diff --git a/docs/README.md b/docs/README.md index 6a923b9..122aa80 100644 --- a/docs/README.md +++ b/docs/README.md @@ -8,6 +8,7 @@ This document presents an overview of the `shadow-rs` project, describing its fe * [Hide / Unhide Process](/docs/process.md#hide--unhide-process) * [Elevate Process to System](/docs/process.md#elevate-process-to-system) * [Process Signature (PP / PPL)](/docs/process.md#process-signature-pp--ppl) + * [Process Protection (Anti-Kill / Dumping)](/docs/process.md#process-protection-anti-kill--dumping) * [Terminate Process](/docs/process.md#terminate-process) * [Lists protected and hidden processes currently on the system](/docs/process.md#lists-protected-and-hidden-processes-currently-on-the-system) diff --git a/docs/process.md b/docs/process.md index af5a0f0..2f178ae 100644 --- a/docs/process.md +++ b/docs/process.md @@ -81,6 +81,28 @@ shadow.exe process signature --pid 1234 --pt protected --sg win-tcb This command changes the protection of the process with PID 1234. +## Process Protection (Anti-Kill / Dumping) + +Description: +This command allows you to add or remove process protection. + +```cmd +shadow.exe process protection --pid [--add | --remove] +``` + +* `protection`: Protect the specified process. +* `-a / --add`: Add the process. +* `-r / --remove`: Remove the process. +* `pid`: The PID of the process you want to protect. + +Example of use: + +```cmd +shadow.exe process protection --pid 1234 --add +``` + +This command will protect the process with PID 1234. + ## Terminate Process Description: diff --git a/docs/thread.md b/docs/thread.md index a7db351..9b95f0c 100644 --- a/docs/thread.md +++ b/docs/thread.md @@ -19,4 +19,26 @@ Example of use: shadow.exe thread hide --tid 1234 ``` -This command will hide the thread with TID 1234. \ No newline at end of file +This command will hide the thread with TID 1234. + +## Thread Protection (Anti-Kill) + +Description: +This command allows you to add or remove thread protection. + +```cmd +shadow.exe thread protection --tid [--add | --remove] +``` + +* `protection`: Protect the specified thread. +* `-a / --add`: Add the thread. +* `-r / --remove`: Remove the thread. +* `tid`: The TID of the thread you want to protect. + +Example of use: + +```cmd +shadow.exe thread protection --tid 1234 --add +``` + +This command will protect the thread with TID 1234. \ No newline at end of file