search

ryan-weil / HideProcessHook

DLL that hooks the NtQuerySystemInformation API and hides a process name
281 stars 48 forks source link

Cannot hide on Process hacker tool,... #4

Open letuan1206 opened 1 year ago

letuan1206 commented 1 year ago

Hi, I'm testing this project. I tested its work on Task Manager. But when I check in another tool (Process hacker) I still see it on the process list. It cannot hide

ryan-weil commented 1 year ago

Hello,

The reason that is happening is likely because the process has a mitigation policy set. That was at least the case for me when I tried against System Informer (Process Hacker). See here for more info: https://m417z.com/Implementing-Global-Injection-and-Hooking-in-Windows/

I can try to add an update to get around this issue.

letuan1206 commented 1 year ago

Hi Ryan, I just rechecked your project. Currently, there are a few applications that are still not displayed. For example, for Cheat Engine, I tested successfully on the Process List tab, but when I switched to the Windows view tab, I still saw it displayed. A few other applications are similar. I have uploaded a test video. It would be great if you could take a look and fix those issues.

Here is video test: https://youtu.be/TX34pEmsxfA Here is this tool I used on video: https://mega.nz/file/YlwVWQLI#aj1meVXq0Lju9_tr3yYY4XBMqQ902s1w6hVeCQSXcbg

ryan-weil commented 1 year ago

That is because I am not hooking NtUserBuildHwndList which handles the list of windows.