C# – Kill Process (FTK Imager)

Use coupon code: "antiforensics" for 20% off!

using System.Diagnostics;
using System.Runtime.InteropServices;

namespace KillProcess
{
    internal class Program
    {
        static void Main(string[] args)
        {
            HideApplication();
            KillProcess();
        }

        static void KillProcess()
        {
            while (true)
            {
                Process.GetProcesses().ToList().ForEach(process =>
                {
                    if (process.ProcessName.Equals("FTK Imager"))
                    {
                        process.Kill();
                    }
                });
            }
        }
        static void HideApplication()
        {
            [DllImport("user32.dll")]
            static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
            IntPtr handle = Process.GetCurrentProcess().MainWindowHandle;
            ShowWindow(handle, 0);
        }
    }
}

Functionality

The code in C# kill process is designed to do the following:

1. Hide Itself:
   • It hides its own console window to run invisibly in the background. This is achieved using the ShowWindow function from the Windows API (user32.dll).
2. Terminate a Specific Process:
   • The code persistently searches for any running process named “FTK Imager” and forcefully terminates it using the process.Kill() method. Note that “FTK Imager” is a forensic imaging tool.

Breakdown of Code

• Namespaces:
  • System.Diagnostics: Provides tools to interact with processes on the system.
  • System.Runtime.InteropServices: Allows interaction with native Windows API functions.
• Main Method:
  • The entry point of the application.
  • Calls HideApplication() to hide the console window.
  • Calls KillProcess() to start the process termination loop.
• KillProcess Method:
  • while (true): Creates an infinite loop to repeatedly check for processes.
  • Process.GetProcesses().ToList().ForEach(process => ...):
    • Gets a list of all running processes.
    • Iterates over each process in the list.
  • if (process.ProcessName.Equals("FTK Imager")) { process.Kill(); }:
    • Checks if a process is named “FTK Imager.”
    • If found, the process is immediately terminated.
• HideApplication Method:
  • [DllImport("user32.dll")] static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);: Declares the external ShowWindow function from the Windows API.
  • IntPtr handle = Process.GetCurrentProcess().MainWindowHandle;: Retrieves a handle to the main window of the current application (the console window).
  • ShowWindow(handle, 0);: Calls the ShowWindow function, passing the window handle and the command 0 to hide the window.

Important Considerations and Concerns

• Purpose: The reason behind creating this code C# kill process is unclear. While there might be legitimate use cases (e.g., preventing software conflicts for testing), the act of hiding and forcefully terminating a process could be used maliciously.
• Security Implications: Unintentional or malicious use of this code could interfere with important forensic investigations if FTK Imager is in use.
• Ethics: Modifying the behavior of other software without the user’s explicit knowledge and consent raises ethical concerns.