- Query NtUserGetClassName and NtUserInternalGetWindowText addresses using the new syscall lookup magic
- Add IsWindowBad() helper function which determines for a given HWND not only whether it belongs to the debugger process by PID, but also whether is has a forbidden class name or window text
- FilterHwndList: instead of only comparing against the protected PID, use IsWindowBad() both to determine which HWNDs to overwrite and which ones are good replacements. This allows you to have e.g. IDA and x64dbg open and both will be hidden, even if only x64dbg is actively debugging
- Get rid of NtApiLoader and replace it with a syscall lookup table (Windows XP through early 10) or win32u.dll addresses (later Windows 10 versions)
- Remove NtApiTool/PDBReader project since the NtApiCollection.ini file it generates is no longer used
- Rename BlockInput hook to NtUserBlockInput since they are the same function. The INI setting "BlockInputHook" is now also NtUserBlockInputHook
- Merge ApplyUser32Hook and ApplyWin32uHook into ApplyUserHook
Ntdll is in \KnownDLLs, it always has the same image base in all processes. Note/TODO: this does not prevent a process from manually mapping ntdll at more than one address, but this was never detected in the first place
Currently this is done by PID *for the debugger process only* (i.e., it does not work when using the CLI, and it does not hide a process handle from windbg.exe to the debuggee if ScyllaHide is running as an x64dbg plugin)
This stops my 5 year old niece's "MZ" scanner from finding HookLibrary.dll. The headers were never needed by HookLibrary itself, as evidenced by the fact that we were copying the headers with the wrong (non-relocated) base address anyway.
Wiping the headers in MapModuleToProcess() is optional so as to not further break injection of other DLLs than HookLibrary (which should theoretically be possible according to legends)
Matthijs Lavrijsen