diff --git a/docs/README.md b/docs/README.md index 4c4f791..343f613 100644 --- a/docs/README.md +++ b/docs/README.md @@ -4,4 +4,9 @@ This documentation provides an overview of the shadow-rs rootkit project and ins ### Table of contents -* [Process](/docs/process.md) \ No newline at end of file +* [Process](/docs/process.md) + * [Hide / Unhide Process](/docs/process.md#hide--unhide-process) + * [Elevate Process to System](/docs/process.md#elevate-process-to-system) + * [Process Signature (PP / PPL)](/docs/process.md#process-signature-pp--ppl) + * [Terminate Process](/docs/process.md#terminate-process) + * [Lists protected and hidden processes currently on the system](/docs/process.md#lists-protected-and-hidden-processes-currently-on-the-system) diff --git a/docs/process.md b/docs/process.md index 7ed35b5..608aeb3 100644 --- a/docs/process.md +++ b/docs/process.md @@ -30,7 +30,7 @@ This command allows you to raise the process to system. shadow.exe process elevate --pid ``` -* `elevate`: Elevate the process +* `elevate`: Elevate the process. * ``: The PID of the process you want to escalate to system. Example of use: @@ -39,4 +39,47 @@ Example of use: shadow.exe process elevate --pid 1234 ``` -This command will elevate the process with PID 1234. \ No newline at end of file +This command will elevate the process with PID 1234. + +### Process Signature (PP / PPL) + +Description: +This command allows you to protect / unprotect a process using Process Protection (PP) or Protected Process Light (PPL). + +```cmd +shadow.exe process signature --pt --sg --pid 1234 +``` + +* `signature`: Signature the process. +* ``: The protection type. + * Possible values: + - `none`: No protection + - `protected-light`: Light protection + - `protected`: Full protection + +* ``: The protection signer. + * Possible values: + - `none`: No signer + - `authenticode`: Authenticode signer + - `code-gen`: Code generation signer + - `antimalware`: Antimalware signer + - `lsa`: LSA signer + - `windows`: Windows signer + - `win-tcb`: WinTcb signer + - `win-system`: WinSystem signer + - `app`: Application signer + - `max`: Maximum value for signers + +* ``: The PID of the process you want to modify PP / PPL. + +Example of use: + +```cmd +shadow.exe process signature --pid 1234 --pt protected --sg win-tcb +``` + +This command changes the protection of the process with PID 1234. + +### Terminate Process + +### Lists protected and hidden processes currently on the system \ No newline at end of file