Miscellany

// HELIOS + Tetsuovoid cPatchUtils::HideModuleEx ( HMODULE hModule, ELIST eList ){	_TEB* pTeb = NULL;	__asm	{		xor eax, eax;		mov eax, fs:[0x18];		mov pTeb, eax;	}	PPEB Peb = (PPEB)pTeb->Peb;	char szPath[MAX_PATH] = { 0 };	GetModuleFileNameA(hModule, szPath, MAX_PATH);	if (Peb && Peb->LoaderData && Peb->LoaderData->Initialized)	{		PLIST_ENTRY pListHead = NULL, pListPtr = NULL;		DWORD dOffset = 0;		switch (eList) // There are 3 module lists with different offsets		{		case LIST_LoadOrder:			pListHead = pListPtr = &(Peb->LoaderData->InLoadOrderModuleList);			dOffset = 0x24;			break;		case LIST_MemoryOrder:			pListHead = pListPtr = &(Peb->LoaderData->InMemoryOrderModuleList);			dOffset = 0x1C;			break;		case LIST_InitOrder:			pListHead = pListPtr = &(Peb->LoaderData->InInitializationOrderModuleList);			dOffset = 0x14;			break;		}		if (pListHead && pListPtr)		{			// LIST_ENTRY is a double linked list, so we need to loop thru 2 lists			do // Loop thru Flink			{				char name[MAX_PATH];				wsprintfA(name, "%S", ((PUNICODE_STRING)((PCHAR)pListPtr->Flink + dOffset))->Buffer);				if (!stricmp(name, szPath)) // We found our module, so lets hide it				{					pListPtr->Flink = pListPtr->Flink->Flink;				}				pListPtr = pListPtr->Flink;			} while (pListPtr->Flink != pListHead->Flink);			do // Loop thru Blink			{				char name[MAX_PATH];				wsprintfA(name, "%S", ((PUNICODE_STRING)((PCHAR)pListPtr->Blink + dOffset))->Buffer);				if (!stricmp(name, szPath)) // We found our module, so lets hide it				{					pListPtr->Blink = pListPtr->Blink->Blink;				}				pListPtr = pListPtr->Blink;			} while (pListPtr->Blink != pListHead->Blink);		}	}}