₦airaland Forum

Hi

I have been working on something lately, I'm working on something and I want it to work this way, I have 2 applications, and then I want to upload to a major application (like an extractor) so that when it's run, its going to extract the two applications and run them silently,

The second challenge I have is I use SW_HIDE but it just hides, but on task manager, I could still see the executable. Hence I want to hide everything, while the executable does the work on background.

Please I need real people answering this Question here. With good experience of c++ or delphi.

Thanks.

From my experience, SW_HIDE, isn't the best bet you should use here 100%.

You should be placing a function redirection call (API hooking) to NTQuerySystemInformation to hide the process. (if I understand you correctly) just like we discussed on PM's

You do function redirection to these API functions, NTQuerySystemInformation and NtOpenProcess

And the other part of the extraction, load the applications into memory (resource) and use this

FindResource, LoadResource, SizeofResource,LockResource and extract to disk then use ShellExecute to then execute

SW_HIDE can be used for silent installation, then when you call those functions it may help hide from taskmanager and processmanager.

I hope I helped here.

Mmm,

ZwQuerySystemInformation you mean?

Whytelyon:
From my experience, SW_HIDE, isn't the best bet you should use here 100%.

You should be placing a function redirection call (API hooking) to NTQuerySystemInformation to hide the process. (if I understand you correctly) just like we discussed on PM's

You do function redirection to these API functions, NTQuerySystemInformation and NtOpenProcess

And the other part of the extraction, load the applications into memory (resource) and use this

FindResource, LoadResource, SizeofResource,LockResource and extract to disk then use ShellExecute to then execute

SW_HIDE can be used for silent installation, then when you call those functions it may help hide from taskmanager and processmanager.

I hope I helped here.

Thank you Lyon.
It worked just as I expected. What logic API hooking can solve.

Keep your good work up!