0% found this document useful (0 votes)
9 views4 pages

API Basics - Hiding Program Using Process Creation Flag

The document discusses the use of process creation flags in Windows to hide programs, detailing various flags such as CREATE_SUSPENDED and CREATE_NO_WINDOW. It includes code examples demonstrating how to create processes like Notepad and CMD in suspended mode and without a window. The document emphasizes the implications of these flags for stealth operations in programming.

Uploaded by

ris erdi
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
9 views4 pages

API Basics - Hiding Program Using Process Creation Flag

The document discusses the use of process creation flags in Windows to hide programs, detailing various flags such as CREATE_SUSPENDED and CREATE_NO_WINDOW. It includes code examples demonstrating how to create processes like Notepad and CMD in suspended mode and without a window. The document emphasizes the implications of these flags for stealth operations in programming.

Uploaded by

ris erdi
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Hiding program using process creation flags

Hiding program using dwCreationFlags :


Flag Description
BOOL CreateProcess(
CREATE_NEW_CONSOLE Creates a new console window for the child
lpApplicationName, // Path to the executable process.
lpCommandLine, // Command-line arguments CREATE_SUSPENDED Creates the process in a suspended state.
(Used in process injection.)
lpProcessAttributes, // Security attributes for the process
CREATE_NO_WINDOW Runs the process without showing any
lpThreadAttributes, // Security attributes for the primary thread window (used for stealth malware).

bInheritHandles, // Inherit handles from parent process CREATE_DEFAULT_ERROR_ Uses the parent's error mode.
MODE
dwCreationFlags, // Process creation flags
CREATE_BREAKAWAY_FRO Allows the process to run outside of a job
lpEnvironment, // Pointer to environment block M_JOB object.

lpCurrentDirectory, // Working directory of the new process CREATE_SEPARATE_WOW_ Runs the process in a separate virtual DOS
VDM machine (for 16-bit apps).
lpStartupInfo, // Pointer to STARTUPINFO structure
CREATE_SHARED_WOW_VD Runs in a shared DOS environment (legacy
lpProcessInformation // Pointer to PROCESS_INFORMATION structure M stuff).

DEBUG_PROCESS Allows the parent process to debug the child


); process.

DEBUG_ONLY_THIS_PROCE Only allows the parent to debug this


SS process.

DETACHED_PROCESS Runs the process without associating with


the parent console.

EXTENDED_STARTUPINFO_ Allows passing extended startup information.


PRESENT

INHERIT_PARENT_AFFIINITY Inherits the CPU affinity of the parent


process.

CREATE_PROTECTED_PRO Creates a protected process (used in anti-


CESS debugging).
Code :
#include <windows.h>
#include <stdio.h>

int main() {
STARTUPINFO si = { sizeof(si) }; // setting zero
PROCESS_INFORMATION pi = {0}; // setting zero

// Create Notepad process


if (CreateProcess(
"C:\\Windows\\System32\\[Link]", // Application name
NULL, // No command-line arguments
NULL, NULL, FALSE, // Default security
CREATE_SUSPENDED, // create in suspended mode
NULL, NULL, // Use parent's environment and directory
&si, &pi // Pass structures
))
{
printf("[+] Process created successfully in suspended mode!\n");
printf("[+] Process ID: %lu\n", [Link]);
printf("[+] Thread ID: %lu\n", [Link]);

// Close process handles


CloseHandle([Link]);
CloseHandle([Link]);
}
else {
printf("[-] Failed to create process. Error: %lu\n", GetLastError());
}
return 0;
}
Code :
#include <windows.h>
#include <stdio.h>

int main() {
STARTUPINFO si = { sizeof(si) }; // setting zero
PROCESS_INFORMATION pi = {0}; // setting zero

// Create Notepad process


if (CreateProcess(
"C:\\Windows\\System32\\[Link]", // Application name
NULL, // No command-line arguments
NULL, NULL, FALSE, // Default security
CREATE_NO_WINDOW , // applicable for console app only
NULL, NULL, // Use parent's environment and directory
&si, &pi // Pass structures
))
{
printf("[+] Process created successfully in suspended mode!\n");
printf("[+] Process ID: %lu\n", [Link]);
printf("[+] Thread ID: %lu\n", [Link]);

// Close process handles


CloseHandle([Link]);
CloseHandle([Link]);
}
else {
printf("[-] Failed to create process. Error: %lu\n", GetLastError());
}
return 0;
}

You might also like