Home > Programming, Reversing, Windows > Usermode File Hiding

Usermode File Hiding

April 27th, 2009

Another snippet from one of my projects. This time designed to hide processes by name.

Tested and working on both x86 and x64. Again, actual implementation of hooking engine and undocumented structures is left as an exercise to the reader.

// Detour function for NtQuerySystemInformation
// TODO: Add extra checks and cloaks for other information than processes (debuggers,
// etc)
// TODO: Fix return value in cases where all processes are hidden (with exception,
// see notes)
// TODO: Add logging for any unknown system information classes that aren’t being
// specifically ignored
// Note: Do not totally unlink all processes, as long as System Idle Process is left
// on everything is fine, but if you remove that the system will likely crash
// TODO: Fix the detection hole in the couple of classes that can still enumerate
// processes but that aren’t being handled.
NTSTATUS WINAPI NtQuerySystemInformation_Hook(
__in       SYSTEM_INFORMATION_CLASS SystemInformationClass,
__inout    PVOID SystemInformation,
__in       ULONG SystemInformationLength,
__out_opt  PULONG ReturnLength)
{
// Call the original function to get the data we need
NTSTATUS RetVal = ((tNtQuerySystemInformation)(PROC)(g_NtQuerySystemInformation))(SystemInformationClass,
SystemInformation, SystemInformationLength, ReturnLength);

// Make sure we’re working with valid and expected data
if (RetVal != STATUS_SUCCESS)
return RetVal;

// SPI structure pointers to manipulate the ‘linked list’ with.
PSYSTEM_PROCESS_INFORMATION_C pSpiCurrent = 0, pSpiPrevious = 0;

switch (static_cast<SYSTEM_INFORMATION_CLASS_C>(SystemInformationClass))
{
case SystemProcessInformation_C:
// Set the pointers to their defaults
pSpiCurrent = pSpiPrevious = reinterpret_cast<PSYSTEM_PROCESS_INFORMATION_C>(SystemInformation);
break;
case SystemSessionProcessesInformation_C:
// Set the pointers to their defaults
pSpiCurrent = pSpiPrevious = reinterpret_cast<PSYSTEM_SESSION_PROCESS_INFORMATION_C>(SystemInformation)->Buffer;
break;
default:
return RetVal;
}

// Just run until we run out of processes to process.
for (;;)
{
// Get process name
PWSTR ImageName = pSpiCurrent->ImageName.Buffer;
std::wstring ProcessName(ImageName ? ImageName : L”");
// Convert to lowercase for case insensitive compares
std::transform(ProcessName.begin(),ProcessName.end(),ProcessName.begin(),tolower);

// Check if the process should be cloaked
if (Config::Get()->ShouldHideProcess(ProcessName))
{
// Debug output
WDBGOUT(L”NtQuerySystemInformation called! Hiding process: \”"
<< ProcessName << L”\”.”);

// Check if we hit the end of the list
if (pSpiCurrent->NextEntryOffset == 0)
{
// End of list
// Unlink process
pSpiPrevious->NextEntryOffset = 0;
break;
}
else
{
// Not end of list
// Unlink process
pSpiPrevious->NextEntryOffset +=
pSpiCurrent->NextEntryOffset;
}
}
else
{
// Process should not be cloaked

// Check if we hit the end of the list
if (pSpiCurrent->NextEntryOffset == 0)
break;

// Set pointer ready for next iteration
pSpiPrevious = pSpiCurrent;
}

// Move to next process
pSpiCurrent =
reinterpret_cast<PSYSTEM_PROCESS_INFORMATION_C>(
reinterpret_cast<PBYTE>(pSpiCurrent) +
pSpiCurrent->NextEntryOffset);
}

// Return the value from the trampoline.
// TODO: This could potentially cause problems if ALL processes are hidden.
// Although this should NEVER happen its still a concern. Reverse the appropriate
// return code and implement. Priority: 5
return RetVal;
}

Notes:

  • WDBGOUT is a logging macro, feel free to remove the lines using it or provide your own implementation, it won’t break anything.
  • Minor bugs and flaws. Most are outlined in the comments, a couple were omitted, finding and fixing them is again left as an exercise for the reader.
  • If you find any bugs or have any comments I’d love to hear them.
  1. H
    April 29th, 2009 at 21:07 | #1

    Hello,
    Is this going to hide a certain processors name in my processor list? If the answer to the question is yes then, may I get a bit of information about how to make this code useful? I.E. Steps necessary to make this code into a program of some sort? Thanks for reading.

  2. April 30th, 2009 at 23:03 | #2

    This is for hiding files in an arbitrary process. If you want to hide processes in an arbitrary process look at my other post.

    At any rate, I’m not going to spoonfeed you. I’ve done the hard part (implementing the actual API hook), its up to you to work out how to write a program around it.

  1. No trackbacks yet.