Question

How can I protect my C# app from someone killing its process via taskman or programmatically?

Here is my scenario:

App A is an MFC app developed by another team. It has an unpublished text-based remote interface that is enabled via a backdoor.

I’m developing app B, a C# WinForms app which interacts with A. B enables A’s backdoor when it needs remote access closes it when finished (or on failure).

I’m exploring ways users could abuse B in order to gain access to A’s hidden functionality, such as killing B’s process after it has enabled A’s remote interface. I’d like have one last chance for B to close A’s backdoor when that happens.

B uses localhost to interact with A, so I’m not worried about the power-down scenario.

I’m looking for a solution that doesn’t involve changing A.

I’m not expecting to be able to stop Dark Tangent (though that would be a bonus), but right now a script kiddie could have his way with this design 🙂

These apps run on Windows XP, but will also soon support Vista & 7.

Thanks in advance,
Jim

Answer 1

You can’t – as long as the user has the right to call TerminateProcess on your program, you can’t prevent End Process from killing you immediately in task manager. Raymond Chen posted on this some time ago: The arms race between programs and users