search

bytecode77 / r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.
https://bytecode77.com/r77-rootkit
BSD 2-Clause "Simplified" License
1.59k stars 389 forks source link

Enhance:Can you add a function to hide GPU use #7

Closed echotxl closed 9 months ago

echotxl commented 3 years ago

thanks bud,this software is owesome! Can you add a function to hide GPU use,this is so good .thanks

bytecode77 commented 3 years ago

Just wanted to let you know, since I haven't yet responded for a long time...

I consider this feature to be useful and I've already analyzed what API's to hook in order to manipulate the GPU statistics. For now, it's on the ToDo list, as I think this feature is a useful addition. However, I'm currently working on the next version of PEunion and at the moment I only fix bugs in r77 until I have more time to work on features again.

uakbr commented 2 years ago

Hi, would you be able to point me in the right direction in terms of learning material to perhaps help out with such a feature? I am fascinated by your work, and I would like to help in this area. Any books, blogs, or academia you could guide me towards would be lovely.

Thanks!

bytecode77 commented 2 years ago

Thanks @uakbr :) In terms of Learning, I can recommend "The Rootkit Arsenal", it's a good book on rootkits that also provide some hands on examples. There's also a lot of stuff online, however a lot of code posted online is not entirely correct, or it may just be outdated. For example, the NSI_PARAM struct for the TCPView hiding was mostly documented incorrectly, so I had to reverse engineer myself in order to figure out that struct and what each field means.

In this particular issue you posted in, @echotxl suggested a feature to hide GPU usage. However, it's a long process to figure out what particular API calls are responsible and then filter them correctly. So, expect that any new feature will require a lot of work. The only features that were quickly implemented were file & process hiding, because those are already well documented.

SourCandy80 commented 1 year ago

@bytecode77 No issues. But wow you are an insane programmer. It seems google is trying to hide all of the good backdoors/rootkits on the internet, as I only found this one when trying to get PEUnion (Got curious and went to your site)

This is highly beneficial though, as when searched, barely anything comes up about r77 rootkit.

Again. Insane programmer. I wish you luck on your future projects

PS: God it is going to be annoying for me to figure out how to make this work over network lol.

bytecode77 commented 11 months ago

@KRAFMA you should open another issue instead of posting into an unrelated one. Imagine that several topics are being discussed in one thread.

For a moment I was hoping that somebody figured out how to hide GPU utilization, because honestly, I haven't. But in case anyone has, please feel free to create a pull request or send me a PoC, etc. Because this would be a nice feature to have.

bytecode77 commented 9 months ago

In Version 1.5.1 GPU usage is hidden

I know that this issue was created 2,5 years ago. I, too, had this task on my ToDo list, but I couldn't figure it out. Something that simple may well require weeks of reverse engineering.

Now I have finally figured out what API's are responsible in providing GPU usage performance counters. Although the creator of this issue may no longer care, this feature is useful and finally implemented.