The Next Release

[k3rb0w]

im using version 3014

hey kakashi i saw ur nick hanging around in rootkit forum
is that u?

btw do u guys know any tool that can faking the process id
not just a fake pid but also can redirecting process to another process
so u can read the memory from the fake one (indirect)

[Kakashi_s1]

yeah that was me on rootkit forums hehe. Trying to learn how to fake running processes as well, ie Wpe Pro.

There's a rootkit that does that called Fu RootKit. Basically you have to get into dos prompt and type in something like:

"fu -idlist"

then a list shows of all running processes. Then you type in something like this:

"fu -pid 1029 1030"

to change process list/name or whatever. You can also hide process ids as well but i forgot at the moment. I'll check back on it whenever I can. I cant use the rootkit at the moment because it says that I dont have right to use the rootkit. bleh.

[k3rb0w]

these are the only command that can be uses

Usage: fu
[-pl] #number to list the first #number of processes
[-ph] #PID to hide the process with #PID
[-pld] to list the named drivers in DbgView
[-phd] DRIVER_NAME to hide the named driver
[-pas] #PID to set the AUTH_ID to SYSTEM on process #PID
[-prl] to list the available privileges
[-prs] #PID #privilege_name to set privileges on process #PID
[-pss] #PID #account_name to add #account_name SID to process #PID token

as we see, there is no feature to redirect the process to another process
what im looking for is a "redirect" feature not only faking PID process

like i said before ... so we can read the 1st process by targeting the fake process (indirect)

[t3hL33Tn00b]

Hey guys, whats up?

I've also been trying some rootkits in order to hide processes so I can memory hack in a game (Grand Chase, which uses HackShield).

Neither fu rootkit nor hack defender were able to hide the process from HackShield... I heard Shadow Walker is THE rootkit, it went past the best anti-virus and firewalls around as if they didnt even were there.. The thing is I cant find were to download it anywhere... So if you are more sucessful than I was please let us know...

About the process redirector thing I never seen anything that does that, I'll do some research on it and see if i can find anything...

I read that in this forum that some games are protected from user mode (or whatever), is there a way to unprotect them or something?

Sorry if this is a newbie question, i really dont know much about this stuff...