mirror of
https://github.com/mrexodia/TitanHide
synced 2026-08-13 04:23:04 -04:00
Merge pull request #77 from HyperSine/master
replace some Nt* APIs with Zw* version
This commit is contained in:
Matthijs Lavrijsen
GitHub
commit
df77abcbca
3 changed files with 111 additions and 7 deletions
|
|
@ -18,13 +18,13 @@ ULONG CrossThreadFlagsOffset = 0;
|
|||
NTSTATUS ReferenceProcessByName(_Outptr_ PEPROCESS* Process, _In_ PUNICODE_STRING ProcessName)
|
||||
{
|
||||
ULONG Size;
|
||||
if(Undocumented::NtQuerySystemInformation(SystemProcessInformation, nullptr, 0, &Size) != STATUS_INFO_LENGTH_MISMATCH)
|
||||
if(Undocumented::ZwQuerySystemInformation(SystemProcessInformation, nullptr, 0, &Size) != STATUS_INFO_LENGTH_MISMATCH)
|
||||
return STATUS_UNSUCCESSFUL;
|
||||
const PSYSTEM_PROCESS_INFORMATION SystemProcessInfo =
|
||||
(PSYSTEM_PROCESS_INFORMATION)ExAllocatePoolWithTag(NonPagedPool, 2 * Size, 'croP');
|
||||
if(SystemProcessInfo == nullptr)
|
||||
return STATUS_NO_MEMORY;
|
||||
NTSTATUS Status = Undocumented::NtQuerySystemInformation(SystemProcessInformation, SystemProcessInfo, 2 * Size, nullptr);
|
||||
NTSTATUS Status = Undocumented::ZwQuerySystemInformation(SystemProcessInformation, SystemProcessInfo, 2 * Size, nullptr);
|
||||
if(!NT_SUCCESS(Status))
|
||||
{
|
||||
ExFreePool(SystemProcessInfo);
|
||||
|
|
@ -110,7 +110,7 @@ NTSTATUS FindCrossThreadFlagsOffset(_Out_ PULONG Offset)
|
|||
Attached = TRUE;
|
||||
|
||||
// Create a dummy thread
|
||||
Status = Undocumented::NtCreateThreadEx(&ThreadHandle,
|
||||
Status = Undocumented::ZwCreateThreadEx(&ThreadHandle,
|
||||
THREAD_SET_INFORMATION,
|
||||
&ObjectAttributes,
|
||||
NtCurrentProcess(),
|
||||
|
|
@ -148,7 +148,7 @@ NTSTATUS FindCrossThreadFlagsOffset(_Out_ PULONG Offset)
|
|||
}
|
||||
|
||||
// Set the flag we are looking for
|
||||
Status = Undocumented::NtSetInformationThread(ThreadHandle, ThreadHideFromDebugger, nullptr, 0);
|
||||
Status = Undocumented::ZwSetInformationThread(ThreadHandle, ThreadHideFromDebugger, nullptr, 0);
|
||||
if(!NT_SUCCESS(Status))
|
||||
goto Exit;
|
||||
|
||||
|
|
@ -181,7 +181,7 @@ Exit:
|
|||
ObDereferenceObject(Thread);
|
||||
if(ThreadHandle != nullptr)
|
||||
{
|
||||
Undocumented::NtTerminateThread(ThreadHandle, STATUS_SUCCESS);
|
||||
Undocumented::ZwTerminateThread(ThreadHandle, STATUS_SUCCESS);
|
||||
ObCloseHandle(ThreadHandle, ExGetPreviousMode());
|
||||
}
|
||||
if(Attached)
|
||||
|
|
@ -210,7 +210,7 @@ NTSTATUS UndoHideFromDebuggerInRunningThreads(_In_ ULONG Pid)
|
|||
return Status;
|
||||
|
||||
ULONG Size;
|
||||
Status = Undocumented::NtQuerySystemInformation(SystemProcessInformation, nullptr, 0, &Size);
|
||||
Status = Undocumented::ZwQuerySystemInformation(SystemProcessInformation, nullptr, 0, &Size);
|
||||
if(Status != STATUS_INFO_LENGTH_MISMATCH)
|
||||
goto Exit;
|
||||
|
||||
|
|
@ -221,7 +221,7 @@ NTSTATUS UndoHideFromDebuggerInRunningThreads(_In_ ULONG Pid)
|
|||
goto Exit;
|
||||
}
|
||||
|
||||
Status = Undocumented::NtQuerySystemInformation(SystemProcessInformation, SystemProcessInfo, 2 * Size, nullptr);
|
||||
Status = Undocumented::ZwQuerySystemInformation(SystemProcessInformation, SystemProcessInfo, 2 * Size, nullptr);
|
||||
if(!NT_SUCCESS(Status))
|
||||
goto Exit;
|
||||
|
||||
|
|
|
|||
|
|
@ -73,6 +73,13 @@ typedef NTSTATUS(NTAPI* KERAISEUSEREXCEPTION)(
|
|||
IN NTSTATUS ExceptionCode
|
||||
);
|
||||
|
||||
typedef NTSTATUS(NTAPI* ZWSETINFORMATIONTHREAD)(
|
||||
IN HANDLE ThreadHandle,
|
||||
IN THREADINFOCLASS ThreadInformationClass,
|
||||
IN PVOID ThreadInformation,
|
||||
IN ULONG ThreadInformationLength
|
||||
);
|
||||
|
||||
typedef NTSTATUS(NTAPI* NTSETINFORMATIONTHREAD)(
|
||||
IN HANDLE ThreadHandle,
|
||||
IN THREADINFOCLASS ThreadInformationClass,
|
||||
|
|
@ -104,6 +111,20 @@ typedef NTSTATUS(NTAPI* NTSYSTEMDEBUGCONTROL)(
|
|||
OUT PULONG ReturnLength OPTIONAL
|
||||
);
|
||||
|
||||
typedef NTSTATUS(NTAPI* ZWCREATETHREADEX)(
|
||||
OUT PHANDLE ThreadHandle,
|
||||
IN ACCESS_MASK DesiredAccess,
|
||||
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
|
||||
IN HANDLE ProcessHandle,
|
||||
IN PUSER_THREAD_START_ROUTINE StartRoutine,
|
||||
IN PVOID Argument OPTIONAL,
|
||||
IN ULONG CreateFlags,
|
||||
IN SIZE_T ZeroBits OPTIONAL,
|
||||
IN SIZE_T StackSize OPTIONAL,
|
||||
IN SIZE_T MaximumStackSize OPTIONAL,
|
||||
IN PPS_ATTRIBUTE_LIST AttributeList OPTIONAL
|
||||
);
|
||||
|
||||
typedef NTSTATUS(NTAPI* NTCREATETHREADEX)(
|
||||
OUT PHANDLE ThreadHandle,
|
||||
IN ACCESS_MASK DesiredAccess,
|
||||
|
|
@ -118,6 +139,11 @@ typedef NTSTATUS(NTAPI* NTCREATETHREADEX)(
|
|||
IN PPS_ATTRIBUTE_LIST AttributeList OPTIONAL
|
||||
);
|
||||
|
||||
typedef NTSTATUS(NTAPI* ZWTERMINATETHREAD)(
|
||||
IN HANDLE ThreadHandle OPTIONAL,
|
||||
IN NTSTATUS ExitStatus
|
||||
);
|
||||
|
||||
typedef NTSTATUS(NTAPI* NTTERMINATETHREAD)(
|
||||
IN HANDLE ThreadHandle OPTIONAL,
|
||||
IN NTSTATUS ExitStatus
|
||||
|
|
@ -134,11 +160,14 @@ static NTSETCONTEXTTHREAD NtSCT = 0;
|
|||
static NTCONTINUE NtCon = 0;
|
||||
static NTDUPLICATEOBJECT NtDO = 0;
|
||||
static KERAISEUSEREXCEPTION KeRUE = 0;
|
||||
static ZWSETINFORMATIONTHREAD ZwSIT = 0;
|
||||
static NTSETINFORMATIONTHREAD NtSIT = 0;
|
||||
static NTSETINFORMATIONPROCESS NtSIP = 0;
|
||||
static NTQUERYINFORMATIONPROCESS NtQIP = 0;
|
||||
static NTSYSTEMDEBUGCONTROL NtSDBC = 0;
|
||||
static ZWCREATETHREADEX ZwCrThrEx = 0;
|
||||
static NTCREATETHREADEX NtCrThrEx = 0;
|
||||
static ZWTERMINATETHREAD ZwTermThr = 0;
|
||||
static NTTERMINATETHREAD NtTermThr = 0;
|
||||
|
||||
NTSTATUS NTAPI Undocumented::ZwQueryInformationProcess(
|
||||
|
|
@ -234,6 +263,15 @@ NTSTATUS NTAPI Undocumented::KeRaiseUserException(
|
|||
return KeRUE(ExceptionCode);
|
||||
}
|
||||
|
||||
NTSTATUS NTAPI Undocumented::ZwSetInformationThread(
|
||||
IN HANDLE ThreadHandle,
|
||||
IN THREADINFOCLASS ThreadInformationClass,
|
||||
IN PVOID ThreadInformation,
|
||||
IN ULONG ThreadInformationLength)
|
||||
{
|
||||
return ZwSIT(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength);
|
||||
}
|
||||
|
||||
NTSTATUS NTAPI Undocumented::NtSetInformationThread(
|
||||
IN HANDLE ThreadHandle,
|
||||
IN THREADINFOCLASS ThreadInformationClass,
|
||||
|
|
@ -273,6 +311,22 @@ NTSTATUS NTAPI Undocumented::NtSystemDebugControl(
|
|||
return NtSDBC(Command, InputBuffer, InputBufferLength, OutputBuffer, OutputBufferLength, ReturnLength);
|
||||
}
|
||||
|
||||
NTSTATUS NTAPI Undocumented::ZwCreateThreadEx(
|
||||
OUT PHANDLE ThreadHandle,
|
||||
IN ACCESS_MASK DesiredAccess,
|
||||
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
|
||||
IN HANDLE ProcessHandle,
|
||||
IN PUSER_THREAD_START_ROUTINE StartRoutine,
|
||||
IN PVOID Argument OPTIONAL,
|
||||
IN ULONG CreateFlags,
|
||||
IN SIZE_T ZeroBits OPTIONAL,
|
||||
IN SIZE_T StackSize OPTIONAL,
|
||||
IN SIZE_T MaximumStackSize OPTIONAL,
|
||||
IN PPS_ATTRIBUTE_LIST AttributeList OPTIONAL)
|
||||
{
|
||||
return ZwCrThrEx(ThreadHandle, DesiredAccess, ObjectAttributes, ProcessHandle, StartRoutine, Argument, CreateFlags, ZeroBits, StackSize, MaximumStackSize, AttributeList);
|
||||
}
|
||||
|
||||
NTSTATUS NTAPI Undocumented::NtCreateThreadEx(
|
||||
OUT PHANDLE ThreadHandle,
|
||||
IN ACCESS_MASK DesiredAccess,
|
||||
|
|
@ -289,6 +343,13 @@ NTSTATUS NTAPI Undocumented::NtCreateThreadEx(
|
|||
return NtCrThrEx(ThreadHandle, DesiredAccess, ObjectAttributes, ProcessHandle, StartRoutine, Argument, CreateFlags, ZeroBits, StackSize, MaximumStackSize, AttributeList);
|
||||
}
|
||||
|
||||
NTSTATUS NTAPI Undocumented::ZwTerminateThread(
|
||||
IN HANDLE ThreadHandle OPTIONAL,
|
||||
IN NTSTATUS ExitStatus)
|
||||
{
|
||||
return ZwTermThr(ThreadHandle, ExitStatus);
|
||||
}
|
||||
|
||||
NTSTATUS NTAPI Undocumented::NtTerminateThread(
|
||||
IN HANDLE ThreadHandle OPTIONAL,
|
||||
IN NTSTATUS ExitStatus)
|
||||
|
|
@ -355,6 +416,14 @@ bool Undocumented::UndocumentedInit()
|
|||
if(!KeRUE)
|
||||
return false;
|
||||
}
|
||||
if(!ZwSIT)
|
||||
{
|
||||
UNICODE_STRING routineName;
|
||||
RtlInitUnicodeString(&routineName, L"ZwSetInformationThread");
|
||||
ZwSIT = (ZWSETINFORMATIONTHREAD)MmGetSystemRoutineAddress(&routineName);
|
||||
if(!ZwSIT)
|
||||
return false;
|
||||
}
|
||||
if(!NtSIT)
|
||||
{
|
||||
UNICODE_STRING routineName;
|
||||
|
|
@ -410,12 +479,24 @@ bool Undocumented::UndocumentedInit()
|
|||
if(!NtSDBC)
|
||||
return false;
|
||||
}
|
||||
if((NtBuildNumber & 0xFFFF) >= 6000 && !ZwCrThrEx) // only exists on >= Vista
|
||||
{
|
||||
ZwCrThrEx = (ZWCREATETHREADEX)SSDT::GetFunctionAddress("ZwCreateThreadEx");
|
||||
if(!ZwCrThrEx)
|
||||
return false;
|
||||
}
|
||||
if((NtBuildNumber & 0xFFFF) >= 6000 && !NtCrThrEx) // only exists on >= Vista
|
||||
{
|
||||
NtCrThrEx = (NTCREATETHREADEX)SSDT::GetFunctionAddress("NtCreateThreadEx");
|
||||
if(!NtCrThrEx)
|
||||
return false;
|
||||
}
|
||||
if(!ZwTermThr)
|
||||
{
|
||||
ZwTermThr = (ZWTERMINATETHREAD)SSDT::GetFunctionAddress("ZwTerminateThread");
|
||||
if(!ZwTermThr)
|
||||
return false;
|
||||
}
|
||||
if(!NtTermThr)
|
||||
{
|
||||
NtTermThr = (NTTERMINATETHREAD)SSDT::GetFunctionAddress("NtTerminateThread");
|
||||
|
|
|
|||
|
|
@ -499,6 +499,12 @@ public:
|
|||
static NTSTATUS NTAPI KeRaiseUserException(
|
||||
IN NTSTATUS ExceptionCode);
|
||||
|
||||
static NTSTATUS NTAPI ZwSetInformationThread(
|
||||
IN HANDLE ThreadHandle,
|
||||
IN THREADINFOCLASS ThreadInformationClass,
|
||||
IN PVOID ThreadInformation,
|
||||
IN ULONG ThreadInformationLength);
|
||||
|
||||
static NTSTATUS NTAPI NtSetInformationThread(
|
||||
IN HANDLE ThreadHandle,
|
||||
IN THREADINFOCLASS ThreadInformationClass,
|
||||
|
|
@ -526,10 +532,27 @@ public:
|
|||
IN ULONG OutputBufferLength,
|
||||
OUT PULONG ReturnLength OPTIONAL);
|
||||
|
||||
static NTSTATUS NTAPI ZwTerminateThread(
|
||||
IN HANDLE ThreadHandle OPTIONAL,
|
||||
IN NTSTATUS ExitStatus);
|
||||
|
||||
static NTSTATUS NTAPI NtTerminateThread(
|
||||
IN HANDLE ThreadHandle OPTIONAL,
|
||||
IN NTSTATUS ExitStatus);
|
||||
|
||||
static NTSTATUS NTAPI ZwCreateThreadEx(
|
||||
OUT PHANDLE ThreadHandle,
|
||||
IN ACCESS_MASK DesiredAccess,
|
||||
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
|
||||
IN HANDLE ProcessHandle,
|
||||
IN PUSER_THREAD_START_ROUTINE StartRoutine,
|
||||
IN PVOID Argument OPTIONAL,
|
||||
IN ULONG CreateFlags,
|
||||
IN SIZE_T ZeroBits OPTIONAL,
|
||||
IN SIZE_T StackSize OPTIONAL,
|
||||
IN SIZE_T MaximumStackSize OPTIONAL,
|
||||
IN PPS_ATTRIBUTE_LIST AttributeList OPTIONAL);
|
||||
|
||||
static NTSTATUS NTAPI NtCreateThreadEx(
|
||||
OUT PHANDLE ThreadHandle,
|
||||
IN ACCESS_MASK DesiredAccess,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue