Detours: Prevent task kill of my software via another software

Question

I have found a code that promises to intercept and detour calls to the TerminateProcess function and thus prevent my software from being killed directly from other program.

But this code is not working and I am still able to kill my process via other program.

Here is the last my attempt with a code I have found in this YouTube video:

PS: victim.exe is the killer program.

DLL

// DllRedirectAPI.cpp : Defines the exported functions for the DLL application.
//

#include "stdafx.h"
#include <Windows.h>

BYTE MOV[10] = { 0x48, 0xB8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }; 
BYTE JMP_RAX[2] = { 0xFF, 0xE0 }; 
#define BuffSizeX64 (sizeof(MOV) + sizeof(JMP_RAX))

BOOL Hook_Det_x64(char LibName[], char API_Name[], LPVOID NewFun) {
    DWORD OldProtect;
    DWORD64 OrgAddress = (DWORD64)GetProcAddress(LoadLibraryA(LibName), API_Name);
    if (OrgAddress == NULL) return 0;

    memcpy(&MOV[2], &NewFun, 8);
    VirtualProtect((LPVOID)OrgAddress, BuffSizeX64, PAGE_EXECUTE_READWRITE, &OldProtect);
    memcpy((LPVOID)OrgAddress, MOV, sizeof(MOV));
    memcpy((LPVOID)(OrgAddress + sizeof(MOV)), JMP_RAX, sizeof(JMP_RAX));
    VirtualProtect((LPVOID)OrgAddress, BuffSizeX64, OldProtect, &OldProtect);

    return 1;
}

int WINAPI MessageBoxAX(
    HWND hWnd,
    LPCSTR lpText,
    LPCSTR lpCaption,
    UINT uType) {

    MessageBoxExA(0, "Hooked ...", "Mahmoud", 0, 0);
    return 999;
}

BOOL WINAPI DllMain(HMODULE hModule, DWORD Call_Reason, LPVOID lpReserved) {
    switch (Call_Reason) {
    case DLL_PROCESS_ATTACH:
        Hook_Det_x64("Kernel32.dll", "TerminateProcess", MessageBoxAX);
    }
    return 1;
}

INJECTOR

// Injector.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <windows.h>
#include <tlhelp32.h>
#include <shlwapi.h>
#include <conio.h>
#include <stdio.h>
#include <comdef.h>

#define WIN32_LEAN_AND_MEAN
#define CREATE_THREAD_ACCESS (PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ)


BOOL Inject(DWORD pID, const char * DLL_NAME);
DWORD GetTargetThreadIDFromProcName(const char * ProcName);

int main(int argc, char * argv[])
{
    //###############  CHANGE HERE ONLY   ###################
    char *Target_Process = "victim.exe"; //###
    //#######################################################



    char *buf;
    DWORD pID = GetTargetThreadIDFromProcName(Target_Process);
    buf = "DllRedirectAPI.dll";

    if (!Inject(pID, buf))
    {

        printf("DLL Not Loaded!");
    }
    else{
        printf("DLL is Injected in torget Process");
    }

    _getch();
    return 0;
}

BOOL Inject(DWORD pID, const char * DLL_NAME)
{
    HANDLE Proc;
    char buf[50] = { 0 };
    LPVOID RemoteString, LoadLibAddy;

    if (!pID)
        return false;

    Proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);
    if (!Proc)
    {
        sprintf_s(buf, "OpenProcess() failed: %d", GetLastError());
        printf(buf);
        return false;
    }

    LoadLibAddy = (LPVOID)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryA");

    RemoteString = (LPVOID)VirtualAllocEx(Proc, NULL, strlen(DLL_NAME), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

    WriteProcessMemory(Proc, (LPVOID)RemoteString, DLL_NAME, strlen(DLL_NAME), NULL);

    CreateRemoteThread(Proc, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, NULL, NULL);

    CloseHandle(Proc);
    return true;
}

DWORD GetTargetThreadIDFromProcName(const char * ProcName)
{
    PROCESSENTRY32 pe;
    HANDLE thSnapShot;
    BOOL retval, ProcFound = false;

    thSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (thSnapShot == INVALID_HANDLE_VALUE)
    {
        printf("Error: Unable create toolhelp snapshot!");
        return false;
    }

    pe.dwSize = sizeof(PROCESSENTRY32);

    retval = Process32First(thSnapShot, &pe);
    while (retval)
    {
        if (_bstr_t(pe.szExeFile) == _bstr_t(ProcName))
        {
            return pe.th32ProcessID;
        }
        retval = Process32Next(thSnapShot, &pe);
    }
    return 0;
}

Can someone help me, telling me where I'm making a mistake?

My system is Windows 7 Ultimate 64 Bits.

Thanks in advance.

Answer 1

(Wanted to write a comment, but it got quite long...)

As @AndrewMedico says in the comment: You need to hook the TerminateProcess of the Task Manager process to prevent the Task Manager from terminating anything.

---

I suggest you the following approach:

1. Try a simple DLL injection

   a/ Make a DLL which prints some text in its DllMain, e.g. printf("I am here\n"); fflush(stdout);

   b/ Try to inject it into some other command line process using the process hacker's Miscellaneous>Inject DLL...

   c/ Verify your DLL was executed inside the target process by checking it's standard output

2. Try a simple API hook:

   a/ Make a command line application which waits for a key and then terminates itself using some variant of TerminateProcess(GetCurrentProcess(), 1);. Add code to print some text after the TerminateProcess call.

   b/ Run this application to verify the text after calling the TerminateProcess is not printed.

   c/ Hook the TerminateProcess before waiting for the key using, e.g. mhook. Print some text in the replacement function and then return. Do not call the original TerminateProcess here.

   d/ Run this application to verify the text inside the hook is printed and the text after the TerminateProcess call is printed as well (i.e. verify the process termination was suppressed).

3. Combine the results of previous steps to reach your goal:

   a/ Put the hooking code from from step 2 into the DLL from step 1

   b/ Inject it into the application from step 2b (i.e. the one without the hook) while it is waiting for the key and verify the text after TerminateProcess is printed.

   c/ Enjoy (or debug/blame me)

Good luck!

---

EDIT>

OK, here is my view of what we have here:

1. Code in the question:

   • (Is an application very similar to what I suggest in "2b")

   • Hooks the TerminateProcess and shows a message box instead.

   • Should display a message box when executed

   • (Looks like it is a 32-bit only version)

2. YouTube video

   • Shows an application "Terminate process.exe" which terminates process given by name

   • After the "Injector.exe" is executed the application ceases to terminate the process and displays a message box instead (IMHO the "Injector.exe" injects a "DllFile.dll" into the running "Terminate process.exe")

3. Source code for the injector in the YouTube comments

   • This code injects DLL "C:\DllRedirectAPI.dll" into the first process with name "victim.exe" it finds

   • (It does not inject into "Terminate process.exe", it does not use "DllFile.dll")

4. Source code for the DLL in the YouTube comments

   • This code hooks function MessageBoxA that it shows a different message box instead. It is worth noting that the hook code itself calls the original MessageBoxA and takes the approach that it reverts the modification it did during the hooking, calls the original function and then re-applies the hook.

   • (It does not hook 'TerminateProcess' at all)

   • (Looks like it is a 32-bit only version)

5. 64-bit version excerpts

   • Destructive hook of MessageBoxA (i.e. does not backup the original code)

   • The hook uses MessageBoxExA (which is intact) to display a different message box instead (i.e. it does not use the overwritten MessageBoxA)

   • (It does not hook 'TerminateProcess' at all)

   • (It is a 64-bit version)

Disclaimer: I am not that proficient with the topic to be 100% sure, feel free to correct/clarify me.

---

For the actual hooking I personally recommend to use the mhook library, which worked for me. It's documentation is worth reading as well.

See e.g. this for some alternatives (I have not tried any of them)...

---

EDIT>

This one works for me on Win XP inside VirtualBox:

#include <windows.h>
#include <stdio.h>
#include <mhook.h>

static BOOL WINAPI
(*_TerminateProcess)(
  _In_ HANDLE hProcess,
  _In_ UINT   uExitCode
) = NULL;

BOOL WINAPI
TerminateProcessImpl(
  _In_ HANDLE hProcess,
  _In_ UINT   uExitCode) {

    printf("\nBlocked\n"); fflush(stdout);
    return 0;
}

BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD Reason, LPVOID Reserved) {
    if(Reason==DLL_PROCESS_ATTACH) {
        printf("\nDLL attached!\n"); fflush(stdout);
        HMODULE h = LoadLibrary("Kernel32");
        if(h!=NULL) {
            printf("\nGot Kernel32!\n"); fflush(stdout);
            _TerminateProcess=(void*)GetProcAddress(h,"TerminateProcess");
            if(_TerminateProcess!=NULL) {
                printf("\nAbout to hook...\n"); fflush(stdout);
                if(Mhook_SetHook((void*)&_TerminateProcess, &TerminateProcessImpl)) {
                    printf("\nHooked OK!\n"); fflush(stdout);
                } else {
                    printf("\nHook failed!\n"); fflush(stdout);
                }
            }
        }
    }
    return TRUE;
}