diff --git a/TitanHide/threadhidefromdbg.cpp b/TitanHide/threadhidefromdbg.cpp index bb8461e..0229e7c 100644 --- a/TitanHide/threadhidefromdbg.cpp +++ b/TitanHide/threadhidefromdbg.cpp @@ -18,13 +18,13 @@ ULONG CrossThreadFlagsOffset = 0; NTSTATUS ReferenceProcessByName(_Outptr_ PEPROCESS* Process, _In_ PUNICODE_STRING ProcessName) { ULONG Size; - if(Undocumented::NtQuerySystemInformation(SystemProcessInformation, nullptr, 0, &Size) != STATUS_INFO_LENGTH_MISMATCH) + if(Undocumented::ZwQuerySystemInformation(SystemProcessInformation, nullptr, 0, &Size) != STATUS_INFO_LENGTH_MISMATCH) return STATUS_UNSUCCESSFUL; const PSYSTEM_PROCESS_INFORMATION SystemProcessInfo = (PSYSTEM_PROCESS_INFORMATION)ExAllocatePoolWithTag(NonPagedPool, 2 * Size, 'croP'); if(SystemProcessInfo == nullptr) return STATUS_NO_MEMORY; - NTSTATUS Status = Undocumented::NtQuerySystemInformation(SystemProcessInformation, SystemProcessInfo, 2 * Size, nullptr); + NTSTATUS Status = Undocumented::ZwQuerySystemInformation(SystemProcessInformation, SystemProcessInfo, 2 * Size, nullptr); if(!NT_SUCCESS(Status)) { ExFreePool(SystemProcessInfo); @@ -110,7 +110,7 @@ NTSTATUS FindCrossThreadFlagsOffset(_Out_ PULONG Offset) Attached = TRUE; // Create a dummy thread - Status = Undocumented::NtCreateThreadEx(&ThreadHandle, + Status = Undocumented::ZwCreateThreadEx(&ThreadHandle, THREAD_SET_INFORMATION, &ObjectAttributes, NtCurrentProcess(), @@ -148,7 +148,7 @@ NTSTATUS FindCrossThreadFlagsOffset(_Out_ PULONG Offset) } // Set the flag we are looking for - Status = Undocumented::NtSetInformationThread(ThreadHandle, ThreadHideFromDebugger, nullptr, 0); + Status = Undocumented::ZwSetInformationThread(ThreadHandle, ThreadHideFromDebugger, nullptr, 0); if(!NT_SUCCESS(Status)) goto Exit; @@ -181,7 +181,7 @@ Exit: ObDereferenceObject(Thread); if(ThreadHandle != nullptr) { - Undocumented::NtTerminateThread(ThreadHandle, STATUS_SUCCESS); + Undocumented::ZwTerminateThread(ThreadHandle, STATUS_SUCCESS); ObCloseHandle(ThreadHandle, ExGetPreviousMode()); } if(Attached) @@ -210,7 +210,7 @@ NTSTATUS UndoHideFromDebuggerInRunningThreads(_In_ ULONG Pid) return Status; ULONG Size; - Status = Undocumented::NtQuerySystemInformation(SystemProcessInformation, nullptr, 0, &Size); + Status = Undocumented::ZwQuerySystemInformation(SystemProcessInformation, nullptr, 0, &Size); if(Status != STATUS_INFO_LENGTH_MISMATCH) goto Exit; @@ -221,7 +221,7 @@ NTSTATUS UndoHideFromDebuggerInRunningThreads(_In_ ULONG Pid) goto Exit; } - Status = Undocumented::NtQuerySystemInformation(SystemProcessInformation, SystemProcessInfo, 2 * Size, nullptr); + Status = Undocumented::ZwQuerySystemInformation(SystemProcessInformation, SystemProcessInfo, 2 * Size, nullptr); if(!NT_SUCCESS(Status)) goto Exit; diff --git a/TitanHide/undocumented.cpp b/TitanHide/undocumented.cpp index 486ba93..ae7c37b 100644 --- a/TitanHide/undocumented.cpp +++ b/TitanHide/undocumented.cpp @@ -73,6 +73,13 @@ typedef NTSTATUS(NTAPI* KERAISEUSEREXCEPTION)( IN NTSTATUS ExceptionCode ); +typedef NTSTATUS(NTAPI* ZWSETINFORMATIONTHREAD)( + IN HANDLE ThreadHandle, + IN THREADINFOCLASS ThreadInformationClass, + IN PVOID ThreadInformation, + IN ULONG ThreadInformationLength +); + typedef NTSTATUS(NTAPI* NTSETINFORMATIONTHREAD)( IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, @@ -104,6 +111,20 @@ typedef NTSTATUS(NTAPI* NTSYSTEMDEBUGCONTROL)( OUT PULONG ReturnLength OPTIONAL ); +typedef NTSTATUS(NTAPI* ZWCREATETHREADEX)( + OUT PHANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, + IN HANDLE ProcessHandle, + IN PUSER_THREAD_START_ROUTINE StartRoutine, + IN PVOID Argument OPTIONAL, + IN ULONG CreateFlags, + IN SIZE_T ZeroBits OPTIONAL, + IN SIZE_T StackSize OPTIONAL, + IN SIZE_T MaximumStackSize OPTIONAL, + IN PPS_ATTRIBUTE_LIST AttributeList OPTIONAL +); + typedef NTSTATUS(NTAPI* NTCREATETHREADEX)( OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, @@ -118,6 +139,11 @@ typedef NTSTATUS(NTAPI* NTCREATETHREADEX)( IN PPS_ATTRIBUTE_LIST AttributeList OPTIONAL ); +typedef NTSTATUS(NTAPI* ZWTERMINATETHREAD)( + IN HANDLE ThreadHandle OPTIONAL, + IN NTSTATUS ExitStatus +); + typedef NTSTATUS(NTAPI* NTTERMINATETHREAD)( IN HANDLE ThreadHandle OPTIONAL, IN NTSTATUS ExitStatus @@ -134,11 +160,14 @@ static NTSETCONTEXTTHREAD NtSCT = 0; static NTCONTINUE NtCon = 0; static NTDUPLICATEOBJECT NtDO = 0; static KERAISEUSEREXCEPTION KeRUE = 0; +static ZWSETINFORMATIONTHREAD ZwSIT = 0; static NTSETINFORMATIONTHREAD NtSIT = 0; static NTSETINFORMATIONPROCESS NtSIP = 0; static NTQUERYINFORMATIONPROCESS NtQIP = 0; static NTSYSTEMDEBUGCONTROL NtSDBC = 0; +static ZWCREATETHREADEX ZwCrThrEx = 0; static NTCREATETHREADEX NtCrThrEx = 0; +static ZWTERMINATETHREAD ZwTermThr = 0; static NTTERMINATETHREAD NtTermThr = 0; NTSTATUS NTAPI Undocumented::ZwQueryInformationProcess( @@ -234,6 +263,15 @@ NTSTATUS NTAPI Undocumented::KeRaiseUserException( return KeRUE(ExceptionCode); } +NTSTATUS NTAPI Undocumented::ZwSetInformationThread( + IN HANDLE ThreadHandle, + IN THREADINFOCLASS ThreadInformationClass, + IN PVOID ThreadInformation, + IN ULONG ThreadInformationLength) +{ + return ZwSIT(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength); +} + NTSTATUS NTAPI Undocumented::NtSetInformationThread( IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, @@ -273,6 +311,22 @@ NTSTATUS NTAPI Undocumented::NtSystemDebugControl( return NtSDBC(Command, InputBuffer, InputBufferLength, OutputBuffer, OutputBufferLength, ReturnLength); } +NTSTATUS NTAPI Undocumented::ZwCreateThreadEx( + OUT PHANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, + IN HANDLE ProcessHandle, + IN PUSER_THREAD_START_ROUTINE StartRoutine, + IN PVOID Argument OPTIONAL, + IN ULONG CreateFlags, + IN SIZE_T ZeroBits OPTIONAL, + IN SIZE_T StackSize OPTIONAL, + IN SIZE_T MaximumStackSize OPTIONAL, + IN PPS_ATTRIBUTE_LIST AttributeList OPTIONAL) +{ + return ZwCrThrEx(ThreadHandle, DesiredAccess, ObjectAttributes, ProcessHandle, StartRoutine, Argument, CreateFlags, ZeroBits, StackSize, MaximumStackSize, AttributeList); +} + NTSTATUS NTAPI Undocumented::NtCreateThreadEx( OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, @@ -289,6 +343,13 @@ NTSTATUS NTAPI Undocumented::NtCreateThreadEx( return NtCrThrEx(ThreadHandle, DesiredAccess, ObjectAttributes, ProcessHandle, StartRoutine, Argument, CreateFlags, ZeroBits, StackSize, MaximumStackSize, AttributeList); } +NTSTATUS NTAPI Undocumented::ZwTerminateThread( + IN HANDLE ThreadHandle OPTIONAL, + IN NTSTATUS ExitStatus) +{ + return ZwTermThr(ThreadHandle, ExitStatus); +} + NTSTATUS NTAPI Undocumented::NtTerminateThread( IN HANDLE ThreadHandle OPTIONAL, IN NTSTATUS ExitStatus) @@ -355,6 +416,14 @@ bool Undocumented::UndocumentedInit() if(!KeRUE) return false; } + if(!ZwSIT) + { + UNICODE_STRING routineName; + RtlInitUnicodeString(&routineName, L"ZwSetInformationThread"); + ZwSIT = (ZWSETINFORMATIONTHREAD)MmGetSystemRoutineAddress(&routineName); + if(!ZwSIT) + return false; + } if(!NtSIT) { UNICODE_STRING routineName; @@ -410,12 +479,24 @@ bool Undocumented::UndocumentedInit() if(!NtSDBC) return false; } + if((NtBuildNumber & 0xFFFF) >= 6000 && !ZwCrThrEx) // only exists on >= Vista + { + ZwCrThrEx = (ZWCREATETHREADEX)SSDT::GetFunctionAddress("ZwCreateThreadEx"); + if(!ZwCrThrEx) + return false; + } if((NtBuildNumber & 0xFFFF) >= 6000 && !NtCrThrEx) // only exists on >= Vista { NtCrThrEx = (NTCREATETHREADEX)SSDT::GetFunctionAddress("NtCreateThreadEx"); if(!NtCrThrEx) return false; } + if(!ZwTermThr) + { + ZwTermThr = (ZWTERMINATETHREAD)SSDT::GetFunctionAddress("ZwTerminateThread"); + if(!ZwTermThr) + return false; + } if(!NtTermThr) { NtTermThr = (NTTERMINATETHREAD)SSDT::GetFunctionAddress("NtTerminateThread"); diff --git a/TitanHide/undocumented.h b/TitanHide/undocumented.h index f398862..4a8621b 100644 --- a/TitanHide/undocumented.h +++ b/TitanHide/undocumented.h @@ -499,6 +499,12 @@ public: static NTSTATUS NTAPI KeRaiseUserException( IN NTSTATUS ExceptionCode); + static NTSTATUS NTAPI ZwSetInformationThread( + IN HANDLE ThreadHandle, + IN THREADINFOCLASS ThreadInformationClass, + IN PVOID ThreadInformation, + IN ULONG ThreadInformationLength); + static NTSTATUS NTAPI NtSetInformationThread( IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, @@ -526,10 +532,27 @@ public: IN ULONG OutputBufferLength, OUT PULONG ReturnLength OPTIONAL); + static NTSTATUS NTAPI ZwTerminateThread( + IN HANDLE ThreadHandle OPTIONAL, + IN NTSTATUS ExitStatus); + static NTSTATUS NTAPI NtTerminateThread( IN HANDLE ThreadHandle OPTIONAL, IN NTSTATUS ExitStatus); + static NTSTATUS NTAPI ZwCreateThreadEx( + OUT PHANDLE ThreadHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, + IN HANDLE ProcessHandle, + IN PUSER_THREAD_START_ROUTINE StartRoutine, + IN PVOID Argument OPTIONAL, + IN ULONG CreateFlags, + IN SIZE_T ZeroBits OPTIONAL, + IN SIZE_T StackSize OPTIONAL, + IN SIZE_T MaximumStackSize OPTIONAL, + IN PPS_ATTRIBUTE_LIST AttributeList OPTIONAL); + static NTSTATUS NTAPI NtCreateThreadEx( OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess,