Skip to content

Commit 3e79de1

Browse files
crvvdevcrvvdev
committed
Cleaned and renamed code
Cleaned and renamed code to make it more understandable.
1 parent 03d042e commit 3e79de1

File tree

13 files changed

+966
-897
lines changed

13 files changed

+966
-897
lines changed

‎MasterHide/MasterHide.vcxproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@
9898
<ClInclude Include="..\KasperskyHook\KasperskyHookDrv\kernel_modules.hpp" />
9999
<ClInclude Include="..\KasperskyHook\KasperskyHookDrv\pe.hpp" />
100100
<ClInclude Include="..\KasperskyHook\KasperskyHookDrv\utils.hpp" />
101+
<ClInclude Include="globals.hpp" />
101102
<ClInclude Include="mh_hooks.h" />
102103
<ClInclude Include="shadow_ssdt.h" />
103104
<ClInclude Include="ssdt.h" />

‎MasterHide/MasterHide.vcxproj.filters‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,5 +81,8 @@
8181
<ClInclude Include="mh_hooks.h">
8282
<Filter>Header Files</Filter>
8383
</ClInclude>
84+
<ClInclude Include="globals.hpp">
85+
<Filter>Header Files</Filter>
86+
</ClInclude>
8487
</ItemGroup>
8588
</Project>

‎MasterHide/globals.hpp‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
#pragma once
2+
3+
namespace masterhide
4+
{
5+
namespace globals
6+
{
7+
//
8+
// Custom MAC Address
9+
//
10+
static UCHAR szFakeMAC[] = { 0xDE, 0xAD, 0xBE, 0xEF, 0x01, 0x2 };
11+
12+
//
13+
// Custom HD Serial and Model
14+
//
15+
static char szFakeSerial[] = "XJEBA1973M2";
16+
17+
static char* szFakeModels[] =
18+
{
19+
"Samsung EVO 970",
20+
//...
21+
};
22+
23+
//
24+
// Those drivers will not appear on drivers list
25+
//
26+
static char* szProtectedDrivers[] =
27+
{
28+
"dbk64",
29+
"processhacker2",
30+
//...
31+
};
32+
33+
//
34+
// Those processes will not appear on process list or via window methods
35+
//
36+
static wchar_t* wsProtectedProcesses[] =
37+
{
38+
L"cheatengine",
39+
L"ProcessHacker"
40+
//...
41+
};
42+
43+
//
44+
// Those processes will be monitored
45+
//
46+
static wchar_t* wsMonitoredProcesses[] =
47+
{
48+
L"Tibia",
49+
//...
50+
};
51+
52+
//
53+
// Those processess will be blacklisted to query data on protect processes
54+
//
55+
static wchar_t* wsBlacklistedProcessess[] =
56+
{
57+
L"Tibia",
58+
//...
59+
};
60+
}
61+
};

‎MasterHide/main.cpp‎

Lines changed: 22 additions & 163 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,11 @@
11
#include "stdafx.h"
22

3-
using namespace Tools;
4-
53
void OnDriverUnload( PDRIVER_OBJECT pDriverObject )
64
{
75
UNREFERENCED_PARAMETER( pDriverObject );
86

9-
#ifndef USE_KASPERSKY
10-
DestroySSDT();
11-
DestroyShadowSSDT();
12-
#else
13-
if ( kaspersky::is_klhk_loaded() )
14-
{
15-
if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERBUILDWNDLIST, oNtUserBuildHwndList ) )
16-
DBGPRINT( "Failed to unhook NtUserBuildHwndList" );
17-
18-
if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERWNDFROMPOINT, oNtUserWindowFromPoint ) )
19-
DBGPRINT( "Failed to unhook NtUserWindowFromPoint" );
20-
21-
if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERFINDWNDEX, oNtUserFindWindowEx ) )
22-
DBGPRINT( "Failed to unhook NtUserFindWindowEx" );
23-
24-
if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTGETFOREGROUNDWND, oNtUserGetForegroundWindow ) )
25-
DBGPRINT( "Failed to unhook NtUserGetForegroundWindow" );
26-
27-
if ( !kaspersky::unhook_shadow_ssdt_routine( SYSCALL_NTUSERQUERYWND, oNtUserQueryWindow ) )
28-
DBGPRINT( "Failed to unhook NtUserQueryWindow" );
29-
30-
if ( !kaspersky::unhook_ssdt_routine( SYSCALL_NTQUERYSYSINFO, oNtQuerySystemInformation ) )
31-
DBGPRINT( "Failed to unhook NtQuerySystemInformation" );
32-
33-
if ( !kaspersky::unhook_ssdt_routine( SYSCALL_NTOPENPROCESS, oNtOpenProcess ) )
34-
DBGPRINT( "Failed to unhook NtOpenProcess" );
35-
36-
if ( !kaspersky::unhook_ssdt_routine( SYSCALL_NTALLOCVIRTUALMEM, oNtAllocateVirtualMemory ) )
37-
DBGPRINT( "Failed to unhook NtAllocateVirtualMemory" );
38-
39-
if ( !kaspersky::unhook_ssdt_routine( SYSCALL_NTFREEVIRTUALMEM, oNtFreeVirtualMemory ) )
40-
DBGPRINT( "Failed to unhook NtFreeVirtualMemory" );
41-
42-
if ( !kaspersky::unhook_ssdt_routine( SYSCALL_NTWRITEVIRTUALMEM, oNtWriteVirtualMemory ) )
43-
DBGPRINT( "Failed to unhook NtWriteVirtualMemory" );
44-
45-
if ( !kaspersky::unhook_ssdt_routine( SYSCALL_NTDEVICEIOCTRLFILE, oNtDeviceIoControlFile ) )
46-
DBGPRINT( "Failed to unhook NtDeviceIoControlFile" );
47-
48-
if ( !kaspersky::unhook_ssdt_routine( SYSCALL_NTLOADDRIVER, oNtLoadDriver ) )
49-
DBGPRINT( "Failed to unhook NtLoadDriver" );
50-
}
51-
#endif
7+
ssdt::Destroy();
8+
sssdt::Destroy();
529

5310
//
5411
// Delay the execution for a second to make sure no thread is executing the hooked function
@@ -57,7 +14,7 @@ void OnDriverUnload( PDRIVER_OBJECT pDriverObject )
5714
LargeInteger.QuadPart = -11000000;
5815

5916
KeDelayExecutionThread( KernelMode, FALSE, &LargeInteger );
60-
UnloadImages();
17+
tools::UnloadImages();
6118

6219
DBGPRINT( "Driver unload routine triggered!\n" );
6320
}
@@ -100,49 +57,39 @@ extern "C" NTSTATUS NTAPI DriverEntry( PDRIVER_OBJECT pDriverObject, PUNICODE_ST
10057
//
10158
if ( !bIsWin7 )
10259
{
103-
SYSCALL_NTUSERQUERYWND = Tools::GetWin32Syscall( "NtUserQueryWindow" );
104-
SYSCALL_NTUSERFINDWNDEX = Tools::GetWin32Syscall( "NtUserFindWindowEx" );
105-
SYSCALL_NTUSERWNDFROMPOINT = Tools::GetWin32Syscall( "NtUserWindowFromPoint" );
106-
SYSCALL_NTUSERBUILDWNDLIST = Tools::GetWin32Syscall( "NtUserBuildHwndList" );
107-
SYSCALL_NTGETFOREGROUNDWND = Tools::GetWin32Syscall( "NtUserGetForegroundWindow" );
60+
SYSCALL_NTUSERQUERYWND = tools::GetWin32Syscall( "NtUserQueryWindow" );
61+
SYSCALL_NTUSERFINDWNDEX = tools::GetWin32Syscall( "NtUserFindWindowEx" );
62+
SYSCALL_NTUSERWNDFROMPOINT = tools::GetWin32Syscall( "NtUserWindowFromPoint" );
63+
SYSCALL_NTUSERBUILDWNDLIST = tools::GetWin32Syscall( "NtUserBuildHwndList" );
64+
SYSCALL_NTGETFOREGROUNDWND = tools::GetWin32Syscall( "NtUserGetForegroundWindow" );
10865

109-
SYSCALL_NTOPENPROCESS = Tools::GetNtSyscall( "NtOpenProcess" );
110-
SYSCALL_NTDEVICEIOCTRLFILE = Tools::GetNtSyscall( "NtDeviceIoControlFile" );
111-
SYSCALL_NTQUERYSYSINFO = Tools::GetNtSyscall( "NtQuerySystemInformation" );
112-
SYSCALL_NTALLOCVIRTUALMEM = Tools::GetNtSyscall( "NtAllocateVirtualMemory" );
113-
SYSCALL_NTFREEVIRTUALMEM = Tools::GetNtSyscall( "NtFreeVirtualMemory" );
114-
SYSCALL_NTWRITEVIRTUALMEM = Tools::GetNtSyscall( "NtWriteVirtualMemory" );
115-
SYSCALL_NTLOADDRIVER = Tools::GetNtSyscall( "NtLoadDriver" );
66+
SYSCALL_NTOPENPROCESS = tools::GetNtSyscall( "NtOpenProcess" );
67+
SYSCALL_NTDEVICEIOCTRLFILE = tools::GetNtSyscall( "NtDeviceIoControlFile" );
68+
SYSCALL_NTQUERYSYSINFO = tools::GetNtSyscall( "NtQuerySystemInformation" );
69+
SYSCALL_NTALLOCVIRTUALMEM = tools::GetNtSyscall( "NtAllocateVirtualMemory" );
70+
SYSCALL_NTFREEVIRTUALMEM = tools::GetNtSyscall( "NtFreeVirtualMemory" );
71+
SYSCALL_NTWRITEVIRTUALMEM = tools::GetNtSyscall( "NtWriteVirtualMemory" );
72+
SYSCALL_NTLOADDRIVER = tools::GetNtSyscall( "NtLoadDriver" );
11673
}
11774

11875
#ifndef USE_KASPERSKY
11976
//
12077
// (S)SSDT Hooks are only Win7 compatible ( hardcoded )
12178
//
122-
if ( bIsWin7 )
123-
{
124-
DBGPRINT( "Using normal SSDT Hooking!\n" );
125-
InitializeSSDT();
126-
InitializeShadowSSDT();
127-
}
128-
else
129-
{
130-
DBGPRINT( "Not using kaspersky but (S)SSDT is not supported!\n" );
131-
return STATUS_NOT_SUPPORTED;
132-
}
79+
DBGPRINT( "Not using Kaspersky to hook, Shadow SSDT is unstable!\n" );
13380
#else
134-
DBGPRINT( "Using kaspersky!\n" );
81+
DBGPRINT( "Using Kaspersky!\n" );
13582

13683
if ( !kaspersky::is_klhk_loaded() )
13784
{
138-
UnloadImages();
85+
tools::UnloadImages();
13986
DBGPRINT( "Kaspersky not loaded!\n" );
14087
return STATUS_UNSUCCESSFUL;
14188
}
14289

14390
if ( !kaspersky::initialize() )
14491
{
145-
UnloadImages();
92+
tools::UnloadImages();
14693
DBGPRINT( "Kaspersky init failed!\n" );
14794
return STATUS_UNSUCCESSFUL;
14895
}
@@ -151,103 +98,15 @@ extern "C" NTSTATUS NTAPI DriverEntry( PDRIVER_OBJECT pDriverObject, PUNICODE_ST
15198

15299
if ( !kaspersky::hvm_init() )
153100
{
154-
UnloadImages();
101+
tools::UnloadImages();
155102
DBGPRINT( "Hypervisor not loaded!\n" );
156103
return STATUS_UNSUCCESSFUL;
157104
}
158105

159106
DBGPRINT( "Hypervisor loaded!\n" );
160-
161-
//
162-
// SSDT
163-
//
164-
if ( kaspersky::hook_ssdt_routine( SYSCALL_NTOPENPROCESS, hkNtOpenProcess, reinterpret_cast< PVOID* >( &oNtOpenProcess ) ) )
165-
{
166-
DBGPRINT( "NtOpenProcess ( 0x%X ) hooked successfully!\n", SYSCALL_NTOPENPROCESS );
167-
}
168-
else
169-
DBGPRINT( "Failed to hook NtOpenProcess!\n" );
170-
171-
if ( kaspersky::hook_ssdt_routine( SYSCALL_NTDEVICEIOCTRLFILE, hkNtDeviceIoControlFile, reinterpret_cast< PVOID* >( &oNtDeviceIoControlFile ) ) )
172-
{
173-
DBGPRINT( "NtDeviceIoControlFile ( 0x%X ) hooked successfully!\n", SYSCALL_NTDEVICEIOCTRLFILE );
174-
}
175-
else
176-
DBGPRINT( "Failed to hook NtDeviceIoControlFile!\n" );
177-
178-
if ( kaspersky::hook_ssdt_routine( SYSCALL_NTQUERYSYSINFO, hkNtQuerySystemInformation, reinterpret_cast< PVOID* >( &oNtQuerySystemInformation ) ) )
179-
{
180-
DBGPRINT( "NtQuerySystemInformation ( 0x%X ) hooked successfully!\n", SYSCALL_NTQUERYSYSINFO );
181-
}
182-
else
183-
DBGPRINT( "Failed to hook NtQuerySystemInformation!\n" );
184-
185-
if ( kaspersky::hook_ssdt_routine( SYSCALL_NTALLOCVIRTUALMEM, hkNtAllocateVirtualMemory, reinterpret_cast< PVOID* >( &oNtAllocateVirtualMemory ) ) )
186-
{
187-
DBGPRINT( "NtAllocateVirtualMemory ( 0x%X ) hooked successfully!\n", SYSCALL_NTALLOCVIRTUALMEM );
188-
}
189-
else
190-
DBGPRINT( "Failed to hook NtAllocateVirtualMemory!\n" );
191-
192-
if ( kaspersky::hook_ssdt_routine( SYSCALL_NTFREEVIRTUALMEM, hkNtFreeVirtualMemory, reinterpret_cast< PVOID* >( &oNtFreeVirtualMemory ) ) )
193-
{
194-
DBGPRINT( "NtFreeVirtualMemory ( 0x%X ) hooked successfully!\n", SYSCALL_NTFREEVIRTUALMEM );
195-
}
196-
else
197-
DBGPRINT( "Failed to hook NtFreeVirtualMemory!\n" );
198-
199-
if ( kaspersky::hook_ssdt_routine( SYSCALL_NTWRITEVIRTUALMEM, hkNtWriteVirtualMemory, reinterpret_cast< PVOID* >( &oNtWriteVirtualMemory ) ) )
200-
{
201-
DBGPRINT( "NtWriteVirtualMemory ( 0x%X ) hooked successfully!\n", SYSCALL_NTWRITEVIRTUALMEM );
202-
}
203-
else
204-
DBGPRINT( "Failed to hook NtWriteVirtualMemory!\n" );
205-
206-
if ( kaspersky::hook_ssdt_routine( SYSCALL_NTLOADDRIVER, hkNtLoadDriver, reinterpret_cast< PVOID* >( &oNtLoadDriver ) ) )
207-
{
208-
DBGPRINT( "NtLoadDriver ( 0x%X ) hooked successfully!\n", SYSCALL_NTLOADDRIVER );
209-
}
210-
else
211-
DBGPRINT( "Failed to hook NtLoadDriver!\n" );
212-
213-
//
214-
// Shadow SSDT
215-
//
216-
if ( kaspersky::hook_shadow_ssdt_routine( SYSCALL_NTUSERQUERYWND, hkNtUserQueryWindow, reinterpret_cast< PVOID* >( &oNtUserQueryWindow ) ) )
217-
{
218-
DBGPRINT( "NtUserQueryWindow ( 0x%X ) hooked successfully!\n", SYSCALL_NTUSERQUERYWND );
219-
}
220-
else
221-
DBGPRINT( "Failed to hook NtUserQueryWindow!\n" );
222-
223-
if ( kaspersky::hook_shadow_ssdt_routine( SYSCALL_NTUSERFINDWNDEX, hkNtUserFindWindowEx, reinterpret_cast< PVOID* >( &oNtUserFindWindowEx ) ) )
224-
{
225-
DBGPRINT( "NtUserFindWindowEx ( 0x%X ) hooked successfully!\n", SYSCALL_NTUSERFINDWNDEX );
226-
}
227-
else
228-
DBGPRINT( "Failed to hook NtUserFindWindowEx!\n" );
229-
230-
if ( kaspersky::hook_shadow_ssdt_routine( SYSCALL_NTUSERWNDFROMPOINT, hkNtUserWindowFromPoint, reinterpret_cast< PVOID* >( &oNtUserWindowFromPoint ) ) )
231-
{
232-
DBGPRINT( "NtUserWindowFromPoint ( 0x%X ) hooked successfully!\n", SYSCALL_NTUSERWNDFROMPOINT );
233-
}
234-
else
235-
DBGPRINT( "Failed to hook NtUserWindowFromPoint!\n" );
236-
237-
if ( kaspersky::hook_shadow_ssdt_routine( SYSCALL_NTUSERBUILDWNDLIST, hkNtUserBuildHwndList, reinterpret_cast< PVOID* >( &oNtUserBuildHwndList ) ) )
238-
{
239-
DBGPRINT( "NtUserBuildHwndList ( 0x%X ) hooked successfully!\n", SYSCALL_NTUSERBUILDWNDLIST );
240-
}
241-
else
242-
DBGPRINT( "Failed to hook NtUserBuildHwndList!\n" );
243-
244-
if ( kaspersky::hook_shadow_ssdt_routine( SYSCALL_NTGETFOREGROUNDWND, hkNtUserGetForegroundWindow, reinterpret_cast< PVOID* >( &oNtUserGetForegroundWindow ) ) )
245-
{
246-
DBGPRINT( "NtUserGetForegroundWindow ( 0x%X ) hooked successfully!\n", SYSCALL_NTGETFOREGROUNDWND );
247-
}
248-
else
249-
DBGPRINT( "Failed to hook NtUserGetForegroundWindow!\n" );
250107
#endif
108+
ssdt::Init();
109+
sssdt::Init();
251110
}
252111
else
253112
// No support for other OS

0 commit comments

Comments
 (0)