Member Avatar for djzmo

Hi there.

I'm creating a simple anti-cheat program for my game that kills most game cheating programs. (ex: WPE, Cheat Engine, etc.)

But I got stucked when trying to kill hidden processes. Say a program called "HideToolz". it can hide cheating programs from the process list, so that my anti-cheat program cannot detect it. (well, HideToolz can hide any other non-cheating related programs, too.)

And HideToolz itself is hidden from the process list in the Windows Task Manager, so that my program cannot block neither kill the process.

So, is there a way to detect and kill it? I'm using C#. but it would be okay if someone knows how to do this in C++ as I understand both languages.

Thanks.

  • 3 Contributors
  • 9 Replies
  • 565 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by jen140

Dani AI

Generated

Short summary and why Process.Kill fails: HideToolz and similar programs remove entries from the process lists that Task Manager and System.Diagnostics rely on by intercepting the native enumeration APIs or by altering kernel process structures. That means user-mode calls like Process.GetProcesses(), CreateToolhelp32Snapshot/Process32First or WMI can all return a sanitized list with the hidden process absent — so there is nothing for Process.Kill to act on. (itprotoday.com)

Practical user-mode checks (heuristics): enumerate from multiple places and compare results. Example: System.Diagnostics.Process, a WMI query (Win32_Process), and a ToolHelp/PSAPI snapshot. If one source reports PIDs that others do not, that indicates a user-mode hook or manipulation; it’s a useful first diagnostic even though it’s not definitive. Quick C# example to compare Process vs WMI:

// compare Process.GetProcesses() and WMI Win32_Process
using System;
using System.Diagnostics;
using System.Management;
using System.Linq;

var procIds = Process.GetProcesses().Select(p => p.Id).ToHashSet();
var wmi = new ManagementObjectSearcher("SELECT ProcessId FROM Win32_Process")
          .Get().Cast<ManagementObject>()
          .Select(m => Convert.ToInt32((uint)m["ProcessId"])).ToHashSet();

foreach (var id in wmi.Except(procIds))
    Console.WriteLine("WMI-only PID: " + id);

ToolHelp/PSAPI enumeration docs and examples can help you implement these checks. (learn.microsoft.com)

When user-mode checks show nothing, the concealer is likely at kernel level (DKOM, SSDT/SSDT-style hooking, etc.). The reliable route for an anti-cheat is a vetted, signed kernel component that queries kernel process objects (EPROCESS) or receives process notifications from the kernel, rather than trusting user-mode enumerations. Kernel APIs exist for looking up referenced process objects (e.g., PsLookupProcessByProcessId) and for building correct kernel-side logic — but writing and shipping kernel code requires care, test-signing/release-signing and thorough QA because bugs can crash systems. (learn.microsoft.com)

Practical recommendation: start with the multi-source user-mode comparison above for diagnostics. If you truly need to enforce anti-cheat at kernel level, use an established, signed anti-cheat driver or a commercial framework rather than building an ad-hoc kernel root; driver development and signing are nontrivial and risky. For now, ’ Process.Kill is correct for visible targets; as hinted, catching hidden processes often requires anti-rootkit/kernel techniques and that’s why those higher-privilege solutions are the next step.

Recommended Answers

All 9 Replies

Member Avatar for Ramy Mahrous

I don't know how HideToolz works, but can you try to get all processes with name "your process name you want to kill" and loop on their IDs and kill them using Process.Kill which in System.Diagnostics

Member Avatar for djzmo

It doesn't work. HideToolz (and programs hid by HideToolz) doesn't listed in the array. I've also tried to use some other task/process management tool, but no luck, hidetoolz still cant be seen by them.

You can get a copy of HideToolz by searching on google.

Member Avatar for Ramy Mahrous

So, don't use it, and you can run process without showing its GUI to the user!

Member Avatar for djzmo

Don't use what? I'm avoiding my players from using it.
I just finding out how to detect and kill hidden processes. in this case, HideToolz.

Member Avatar for Ramy Mahrous

mmmmm, I'll think in this using C++, give me sometime..

Member Avatar for djzmo

so..
solved it already?

Member Avatar for djzmo

I need the C#/C++ implementation >.< not autoit scripts

Member Avatar for jen140

There is not much documentation about hiding processes , try searching for antirootkit sources . But i dont think someone will code it in c# .
Here is an example of a very good russian hiden process detector :
its writen in delphi. Btw , here is a tutorial how to do the same with winapi , its in russian ,but try using google translate =)
Maybe u'l find something usefull.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.