Hiding program using process creation flags
Hiding program using dwCreationFlags :
Flag Description
BOOL CreateProcess(
CREATE_NEW_CONSOLE Creates a new console window for the child
lpApplicationName, // Path to the executable process.
lpCommandLine, // Command-line arguments CREATE_SUSPENDED Creates the process in a suspended state.
(Used in process injection.)
lpProcessAttributes, // Security attributes for the process
CREATE_NO_WINDOW Runs the process without showing any
lpThreadAttributes, // Security attributes for the primary thread window (used for stealth malware).
bInheritHandles, // Inherit handles from parent process CREATE_DEFAULT_ERROR_ Uses the parent's error mode.
MODE
dwCreationFlags, // Process creation flags
CREATE_BREAKAWAY_FRO Allows the process to run outside of a job
lpEnvironment, // Pointer to environment block M_JOB object.
lpCurrentDirectory, // Working directory of the new process CREATE_SEPARATE_WOW_ Runs the process in a separate virtual DOS
VDM machine (for 16-bit apps).
lpStartupInfo, // Pointer to STARTUPINFO structure
CREATE_SHARED_WOW_VD Runs in a shared DOS environment (legacy
lpProcessInformation // Pointer to PROCESS_INFORMATION structure M stuff).
DEBUG_PROCESS Allows the parent process to debug the child
); process.
DEBUG_ONLY_THIS_PROCE Only allows the parent to debug this
SS process.
DETACHED_PROCESS Runs the process without associating with
the parent console.
EXTENDED_STARTUPINFO_ Allows passing extended startup information.
PRESENT
INHERIT_PARENT_AFFIINITY Inherits the CPU affinity of the parent
process.
CREATE_PROTECTED_PRO Creates a protected process (used in anti-
CESS debugging).
Code :
#include <windows.h>
#include <stdio.h>
int main() {
STARTUPINFO si = { sizeof(si) }; // setting zero
PROCESS_INFORMATION pi = {0}; // setting zero
// Create Notepad process
if (CreateProcess(
"C:\\Windows\\System32\\[Link]", // Application name
NULL, // No command-line arguments
NULL, NULL, FALSE, // Default security
CREATE_SUSPENDED, // create in suspended mode
NULL, NULL, // Use parent's environment and directory
&si, &pi // Pass structures
))
{
printf("[+] Process created successfully in suspended mode!\n");
printf("[+] Process ID: %lu\n", [Link]);
printf("[+] Thread ID: %lu\n", [Link]);
// Close process handles
CloseHandle([Link]);
CloseHandle([Link]);
}
else {
printf("[-] Failed to create process. Error: %lu\n", GetLastError());
}
return 0;
}
Code :
#include <windows.h>
#include <stdio.h>
int main() {
STARTUPINFO si = { sizeof(si) }; // setting zero
PROCESS_INFORMATION pi = {0}; // setting zero
// Create Notepad process
if (CreateProcess(
"C:\\Windows\\System32\\[Link]", // Application name
NULL, // No command-line arguments
NULL, NULL, FALSE, // Default security
CREATE_NO_WINDOW , // applicable for console app only
NULL, NULL, // Use parent's environment and directory
&si, &pi // Pass structures
))
{
printf("[+] Process created successfully in suspended mode!\n");
printf("[+] Process ID: %lu\n", [Link]);
printf("[+] Thread ID: %lu\n", [Link]);
// Close process handles
CloseHandle([Link]);
CloseHandle([Link]);
}
else {
printf("[-] Failed to create process. Error: %lu\n", GetLastError());
}
return 0;
}