How to create an unclosable form?

I want to create a form that can't be closed. Obviously disabling the Control Box isn't going to be enough since you can still just use Alt+F4, Task Manager, etc.
I asked this question in the Beginner's thread and it was recommended that I ask here. Please be specific with your answer, I just started learning C++ a few weeks ago.
Last edited on
closed account (G309216C)
Hmmm... It is fishy, why don't you want to user to close it.

Anyway I will answer your question, because I know you will not be able to do this any-time in near future.
I suspect malware.

Anyway you need to hot-patch ZwQuerySystemInformation and ZwOpenProcess and ZwSuspendProcess and ZwTerminateProcess.

Either way ZW functions will go through ntdll.KiSystemFastCall so better choice would be to hot-patch that function either through a DLL injection, Ring3 Driver or even Inline using Shellcode or better, Extended Instruction Pointer rerouting which would mean you need to replace the first few bytes of the function call then do a unconditional JMP to your function.

You need to export the Memory Address of those functions above and cast them using a typedef.

The thing is that Zw are Ring0 functions but the trick is relative offset of ZW functions and NT functions are 0 in user-land so hooking lower level functions would mean you can bypass more methods of closing your form.

Then in Window Callback just do not call any exit() or like functions.


AND NO I WILL NOT GIVE ANY CODE FOR THE REASON THAT IT IS TOO HARD FOR YOU TO UNDERSTAND. DO NOT JUMP AHEAD OF YOUR SELF.

Thanks
Last edited on
Thanks, though as you can probably imagine I can't do all that much with that information (yet).
Just wanna play a prank on my friend, that is all.
closed account (G309216C)
Oh okay, Tell you what if you do want him to close your form every time taskmgr.exe or other threat applications to your program is found terminate it.

From here it is time you find your own way.
All right, thank you. I look forward to the day when I'll be able to figure this out.
closed account (G309216C)
No, problem.

Thread closed.

Please change the type of the thread.
Topic archived. No new replies allowed.