- Fix "initialization error 1" on Windows 7/8/8.1 and supported (= with known syscall tables) versions of Windows 10
- Zero extend the value of RAX on x64 when returning an NTSTATUS
- Fix access violation on instrumentation callback removal on Windows 7/8/8.1
- Do not return the real PID or TID of any window with a bad owner process, window class name or title
- Instead of returning a bogus handle, return the debuggee's own client ID
NtUserBuildHwndList gained a boolean parameter in Windows 8, which breaks the call because the original syscall is called with one less argument (which results in STATUS_INVALID_HANDLE). Work around this by exporting a separate HookedNtUserBuildHwndList_Eight function that uses the new prototype. Replace the HOOK_NATIVE() invocation in ApplyHooking.cpp with a manual version that determines the hook to use based on the OS version
- Query NtUserGetClassName and NtUserInternalGetWindowText addresses using the new syscall lookup magic
- Add IsWindowBad() helper function which determines for a given HWND not only whether it belongs to the debugger process by PID, but also whether is has a forbidden class name or window text
- FilterHwndList: instead of only comparing against the protected PID, use IsWindowBad() both to determine which HWNDs to overwrite and which ones are good replacements. This allows you to have e.g. IDA and x64dbg open and both will be hidden, even if only x64dbg is actively debugging
- Get rid of NtApiLoader and replace it with a syscall lookup table (Windows XP through early 10) or win32u.dll addresses (later Windows 10 versions)
- Remove NtApiTool/PDBReader project since the NtApiCollection.ini file it generates is no longer used
- Rename BlockInput hook to NtUserBlockInput since they are the same function. The INI setting "BlockInputHook" is now also NtUserBlockInputHook
- Merge ApplyUser32Hook and ApplyWin32uHook into ApplyUserHook
This is actually part of the NtClose hook (in that NtClose is the problem, not NtDuplicateObject), it's just that NtDuplicateObject with DUPLICATE_CLOSE_SOURCE is a very clever way of calling NtClose inside the kernel where our ntdll hook obviously doesn't fly
Reported by _BaZzi (https://forum.tuts4you.com/topic/35191-scyllahide/?page=9&tab=comments#comment-189015)
This was caused by an incorrect order of operations (modifying return length after changing the return status).
In the interest of saving time on both sides, pre-emptively fix this for other syscalls/classes as well
This prevents the debuggee from doing
NtCreateDebugObject(&h);
NtQueryObject(h, ObjectTypeInformation);
if (TotalNumberOfObjects == 0) { /* something is wrong since we just made a debug object */ }
Found by Al-Khaser (https://github.com/LordNoteworthy/al-khaser)
IsWindowClassBad and IsWindowNameBad still require 'wcsistr'. Added TODO note to wcsistr to rename it and make it take a PUNICODE_STRING in order to increase sanity levels
ScyllaTest: call FreeConsole before exiting
- Remove _wcslen, _strlen and _wcscat which are already provided as compiler intrinsics and as ntdll exports
- wcsistr (1): fix off-by-one error by changing < to <=, and remove 'if (l1 == l2)' check because the for loop already does the same thing
- wcsistr (2): fix bug introduced by me causing wcsistr(L"asdf", L"asd") to return false. Now we're back to using _wcsicmp and _wcsnicmp together
- Misc dead code removal/variable naming
Currently this is done by PID *for the debugger process only* (i.e., it does not work when using the CLI, and it does not hide a process handle from windbg.exe to the debuggee if ScyllaHide is running as an x64dbg plugin)
Matthijs Lavrijsen