[Unc3nZureD]

Hi guys!
I'd like to make a small user-mode DLL, which could be injected into any process and the result would be hiding some processes or files from that process.

For Process hiding I think I should hook these APIs:

• Process32First
  


• Process32Next
  


• EnumProcesses
  


• NtQuerySystemInformation (would this overwrite APIs mentioned above?)
  

To Hide files:
?
I've got no idea...

Any lower level (Nt) function would be awesome, so I don't have to hook tons of higher level APIs.

So, all in one: Could you suggest me low level APIs to hook?
Thank you!

[erhanzz]

Here is an nice article about an userland rootkit :
http://phrack.org/issues/62/12.html

Btw hooking NtQuerySystemInformation is enough to hide a process (task manager makes direct calls to NtQuerySystemInformation, so hiding a process in taskmanager requires a hook on the NtQuerySystemInformation api).

Hiding files hook findfirstfile and findnextfile (See link)

Greetz

[Dickyb0bSue]

hooking NtQuerySystemInformation in taskmgr.exe does not work on windows 8 just letting you know

[stdimap]

hooking NtQuerySystemInformation in taskmgr.exe does not work on windows 8 just letting you know

You don't know what you're talking about.

[Dickyb0bSue]

I think i do,i tested it the other day,try it your self,but i dont understand why because this log say it uses the function

Windows 8 task manger dumpbin
ntdll.dll
49B68C Import Address Table
49CE7C Import Name Table
0 time date stamp
0 Index of first forwarder reference

219 NtSetInformationProcess
418 RtlIpv4AddressToStringExW
420 RtlIpv6AddressToStringExW
5E9 WinSqmAddToStream
5EA WinSqmAddToStreamEx
5FD WinSqmSetDWORD
1D1 NtQueryTimerResolution
3EF RtlInitUnicodeString
1B4 NtQueryInformationThread
1CE NtQuerySystemInformationEx
1B2 NtQueryInformationProcess
8A LdrQueryProcessModuleInformation
215 NtSetInformationFile
51F RtlTimeToElapsedTimeFields
1C0 NtQueryObject
1AF NtQueryInformationFile
4D8 RtlSecondsSince1970ToTime
395 RtlFreeHeap
29F RtlAllocateHeap
46F RtlNtStatusToDosErrorNoTeb
2D3 RtlCompareUnicodeString
1B5 NtQueryInformationToken
17B NtOpenFile
2BF RtlCheckPortableOperatingSystem
46E RtlNtStatusToDosError
1CD NtQuerySystemInformation
476 RtlNumberOfSetBitsUlongPtr

windows 7 taskmgr.exe dumpbin
ntdll.dll
100001A88 Import Address Table
100025768 Import Name Table
FFFFFF time date stamp
FFFFFF Index of first forwarder reference

78EA0810 27B RtlCaptureContext
78E79BA0 402 RtlLookupFunctionEntry
78E69910 4F1 RtlVirtualUnwind
78E75320 4C1 RtlTryEnterCriticalSection
78EA1580 1EE NtSetInformationFile
78EA14D0 1F2 NtSetInformationProcess
78EA22D0 164 NtOpenProcessToken
78EA1550 16C NtOpenThreadToken
78EA1640 158 NtOpenFile
78F0AE20 4B2 RtlTimeToElapsedTimeFields
78EA3000 3EB RtlLeaveCriticalSection
78EA2FC0 311 RtlEnterCriticalSection
78EA14A0 18F NtQueryInformationProcess
78EA2610 1AE NtQueryTimerResolution
78EA5280 3A3 RtlInitUnicodeString
78EA5110 415 RtlNtStatusToDosError
78E75350 2DF RtlDeleteCriticalSection
78E78100 3AA RtlInitializeCriticalSection
78EA1670 1AA NtQuerySystemInformation
78F43710 56B WinSqmAddToStream
78EA1520 192 NtQueryInformationToken
78EA1400 D6 NtClose

[stdimap]

I think i do,i tested it the other day,try it your self...

Probably because you have no fucking clue as to what you're doing.

---

Hi guys!
I'd like to make a small user-mode DLL, which could be injected into any process and the result would be hiding some processes or files from that process.

For Process hiding I think I should hook these APIs:

• Process32First
  


• Process32Next
  


• EnumProcesses
  


• NtQuerySystemInformation (would this overwrite APIs mentioned above?)
  

To Hide files:
?
I've got no idea...

Any lower level (Nt) function would be awesome, so I don't have to hook tons of higher level APIs.

So, all in one: Could you suggest me low level APIs to hook?
Thank you!

Hooking ntquerysysteminformation deems those other API's redundant. Now that you're hiding the process from ntquerysysteminformation look into hiding it from ntquerydirectoryfile and the registry.

I just hate these rootkits. You have to deal with x86/x64 Whether to drop or somehow apply heavens gate and make the entire application stable.

[Dickyb0bSue]

Probably because you have no fucking clue as to what you're doing.

---

Hooking ntquerysysteminformation deems those other API's redundant. Now that you're hiding the process from ntquerysysteminformation look into hiding it from ntquerydirectoryfile and the registry.

I just hate these rootkits. You have to deal with x86/x64 Whether to drop or somehow apply heavens gate and make the entire application stable.

I am doing exactly what i do on windows 7,inject a dll in to taskmgr.exe, how do i know what i am doing?

---

Never mind its working, i was doing it on explorer.exe but in task manager on windows 8 its called Windows Explorer, it worked when i tried it on wircd.exe , so ignore my previous posts

---

Before injecting
[img]http://s27.postimg.org/mssfzeic3/before_inject.jpg[/img]

After Injecting
[img]http://s24.postimg.org/onwfvfoid/after_inject.jpg[/img]

[Masm4ever]

Probably because you have no fucking clue as to what you're doing.

Hey stdimap, are you the same kid who believes that structures are opcodes?

[stdimap]

Hey stdimap, are you the same kid who believes that structures are opcodes?

Wow, alot of people here that can't comprehend the sense of a structure being formatted in memory.

Fucking idiot.

What do you think

typedef struct
{
char szPath[250];
}MasmIsAnIdiot;

MasmIsAnIdiot MIAI = {0};

How do you think MIAI looks in memory?

A structure is just a formatted set of bytes in memory.

[Masm4ever]

A structure is just a formatted set of bytes in memory.

You are making progress, "bytes" is already close to the real thing, and much better than the "opcodes" you used in the other thread.

Keep up the good work 👍

[stdimap]

A structure is not a "formatted set of bytes in memory", it defines the format of a range of memory. But never mind, you are making progress, "bytes" is already close to the real thing, and much better than the "opcodes" you used in the other thread.

Keep up the good work 👍

You're the type of kid that argues about spelling to a math teacher. 🤣
I misused the term of opcodes as i was thinking of Assembly at the time.

[Unc3nZureD]

Thanks for all the answers :)

So it seems that hooking:

• ntquerysysteminformation
  


• ntquerydirectoryfile
  

Will do the work, since most of other APIs are based on it. Thank you, I'll look into hooking them.

Anyways I'm not making a rootkit, it's rather a bypass for any application, or maybe some kind of anti anti-debug :)

[ctrlaltdestroy_]

All you need to hook for files is:

NtCreateFile
NtOpenFile
NtQueryInformationFile
NtDeleteFile
// optional
NtLockFile

[xMoD]

Wont this only work on 32bit systems?
I keep reading that it wont on 64 bit.

[_Stoner]

NtCreateFile: Block opening the file for modification
NtOpenProcess: Block ability to retrieve process handle for messing with process
NtCreateKey: Block tampering with startup key
NtQueryDirectoryFile: Hide the saved file
NtQuerySystemInformation: Hide the running process
NtEnumerateValueKey: Hide the registry key used for startup
NtTerminateThread: Prevent ability to terminate specified threads
NtTerminateProcess: Prevent ability to terminate running process
NtSuspendThread: Prevent ability to suspend specified threads
NtSuspendProcess: Prevent ability to suspend running process
NtResumeThread: Detect creation of new processes for information on new processes to inject into

Beyond this, there are still sooo many useful functions to be hooked. There are still ways to tamper with other bots files, processes, registry keys, and more with other functions and other methods than the conventional.