . Which programs or commands are needed for compilation and how can I do it in general (step by step, im beginner)? thank you very much for your help

bytecode77 commented 11 months ago

You need to install Visual Studio 2022 Community Edition. Then you can open the solution file, select Release, not Debug mode and Rebuild Solution.

joy300loy300 commented 11 months ago

Is this the correct code? I can't find any examples of correct const format for ProcessExclusions in GlobalAssemblyInfo.

bytecode77 commented 11 months ago

GlobalAssemblyInfo does not need the process exclusion list. The change in r77def.h is sufficient.