- Fix "initialization error 1" on Windows 7/8/8.1 and supported (= with known syscall tables) versions of Windows 10
- Zero extend the value of RAX on x64 when returning an NTSTATUS
- Fix access violation on instrumentation callback removal on Windows 7/8/8.1
- Query NtUserGetClassName and NtUserInternalGetWindowText addresses using the new syscall lookup magic
- Add IsWindowBad() helper function which determines for a given HWND not only whether it belongs to the debugger process by PID, but also whether is has a forbidden class name or window text
- FilterHwndList: instead of only comparing against the protected PID, use IsWindowBad() both to determine which HWNDs to overwrite and which ones are good replacements. This allows you to have e.g. IDA and x64dbg open and both will be hidden, even if only x64dbg is actively debugging
IsWindowClassBad and IsWindowNameBad still require 'wcsistr'. Added TODO note to wcsistr to rename it and make it take a PUNICODE_STRING in order to increase sanity levels
ScyllaTest: call FreeConsole before exiting
- Remove _wcslen, _strlen and _wcscat which are already provided as compiler intrinsics and as ntdll exports
- wcsistr (1): fix off-by-one error by changing < to <=, and remove 'if (l1 == l2)' check because the for loop already does the same thing
- wcsistr (2): fix bug introduced by me causing wcsistr(L"asdf", L"asd") to return false. Now we're back to using _wcsicmp and _wcsnicmp together
- Misc dead code removal/variable naming
Currently this is done by PID *for the debugger process only* (i.e., it does not work when using the CLI, and it does not hide a process handle from windbg.exe to the debuggee if ScyllaHide is running as an x64dbg plugin)
- For ProcessInformationClass == ProcessHandleTracing, turned ProcessInformationLength == 0 into a valid case. This disables tracing and causes all other parameter checks to be skipped, so passing e.g. a bogus pointer with ProcessInformationLength 0 will still succeed. This is as per the real function
- For ProcessInformationClass == ProcessHandleTracing, ValueProcessBreakOnTermination can now be set to false (in the case that length is 0 as noted above). Previously calling the function would always 'enable' the flag, even when called with parameters that should disable it
- Moved 'ProcessInformation != 0' checks for ProcessHandleTracing and ProcessBreakOnTermination cases further down and turned them into faux access violations. We can let the real NtSetInformationProcess take the AVs, but the problem with this is that the order of parameter checks would be subtly changed.
- Test whether the struct passed in for ProcessHandleTracing (PROCESS_HANDLE_TRACING_ENABLE/PROCESS_HANDLE_TRACING_ENABLE_EX) has Flags set to 0, the only allowed value. Other values now cause STATUS_INVALID_PARAMETER instead of success
- The ProcessBreakOnTermination flag may only be set by a process that has debug privileges enabled. This is now enforced by querying the process token privileges and returning STATUS_PRIVILEGE_NOT_HELD if it doesn't have debug privileges. Because this check occurs fairly deep within the real NtSetInformationProcess, I've also had to add length and null pointer checks before the privilege check to preserve the order of parameter validation
Matthijs Lavrijsen