mirror of
https://github.com/x64dbg/ScyllaHide
synced 2026-06-08 18:22:18 +00:00
Mattiwatti
956fea4e6d
- Query NtUserGetClassName and NtUserInternalGetWindowText addresses using the new syscall lookup magic - Add IsWindowBad() helper function which determines for a given HWND not only whether it belongs to the debugger process by PID, but also whether is has a forbidden class name or window text - FilterHwndList: instead of only comparing against the protected PID, use IsWindowBad() both to determine which HWNDs to overwrite and which ones are good replacements. This allows you to have e.g. IDA and x64dbg open and both will be hidden, even if only x64dbg is actively debugging
51 lines
1.7 KiB
C
51 lines
1.7 KiB
C
#pragma once
|
|
|
|
#include <ntdll/ntdll.h>
|
|
|
|
FORCEINLINE ULONG NTAPI RtlNtMajorVersion()
|
|
{
|
|
return *(PULONG)(0x7FFE0000 + 0x26C);
|
|
}
|
|
|
|
FORCEINLINE ULONG NTAPI RtlNtMinorVersion()
|
|
{
|
|
return *(PULONG)(0x7FFE0000 + 0x270);
|
|
}
|
|
|
|
FORCEINLINE ULONG NTAPI RtlGetTickCount()
|
|
{
|
|
return (ULONG)(*(PULONG64)(0x7FFE0000 + 0x320) * *(PULONG)(0x7FFE0000 + 0x4) >> 24);
|
|
}
|
|
|
|
bool HasDebugPrivileges(HANDLE hProcess);
|
|
bool IsWow64Process(HANDLE ProcessHandle);
|
|
NTSTATUS InstallInstrumentationCallbackHook(HANDLE ProcessHandle, BOOLEAN Remove);
|
|
DWORD GetExplorerProcessId();
|
|
DWORD GetProcessIdByName(PUNICODE_STRING processName);
|
|
bool IsProcessNameBad(PUNICODE_STRING processName);
|
|
|
|
DWORD GetProcessIdByProcessHandle(HANDLE hProcess);
|
|
DWORD GetProcessIdByThreadHandle(HANDLE hThread);
|
|
|
|
bool RtlUnicodeStringContains(PUNICODE_STRING Str, PUNICODE_STRING SubStr, BOOLEAN CaseInsensitive);
|
|
|
|
bool IsWindowNameBad(PUNICODE_STRING windowName);
|
|
bool IsWindowClassNameBad(PUNICODE_STRING className);
|
|
bool IsWindowBad(HWND hWnd);
|
|
bool IsObjectTypeBad(USHORT objectTypeIndex);
|
|
|
|
int ThreadDebugContextFindFreeSlotIndex();
|
|
int ThreadDebugContextFindExistingSlotIndex();
|
|
void ThreadDebugContextRemoveEntry(const int index);
|
|
void ThreadDebugContextSaveContext(const int index, const PCONTEXT ThreadContext);
|
|
|
|
void NTAPI RealGetSystemTime(PSYSTEMTIME lpSystemTime);
|
|
void NTAPI RealGetLocalTime(LPSYSTEMTIME lpSystemTime);
|
|
void IncreaseSystemTime(LPSYSTEMTIME lpTime);
|
|
|
|
void TerminateProcessByProcessId(DWORD dwProcess);
|
|
bool WriteMalwareToDisk(LPCVOID buffer, DWORD bufferSize, DWORD_PTR imagebase);
|
|
bool WriteMemoryToFile(const WCHAR * filename, LPCVOID buffer, DWORD bufferSize, DWORD_PTR imagebase);
|
|
void * GetPEBRemote(HANDLE hProcess);
|
|
void DumpMalware(DWORD dwProcessId);
|