Hide Debugger fails to provide protection against Terminate Process

[mcnorth]

I'm using the Hide Debugger plugin and set it to protect against TerminateProcess. Still, it terminates. Is there another way to protect against this?

Thanks.

[Ricardo Narvaja]

the terminate process protection don´t work in XP sp2, only sp1.

Ricardo

[Asterix]

I'll correct it in the future version

[1bitshort]

hmm, there are lots of ways to terminate processes under windows:
http://www.diamondcs.com.au/freeutilities/apt-techniques.php

[mcnorth]

Ricardo: Good to know. thanks for sharing it.

Asterix: I'll be looking for it. Do you have the future version in the works?

1bitshort: Thanks for the link. So if I identify which method is being used should I be able to patch to prevent it?

[1bitshort]

yep. usually it's just TerminateProcess, but not always... might even be just sending window messages like WM_CLOSE/SC_CLOSE

[dm47]

can some1 post a link for hide debugger?
none of them ever work