https://github.com/MandConsultingGroup/ring3-kit

Hides Process From Task Manager Using NT API Hooking (NtQuerySystemInformation)
https://github.com/MandConsultingGroup/ring3-kit

hooks-api win32api

Last synced: about 1 month ago
JSON representation

Hides Process From Task Manager Using NT API Hooking (NtQuerySystemInformation)

• Host: GitHub
• URL: https://github.com/MandConsultingGroup/ring3-kit
• Owner: MandConsultingGroup
• License: mit
• Created: 2019-03-20T16:25:48.000Z (over 5 years ago)
• Default Branch: master
• Last Pushed: 2022-12-28T01:07:59.000Z (almost 2 years ago)
• Last Synced: 2024-11-08T20:42:21.329Z (about 1 month ago)
• Topics: hooks-api, win32api
• Language: C++
• Homepage:
• Size: 381 KB
• Stars: 72
• Watchers: 4
• Forks: 19
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-rainmana - MandConsultingGroup/ring3-kit - Hides Process From Task Manager Using NT API Hooking (NtQuerySystemInformation) (C++)

README

        
# ring3-kit

Hides Process From Task Manager Using NT Hooking (NtQuerySystemInformation). A simple Ring-3 (user mode) rootkit. 

## How

- Hook the API function NtQuerySystemInformation() with our own function that hides a process

from task manager

- Hooked function gets called instead

- The DLL is injected into Taskmgr.exe so there is a virtual memory space available to execute our hooked code

## Disclaimer

The developer, Josh Schiavone is not responsible or liable for the misuse of this simple rootkit. Do not deploy this rootkit in association with legitmate malware programs on machines that you have no authorized access to. May God bless you all.