├── General.props ├── IntegrityCheck.props ├── README.md ├── RHGUI ├── HiddenRegistryKey.pas ├── MainForm.dfm ├── MainForm.pas ├── NewPseudoValueForm.dfm ├── NewPseudoValueForm.pas ├── PseudoRegistryValue.pas ├── RHGUI.dpr ├── RHGUI.dproj ├── RHGUI.res └── Utils.pas ├── StaticLibrary.props ├── bin ├── Win32 │ └── Release │ │ ├── RHGUI.exe │ │ ├── ndisprot6-test.exe │ │ ├── ndisprot6.sys │ │ ├── reghider.dll │ │ └── reghider.sys └── x64 │ └── Release │ ├── RHGUI.exe │ ├── ndisprot6-test.exe │ ├── ndisprot6.sys │ ├── reghider.dll │ └── reghider.sys ├── dllreghider ├── dllreghider.c ├── dllreghider.vcxproj └── dllreghider.vcxproj.filters ├── hackerfest2015.sln ├── hackerfest2015.suo ├── hackerfest2015.v12.suo ├── hfdetector ├── FileSystemObject.h ├── hfdetector.cpp ├── hfdetector.vcxproj ├── hfdetector.vcxproj.filters ├── utils.cpp └── utils.h ├── include ├── DllRegHider.pas ├── __history │ ├── DllRegHider.pas.~37~ │ ├── DllRegHider.pas.~38~ │ ├── DllRegHider.pas.~39~ │ ├── DllRegHider.pas.~40~ │ ├── DllRegHider.pas.~41~ │ ├── DllRegHider.pas.~42~ │ ├── DllRegHider.pas.~43~ │ ├── DllRegHider.pas.~44~ │ ├── DllRegHider.pas.~45~ │ └── DllRegHider.pas.~46~ ├── dllreghider.h ├── libreghider-types.h ├── libreghider.h ├── reghider-ioctl.h └── reghider-types.h ├── libreghider ├── ReadMe.txt ├── libreghider.c ├── libreghider.vcxproj └── libreghider.vcxproj.filters ├── ndisprot6-test ├── ip-headers.h ├── ndisprot6-test.vcxproj ├── ndisprot6-test.vcxproj.filters └── prottest.c ├── ndisprot6 ├── debug.c ├── debug.h ├── excallbk.c ├── macros.h ├── ndisbind.c ├── ndisprot.h ├── ndisprot.htm ├── ndisprot.inf ├── ndisprot.rc ├── ndisprot6.vcxproj ├── ndisprot6.vcxproj.filters ├── ntdisp.c ├── precomp.h ├── protuser.h ├── recv.c └── send.c ├── ppt ├── hiding-things-on-windows-platform.odp ├── hiding-things-on-windows-platform.pdf └── registry.avi └── reghider ├── allocator.c ├── allocator.h ├── hash_table.c ├── hash_table.h ├── key-record.c ├── key-record.h ├── preprocessor.h ├── process-db.c ├── process-db.h ├── reghider.c ├── reghider.h ├── reghider.v12.suo ├── reghider.vcxproj ├── reghider.vcxproj.filters ├── registry-callback.c ├── registry-callback.h ├── string-hash-table.c ├── string-hash-table.h ├── um-services.c ├── um-services.h ├── utils-dym-array-types.h ├── utils-dym-array.c └── utils-dym-array.h /General.props: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | $(SolutionDir)bin\$(Platform)\$(Configuration)\ 7 | $(SolutionDir)tmp\$(ProjectName)\$(Platform)\$(Configuration)\ 8 | 9 | 10 | 11 | ..\include;%(AdditionalIncludeDirectories) 12 | 4100;4603;4627;4986;4987;4996;%(DisableSpecificWarnings) 13 | 14 | 15 | $(SolutionDir)lib\$(Platform)\$(Configuration);$(SolutionDir)lib\$(Platform);..\lib\$(Platform)\$(Configuration);..\lib\$(Platform);%(AdditionalLibraryDirectories) 16 | 17 | 18 | 19 | -------------------------------------------------------------------------------- /IntegrityCheck.props: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | /INTEGRITYCHECK %(AdditionalOptions) 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Hackerfest2015 2 | Demos presented on Hackerfest 2015 3 | 4 | * No driver files are digitally signed with trusted certificate so you either need to sign them by yourself, or sign them by a test signing certificate and configure your system to support this feature. 5 | 6 | * Rename dllreghider.dll to reghider.dll and the RHGUI.exe should work. 7 | 8 | * You should follow special instructions in order to install the ndisprot6 driver. Look into the ndisprot6\ndisprot.htm file for them. 9 | * After you install the driver, you also must update the ImageFIleName value in its service registry key to point to the ndisprot6.sys file, not the ndisprot.sys one (because it does not exist). I am probably missing something in the INF file. 10 | -------------------------------------------------------------------------------- /RHGUI/HiddenRegistryKey.pas: -------------------------------------------------------------------------------- 1 | Unit HiddenRegistryKey; 2 | 3 | Interface 4 | 5 | Uses 6 | Windows, DllRegHider, Generics.Collections; 7 | 8 | Type 9 | THiddenRegistryKey = Class 10 | Private 11 | FName : WideString; 12 | Public 13 | Constructor Create(Var ARecord:REGHIDER_HIDDEN_KEY_RECORD); Reintroduce; 14 | 15 | Class Function Enumerate(AList:TList):Cardinal; 16 | 17 | Property Name : WideString Read FName; 18 | end; 19 | 20 | Implementation 21 | 22 | Uses 23 | Utils; 24 | 25 | Function _EnumCallback(Var ARecord:REGHIDER_HIDDEN_KEY_RECORD; AContext:Pointer):LongBool; StdCall; 26 | Var 27 | key : THiddenRegistryKey; 28 | list : TList; 29 | begin 30 | list := AContext; 31 | Try 32 | key := THiddenRegistryKey.Create(ARecord); 33 | Result := True; 34 | Except 35 | Result := False; 36 | End; 37 | 38 | If Result Then 39 | begin 40 | Try 41 | list.Add(key); 42 | Except 43 | key.Free; 44 | Result := False; 45 | end; 46 | end; 47 | end; 48 | 49 | Constructor THiddenRegistryKey.Create(Var ARecord:REGHIDER_HIDDEN_KEY_RECORD); 50 | begin 51 | Inherited Create; 52 | FName := WideCharToString(ARecord.KeyName); 53 | end; 54 | 55 | Class Function THiddenRegistryKey.Enumerate(AList:TList):Cardinal; 56 | Var 57 | key : THiddenRegistryKey; 58 | tmpList : TList; 59 | begin 60 | tmpList := TList.Create; 61 | Result := HiddenKeysEnum(_EnumCallback, tmpList); 62 | If Result = ERROR_SUCCESS Then 63 | begin 64 | For key In tmpList Do 65 | AList.Add(key); 66 | end; 67 | 68 | tmpList.Free; 69 | end; 70 | 71 | 72 | 73 | End. 74 | 75 | -------------------------------------------------------------------------------- /RHGUI/MainForm.dfm: -------------------------------------------------------------------------------- 1 | object Form1: TForm1 2 | Left = 0 3 | Top = 0 4 | Caption = 'Registry Hider' 5 | ClientHeight = 362 6 | ClientWidth = 591 7 | Color = clBtnFace 8 | Font.Charset = DEFAULT_CHARSET 9 | Font.Color = clWindowText 10 | Font.Height = -11 11 | Font.Name = 'Tahoma' 12 | Font.Style = [] 13 | OldCreateOrder = False 14 | Position = poScreenCenter 15 | OnClose = FormClose 16 | OnCreate = FormCreate 17 | PixelsPerInch = 96 18 | TextHeight = 13 19 | object HiddenRegistryKeysGroupBox: TGroupBox 20 | Left = 0 21 | Top = 0 22 | Width = 591 23 | Height = 169 24 | Align = alTop 25 | Anchors = [akLeft, akTop, akRight, akBottom] 26 | Caption = 'Hidden registry keys' 27 | TabOrder = 0 28 | object HiddenRegistryKeysPanel: TPanel 29 | Left = 2 30 | Top = 134 31 | Width = 587 32 | Height = 33 33 | Align = alBottom 34 | TabOrder = 0 35 | object HiddenKeysAddButton: TButton 36 | Left = 8 37 | Top = 8 38 | Width = 57 39 | Height = 21 40 | Caption = 'Add...' 41 | TabOrder = 0 42 | OnClick = AddButtonClick 43 | end 44 | object HiddenKeysDeleteButton: TButton 45 | Left = 71 46 | Top = 8 47 | Width = 57 48 | Height = 21 49 | Caption = 'Delete' 50 | TabOrder = 1 51 | OnClick = DeleteButtonClick 52 | end 53 | object HiddenKeysRefreshButton: TButton 54 | Left = 134 55 | Top = 8 56 | Width = 57 57 | Height = 21 58 | Caption = 'Refresh' 59 | TabOrder = 2 60 | OnClick = RefreshButtonClick 61 | end 62 | end 63 | object HiddenKeysListView: TListView 64 | Left = 2 65 | Top = 15 66 | Width = 587 67 | Height = 119 68 | Align = alClient 69 | Columns = < 70 | item 71 | AutoSize = True 72 | Caption = 'Name' 73 | end> 74 | OwnerData = True 75 | ReadOnly = True 76 | RowSelect = True 77 | ShowWorkAreas = True 78 | TabOrder = 1 79 | ViewStyle = vsReport 80 | OnData = ListViewData 81 | end 82 | end 83 | object PseudoRegistryValuesGroupBox: TGroupBox 84 | Left = 0 85 | Top = 169 86 | Width = 591 87 | Height = 193 88 | Align = alBottom 89 | Anchors = [akLeft, akTop, akRight, akBottom] 90 | Caption = 'Registry pseudo values' 91 | TabOrder = 1 92 | object PseudoRegistryValuesPanel: TPanel 93 | Left = 2 94 | Top = 158 95 | Width = 587 96 | Height = 33 97 | Align = alBottom 98 | TabOrder = 0 99 | ExplicitTop = 149 100 | object PseudoValuesAddButton: TButton 101 | Left = 8 102 | Top = 6 103 | Width = 57 104 | Height = 21 105 | Caption = 'Add...' 106 | TabOrder = 0 107 | OnClick = AddButtonClick 108 | end 109 | object PseudoValuesDeleteButton: TButton 110 | Left = 127 111 | Top = 6 112 | Width = 57 113 | Height = 21 114 | Caption = 'Delete' 115 | TabOrder = 1 116 | OnClick = DeleteButtonClick 117 | end 118 | object PseudoValuesRefreshButton: TButton 119 | Left = 190 120 | Top = 6 121 | Width = 57 122 | Height = 21 123 | Caption = 'Refresh' 124 | TabOrder = 2 125 | OnClick = RefreshButtonClick 126 | end 127 | object PseudoValueEditButton: TButton 128 | Left = 71 129 | Top = 6 130 | Width = 57 131 | Height = 21 132 | Caption = 'Edit...' 133 | TabOrder = 3 134 | OnClick = AddButtonClick 135 | end 136 | end 137 | object PseudoValuesListView: TListView 138 | Left = 2 139 | Top = 15 140 | Width = 587 141 | Height = 143 142 | Align = alClient 143 | Columns = < 144 | item 145 | AutoSize = True 146 | Caption = 'Key' 147 | end 148 | item 149 | Caption = 'Value' 150 | Width = 100 151 | end 152 | item 153 | Caption = 'Type' 154 | Width = 100 155 | end 156 | item 157 | Caption = 'Modes' 158 | Width = 100 159 | end 160 | item 161 | AutoSize = True 162 | Caption = 'Data' 163 | end 164 | item 165 | AutoSize = True 166 | Caption = 'Process' 167 | end> 168 | OwnerData = True 169 | ReadOnly = True 170 | RowSelect = True 171 | ShowWorkAreas = True 172 | TabOrder = 1 173 | ViewStyle = vsReport 174 | OnData = ListViewData 175 | ExplicitHeight = 134 176 | end 177 | end 178 | end 179 | -------------------------------------------------------------------------------- /RHGUI/MainForm.pas: -------------------------------------------------------------------------------- 1 | Unit MainForm; 2 | 3 | Interface 4 | 5 | Uses 6 | Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, 7 | System.Classes, Vcl.Graphics, 8 | Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Vcl.ExtCtrls, 9 | Vcl.ComCtrls, 10 | Generics.Collections, HiddenRegistryKey, PseudoRegistryValue; 11 | 12 | Type 13 | TForm1 = Class (TForm) 14 | HiddenRegistryKeysGroupBox: TGroupBox; 15 | PseudoRegistryValuesGroupBox: TGroupBox; 16 | HiddenRegistryKeysPanel: TPanel; 17 | PseudoRegistryValuesPanel: TPanel; 18 | HiddenKeysAddButton: TButton; 19 | HiddenKeysDeleteButton: TButton; 20 | HiddenKeysRefreshButton: TButton; 21 | PseudoValuesAddButton: TButton; 22 | PseudoValuesDeleteButton: TButton; 23 | PseudoValuesRefreshButton: TButton; 24 | HiddenKeysListView: TListView; 25 | PseudoValuesListView: TListView; 26 | PseudoValueEditButton: TButton; 27 | procedure FormCreate(Sender: TObject); 28 | procedure FormClose(Sender: TObject; var Action: TCloseAction); 29 | procedure AddButtonClick(Sender: TObject); 30 | procedure RefreshButtonClick(Sender: TObject); 31 | procedure DeleteButtonClick(Sender: TObject); 32 | procedure ListViewData(Sender: TObject; Item: TListItem); 33 | Private 34 | FHiddenkeyList : TList; 35 | FPSeudoValueList : TList; 36 | 37 | Procedure HiddenKeysRefresh; 38 | Procedure PseudoValuesRefresh; 39 | end; 40 | 41 | Var 42 | Form1: TForm1; 43 | 44 | Implementation 45 | 46 | Uses 47 | Utils, DllRegHider, NewPseudoValueForm; 48 | 49 | {$R *.DFM} 50 | 51 | Procedure TForm1.HiddenKeysRefresh; 52 | Var 53 | key : THiddenRegistryKey; 54 | err : Cardinal; 55 | tmpList : TList; 56 | tmpList2 : TList; 57 | begin 58 | tmpList := TList.Create; 59 | err := THiddenRegistryKey.Enumerate(tmpList); 60 | If err = ERROR_SUCCESS Then 61 | begin 62 | HiddenKeysListView.Items.Count := 0; 63 | tmpList2 := FHiddenKeyList; 64 | FHiddenKeyList := tmpList; 65 | tmpList := tmpList2; 66 | HiddenKeysListView.Items.Count := FHiddenKeyList.Count; 67 | end 68 | Else WindowsErrorMessage(err, 'Failed to enumerate hidden subkeys', []); 69 | 70 | For key In tmplist Do 71 | key.Free; 72 | 73 | tmpList.Free; 74 | end; 75 | 76 | Procedure TForm1.ListViewData(Sender: TObject; Item: TListItem); 77 | Var 78 | value : TPseudoRegistryValue; 79 | key : THiddenRegistryKey; 80 | begin 81 | If Sender = HiddenKeysListView Then 82 | begin 83 | With Item Do 84 | begin 85 | key := FHiddenkeyList[Index]; 86 | Caption := key.Name; 87 | end; 88 | end 89 | Else If Sender = PseudoValuesListView Then 90 | begin 91 | With Item Do 92 | begin 93 | value := FPseudoValueList[Index]; 94 | Caption := value.KeyName; 95 | SubItems.Add(value.ValueName); 96 | SubItems.Add(RegistryValueTypeToStr(value.ValueType)); 97 | SubItems.Add(Format('%s | %s', [RegistryValueOpModeToStr(value.ChangeMode), RegistryValueOpModeToStr(value.DeleteMode)])); 98 | SubItems.Add('Not implemented'); 99 | SubItems.Add(value.ProcessName); 100 | end; 101 | end; 102 | end; 103 | 104 | Procedure TForm1.PseudoValuesRefresh; 105 | Var 106 | value : TPseudoRegistryValue; 107 | err : Cardinal; 108 | tmpList : TList; 109 | tmpList2 : TList; 110 | begin 111 | tmpList := TList.Create; 112 | err := TPseudoRegistryValue.Enumerate(tmpList); 113 | If err = ERROR_SUCCESS Then 114 | begin 115 | PseudoValuesListView.Items.Count := 0; 116 | tmpList2 := FPseudoValueList; 117 | FPseudoValueList := tmpList; 118 | tmpList := tmpList2; 119 | PseudoValuesListView.Items.Count := FPseudoValueList.Count; 120 | end 121 | Else WindowsErrorMessage(err, 'Failed to enumerate pseudo values', []); 122 | 123 | For value In tmplist Do 124 | value.Free; 125 | 126 | tmpList.Free; 127 | end; 128 | 129 | Procedure TForm1.RefreshButtonClick(Sender: TObject); 130 | begin 131 | If Sender = HiddenKeysRefreshButton Then 132 | HiddenKeysRefresh 133 | Else If Sender = PseudoValuesRefreshButton Then 134 | PseudoValuesRefresh; 135 | end; 136 | 137 | Procedure TForm1.AddButtonClick(Sender: TObject); 138 | Var 139 | err : Cardinal; 140 | kn : WideString; 141 | L : TListItem; 142 | begin 143 | If Sender = HiddenKeysAddButton Then 144 | begin 145 | kn := InputBox('Hide a key', 'Full key name', ''); 146 | If kn <> '' Then 147 | begin 148 | err := HiddenKeyAdd(PWideChar(kn)); 149 | If err = ERROR_SUCCESS Then 150 | HiddenKeysRefresh; 151 | 152 | If err <> ERROR_SUCCESS Then 153 | WindowsErrorMessage(err, '', []); 154 | end; 155 | end 156 | Else If Sender = PseudoValuesAddButton Then 157 | begin 158 | With TNewPseudoValueFrm.Create(Application) Do 159 | begin 160 | ShowModal; 161 | If Not Cancelled Then 162 | begin 163 | err := PseudoValueAdd(PWideChar(KeyName), PWideChar(ValueName), ValueType, ValueData, ValueDataLength, DeleteMode, ChangeMode, PWideChar(ProcessName)); 164 | If err = ERROR_SUCCESS Then 165 | PseudoValuesRefresh; 166 | 167 | If err <> ERROR_SUCCESS Then 168 | WindowsErrorMessage(err, '', []); 169 | end; 170 | 171 | Free; 172 | end; 173 | end 174 | Else If Sender = PseudoValueEditButton Then 175 | begin 176 | L := PseudoValuesListView.Selected; 177 | If Assigned(L) Then 178 | begin 179 | With TNewPseudoValueFrm.Create(Application, FPseudoValueList[L.Index]) Do 180 | begin 181 | ShowModal; 182 | If Not Cancelled Then 183 | begin 184 | err := PseudoValueSet(PWideChar(KeyName), PWideChar(ValueName), ValueType, ValueData, ValueDataLength, DeleteMode, ChangeMode, PWideChar(ProcessName)); 185 | If err = ERROR_SUCCESS Then 186 | PseudoValuesRefresh; 187 | 188 | If err <> ERROR_SUCCESS Then 189 | WindowsErrorMessage(err, '', []); 190 | end; 191 | 192 | Free; 193 | end; 194 | end; 195 | end; 196 | end; 197 | 198 | Procedure TForm1.DeleteButtonClick(Sender: TObject); 199 | Var 200 | err : Cardinal; 201 | value : TPseudoRegistryValue; 202 | key : THiddenRegistryKey; 203 | L : TListItem; 204 | begin 205 | err := ERROR_SUCCESS; 206 | If Sender = HiddenKeysDeleteButton Then 207 | begin 208 | L := HiddenKeysListView.Selected; 209 | If Assigned(L) Then 210 | begin 211 | key := FHiddenKeyList[L.Index]; 212 | err := HiddenKeyDelete(PWideChar(key.Name)); 213 | If err = ERROR_SUCCESS Then 214 | HiddenKeysRefresh; 215 | end; 216 | end 217 | Else If Sender = PseudoValuesDeleteButton Then 218 | begin 219 | L := PseudoValuesListView.Selected; 220 | If Assigned(L) Then 221 | begin 222 | value := FPseudoValueList[L.Index]; 223 | err := PseudoValueDelete(PWideChar(value.KeyName), PWideChar(value.ValueName)); 224 | If err = ERROR_SUCCESS Then 225 | PseudoValuesRefresh; 226 | end; 227 | end; 228 | 229 | If err <> ERROR_SUCCESS Then 230 | WindowsErrorMessage(err, '', []); 231 | end; 232 | 233 | Procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction); 234 | Var 235 | key : THiddenRegistryKey; 236 | value : TPseudoRegistryValue; 237 | begin 238 | PseudoValuesListView.Items.Count := 0; 239 | For value In FPseudoValueList Do 240 | value.Free; 241 | 242 | FPseudoValueList.Free; 243 | HiddenKeysListView.Items.Count := 0; 244 | For key In FHiddenkeyList Do 245 | key.Free; 246 | 247 | FHiddenKeyList.Free; 248 | end; 249 | 250 | Procedure TForm1.FormCreate(Sender: TObject); 251 | begin 252 | FHiddenKeyList := TList.Create; 253 | FPseudoValueList := TList.Create; 254 | HiddenKeysRefresh; 255 | PseudoValuesRefresh; 256 | end; 257 | 258 | End. 259 | 260 | -------------------------------------------------------------------------------- /RHGUI/NewPseudoValueForm.dfm: -------------------------------------------------------------------------------- 1 | object NewPseudoValueFrm: TNewPseudoValueFrm 2 | Left = 0 3 | Top = 0 4 | BorderIcons = [biSystemMenu] 5 | Caption = 'NewPseudoValueFrm' 6 | ClientHeight = 341 7 | ClientWidth = 333 8 | Color = clBtnFace 9 | Font.Charset = DEFAULT_CHARSET 10 | Font.Color = clWindowText 11 | Font.Height = -11 12 | Font.Name = 'Tahoma' 13 | Font.Style = [] 14 | OldCreateOrder = False 15 | Position = poScreenCenter 16 | OnCreate = FormCreate 17 | OnDestroy = FormDestroy 18 | PixelsPerInch = 96 19 | TextHeight = 13 20 | object MainPanel: TPanel 21 | Left = 0 22 | Top = 0 23 | Width = 333 24 | Height = 306 25 | Align = alTop 26 | TabOrder = 0 27 | object ExtraInformationGroupBox: TGroupBox 28 | Left = 1 29 | Top = 188 30 | Width = 331 31 | Height = 111 32 | Align = alTop 33 | Caption = 'Extra information' 34 | TabOrder = 0 35 | object Label4: TLabel 36 | Left = 3 37 | Top = 20 38 | Width = 66 39 | Height = 13 40 | Caption = 'Process name' 41 | end 42 | object Label5: TLabel 43 | Left = 3 44 | Top = 43 45 | Width = 66 46 | Height = 13 47 | Caption = 'Change mode' 48 | end 49 | object Label6: TLabel 50 | Left = 3 51 | Top = 70 52 | Width = 60 53 | Height = 13 54 | Caption = 'Delete mode' 55 | end 56 | object ProcessNameEdit: TEdit 57 | Left = 72 58 | Top = 16 59 | Width = 184 60 | Height = 21 61 | TabOrder = 0 62 | end 63 | object ChangeModeComboBox: TComboBox 64 | Left = 72 65 | Top = 43 66 | Width = 105 67 | Height = 21 68 | Style = csDropDownList 69 | ItemIndex = 0 70 | TabOrder = 1 71 | Text = 'Deny' 72 | Items.Strings = ( 73 | 'Deny' 74 | 'Allow' 75 | 'Pretend') 76 | end 77 | object DeleteModeComboBox: TComboBox 78 | Left = 72 79 | Top = 70 80 | Width = 105 81 | Height = 21 82 | Style = csDropDownList 83 | ItemIndex = 0 84 | TabOrder = 2 85 | Text = 'Deny' 86 | Items.Strings = ( 87 | 'Deny' 88 | 'Allow' 89 | 'Pretend') 90 | end 91 | end 92 | object DataGroupBox: TGroupBox 93 | Left = 1 94 | Top = 105 95 | Width = 331 96 | Height = 83 97 | Align = alTop 98 | Caption = 'Data' 99 | TabOrder = 1 100 | object ValueDataRichEdit: TRichEdit 101 | Left = 2 102 | Top = 15 103 | Width = 327 104 | Height = 66 105 | Align = alClient 106 | Font.Charset = EASTEUROPE_CHARSET 107 | Font.Color = clWindowText 108 | Font.Height = -11 109 | Font.Name = 'Tahoma' 110 | Font.Style = [] 111 | ParentFont = False 112 | PlainText = True 113 | TabOrder = 0 114 | end 115 | end 116 | object BasicInformationGroupBox: TGroupBox 117 | Left = 1 118 | Top = 1 119 | Width = 331 120 | Height = 104 121 | Align = alTop 122 | Caption = 'Basic information' 123 | TabOrder = 2 124 | object Label1: TLabel 125 | Left = 11 126 | Top = 19 127 | Width = 47 128 | Height = 13 129 | Caption = 'Key name' 130 | end 131 | object Label2: TLabel 132 | Left = 11 133 | Top = 46 134 | Width = 55 135 | Height = 13 136 | Caption = 'Value name' 137 | end 138 | object Label3: TLabel 139 | Left = 11 140 | Top = 70 141 | Width = 24 142 | Height = 13 143 | Caption = 'Type' 144 | end 145 | object KeyNameEdit: TEdit 146 | Left = 72 147 | Top = 16 148 | Width = 256 149 | Height = 21 150 | TabOrder = 0 151 | end 152 | object ValueNameEdit: TEdit 153 | Left = 72 154 | Top = 43 155 | Width = 256 156 | Height = 21 157 | TabOrder = 1 158 | end 159 | object ValueTypeComboBox: TComboBox 160 | Left = 72 161 | Top = 70 162 | Width = 105 163 | Height = 21 164 | Style = csDropDownList 165 | ItemIndex = 1 166 | TabOrder = 2 167 | Text = 'REG_BINARY' 168 | Items.Strings = ( 169 | 'REG_NONE' 170 | 'REG_BINARY' 171 | 'REG_DWORD' 172 | 'REG_QWORD' 173 | 'REG_SZ' 174 | 'REG_EXPAND_SZ' 175 | 'REG_MULTI_SZ') 176 | end 177 | end 178 | end 179 | object OkButton: TButton 180 | Left = 192 181 | Top = 312 182 | Width = 65 183 | Height = 25 184 | Caption = 'Ok' 185 | TabOrder = 1 186 | OnClick = OkButtonClick 187 | end 188 | object StornoButton: TButton 189 | Left = 260 190 | Top = 312 191 | Width = 65 192 | Height = 25 193 | Caption = 'Storno' 194 | TabOrder = 2 195 | OnClick = StornoButtonClick 196 | end 197 | end 198 | -------------------------------------------------------------------------------- /RHGUI/NewPseudoValueForm.pas: -------------------------------------------------------------------------------- 1 | Unit NewPseudoValueForm; 2 | 3 | Interface 4 | 5 | Uses 6 | Winapi.Windows, Winapi.Messages, System.SysUtils, 7 | System.Variants, System.Classes, Vcl.Graphics, 8 | Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.ExtCtrls, 9 | Vcl.StdCtrls, Vcl.ComCtrls, DllRegHider, PseudoRegistryValue; 10 | 11 | Type 12 | TNewPseudoValueFrm = Class (TForm) 13 | MainPanel: TPanel; 14 | OkButton: TButton; 15 | StornoButton: TButton; 16 | ExtraInformationGroupBox: TGroupBox; 17 | DataGroupBox: TGroupBox; 18 | BasicInformationGroupBox: TGroupBox; 19 | KeyNameEdit: TEdit; 20 | ValueNameEdit: TEdit; 21 | ProcessNameEdit: TEdit; 22 | ValueTypeComboBox: TComboBox; 23 | ChangeModeComboBox: TComboBox; 24 | DeleteModeComboBox: TComboBox; 25 | Label1: TLabel; 26 | Label2: TLabel; 27 | Label3: TLabel; 28 | Label4: TLabel; 29 | Label5: TLabel; 30 | Label6: TLabel; 31 | ValueDataRichEdit: TRichEdit; 32 | procedure FormCreate(Sender: TObject); 33 | procedure FormDestroy(Sender: TObject); 34 | procedure StornoButtonClick(Sender: TObject); 35 | procedure OkButtonClick(Sender: TObject); 36 | Private 37 | FCancelled : Boolean; 38 | FKeyName : WideString; 39 | FValueName : WideString; 40 | FValueType : Cardinal; 41 | FValueData : Pointer; 42 | FValueDataLength : Cardinal; 43 | FProcessName : WideString; 44 | FChangeMode : ERegistryValueOpMode; 45 | FDeleteMode : ERegistryValueOpMode; 46 | FPseudoValue : TPseudoRegistryValue; 47 | Public 48 | Constructor Create(AOwner:TComponent; AValue:TPseudoRegistryValue = Nil); Reintroduce; 49 | 50 | Property Cancelled : Boolean Read FCancelled; 51 | Property KeyName : WideString Read FKeyName; 52 | Property ValueName : WideString Read FValueName; 53 | Property ValueType : Cardinal Read FValueType; 54 | Property ValueData : Pointer Read FValueData; 55 | Property ValueDataLength : Cardinal Read FValueDataLength; 56 | Property ProcessName : WideString Read FProcessName; 57 | Property ChangeMode : ERegistryValueOpMode Read FChangeMode; 58 | Property DeleteMode : ERegistryValueOpMode Read FDeleteMode; 59 | end; 60 | 61 | 62 | Implementation 63 | 64 | {$R *.DFM} 65 | 66 | Uses 67 | Utils; 68 | 69 | Constructor TNewPseudoValueFrm.Create(AOwner:TComponent; AValue:TPseudoRegistryValue = Nil); 70 | begin 71 | FPseudoValue := AValue; 72 | Inherited Create(AOwner); 73 | end; 74 | 75 | Procedure TNewPseudoValueFrm.FormCreate(Sender: TObject); 76 | begin 77 | FValueData := Nil; 78 | FValueDataLength := 0; 79 | FCancelled := True; 80 | If Assigned(FPseudoValue) Then 81 | begin 82 | KeyNameEdit.Text := FPseudoValue.KeyName; 83 | ValueNameEdit.Text := FPseudoValue.ValueName; 84 | ValuetypeComboBox.ItemIndex := 0; 85 | Case FPseudoValue.ValueType Of 86 | REG_NONE : ValuetypeComboBox.ItemIndex := 0; 87 | REG_BINARY : ValuetypeComboBox.ItemIndex := 1; 88 | REG_DWORD : ValuetypeComboBox.ItemIndex := 2; 89 | 11 : ValuetypeComboBox.ItemIndex := 3; 90 | REG_SZ : ValuetypeComboBox.ItemIndex := 4; 91 | REG_EXPAND_SZ : ValuetypeComboBox.ItemIndex := 5; 92 | REG_MULTI_SZ : ValuetypeComboBox.ItemIndex := 6; 93 | end; 94 | 95 | Case FPseudoValue.ValueType Of 96 | REG_SZ, 97 | REG_EXPAND_SZ : ValueDataRichEdit.Text := WideCharToString(FPseudoValue.Data); 98 | REG_MULTI_SZ : MultiStringToStringList(FPseudoValue.Data, ValueDataRichEdit.Lines); 99 | REG_DWORD : begin 100 | If FPseudoValue.DataLength = SizeOf(Cardinal) THen 101 | ValueDataRichEdit.Text := IntToStr(PInteger(FPseudoValue.Data)^); 102 | end; 103 | 11 : begin 104 | If FPseudoValue.DataLength = SizeOf(Int64) THen 105 | ValueDataRichEdit.Text := IntToStr(PInt64(FPseudoValue.Data)^); 106 | end; 107 | Else ValueDataRichEdit.Text := BinaryDataToString(FPseudoValue.Data, FPseudoValue.DataLength); 108 | end; 109 | 110 | ChangeModeComboBox.ItemIndex := Ord(FPseudoValue.ChangeMode); 111 | DeleteModeComboBox.ItemIndex := Ord(FPseudoValue.DeleteMode); 112 | ProcessNameEdit.Text := FPseudoValue.ProcessName; 113 | end; 114 | end; 115 | 116 | Procedure TNewPseudoValueFrm.FormDestroy(Sender: TObject); 117 | begin 118 | If Assigned(FValueData) Then 119 | FreeMem(FValueData); 120 | end; 121 | 122 | Procedure TNewPseudoValueFrm.OkButtonClick(Sender: TObject); 123 | Var 124 | dw : Cardinal; 125 | qw : UInt64; 126 | begin 127 | FCancelled := False; 128 | FKeyName := KeyNameEdit.Text; 129 | FValueName := ValueNameEdit.Text; 130 | Case ValueTypeComboBox.ItemIndex Of 131 | 0 : FValueType := REG_NONE; 132 | 1 : FValueType := REG_BINARY; 133 | 2 : FValueType := REG_DWORD; 134 | 3 : FValueType := 11; 135 | 4 : FValueType := REG_SZ; 136 | 5 : FValueType := REG_EXPAND_SZ; 137 | 6 : FValueType := REG_MULTI_SZ; 138 | end; 139 | 140 | Case FValueType Of 141 | REG_SZ, 142 | REG_EXPAND_SZ : begin 143 | FValueDataLength := (Length(ValueDataRichEdit.Text) + 1)*Sizeof(WideChar); 144 | FValueData := AllocMem(FValueDataLength); 145 | FCancelled := Not Assigned(FValueData); 146 | If Not FCancelled Then 147 | CopyMemory(FValueData, PWideChar(ValueDataRichEdit.Text), FValueDataLength); 148 | end; 149 | REG_DWORD : begin 150 | FValueDataLength := SizeOf(Cardinal); 151 | FValueData := AllocMem(FValueDataLength); 152 | FCancelled := Not Assigned(FValueData); 153 | If Not FCancelled Then 154 | begin 155 | try 156 | dw := Cardinal(StrToInt64(ValueDataRichEdit.Text)); 157 | CopyMemory(FValueData, @dw, FValueDataLength); 158 | Except 159 | FCancelled := True; 160 | end; 161 | 162 | If FCancelled Then 163 | FreeMem(FValueData); 164 | end; 165 | end; 166 | 11 : begin 167 | FValueDataLength := SizeOf(UInt64); 168 | FValueData := AllocMem(FValueDataLength); 169 | FCancelled := Not Assigned(FValueData); 170 | If Not FCancelled Then 171 | begin 172 | try 173 | qw := UInt64(StrToInt64(ValueDataRichEdit.Text)); 174 | CopyMemory(FValueData, @qw, FValueDataLength); 175 | Except 176 | FCancelled := True; 177 | end; 178 | 179 | If FCancelled Then 180 | FreeMem(FValueData); 181 | end; 182 | end; 183 | REG_MULTI_SZ : begin 184 | FCancelled := Not StringListToMultiStringData(ValueDataRichEdit.Lines, FValueData, FValueDatalength) 185 | end; 186 | REG_BINARY, 187 | REG_NONE : begin 188 | FCancelled := Not StringToBinaryData(ValueDataRichEdit.Text, FValueData, FValueDataLength); 189 | end; 190 | end; 191 | 192 | FProcessName := ProcessnameEdit.Text; 193 | FChangeMode := ERegistryValueOpMode(ChangeModeComboBox.ItemIndex); 194 | FDeleteMode := ERegistryValueOpMode(DeleteModeComboBox.ItemIndex); 195 | If Not FCancelled Then 196 | Close 197 | Else begin 198 | FValuedata := Nil; 199 | FValueDataLength := 0; 200 | end; 201 | end; 202 | 203 | Procedure TNewPseudoValueFrm.StornoButtonClick(Sender: TObject); 204 | begin 205 | Close; 206 | end; 207 | 208 | End. 209 | -------------------------------------------------------------------------------- /RHGUI/PseudoRegistryValue.pas: -------------------------------------------------------------------------------- 1 | Unit PseudoRegistryValue; 2 | 3 | Interface 4 | 5 | Uses 6 | Windows, DllRegHider, Generics.Collections; 7 | 8 | Type 9 | TPseudoRegistryValue = Class 10 | Private 11 | FKeyName : WideString; 12 | FValueName : WideString; 13 | FValueType : Cardinal; 14 | FData : Pointer; 15 | FDataLength : Cardinal; 16 | FChangeMode : ERegistryValueOpMode; 17 | FDeleteMode : ERegistryValueOpMode; 18 | FProcessName : WideString; 19 | Public 20 | Constructor Create(Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD); Reintroduce; 21 | Destructor Destroy; Override; 22 | 23 | Class Function Enumerate(AList:TList):Cardinal; 24 | 25 | Property KeyName : WideString Read FKeyName; 26 | Property ValueName : WideString Read FValueName; 27 | Property ValueType : Cardinal Read FValueType; 28 | Property Data : Pointer Read FData; 29 | Property DataLength : Cardinal Read FDataLength; 30 | Property ChangeMode : ERegistryValueOpMode Read FChangeMode; 31 | Property DeleteMode : ERegistryValueOpMode Read FDeleteMode; 32 | Property ProcessName : WideString Read FProcessName; 33 | end; 34 | 35 | 36 | Implementation 37 | 38 | Uses 39 | SysUtils; 40 | 41 | Function _EnumCallback(Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD; AContext:Pointer):LongBool; StdCall; 42 | Var 43 | value : TPseudoRegistryValue; 44 | list : TList; 45 | begin 46 | list := AContext; 47 | Try 48 | value := TPseudoRegistryValue.Create(ARecord); 49 | Result := True; 50 | Except 51 | Result := False; 52 | End; 53 | 54 | If Result Then 55 | begin 56 | Try 57 | list.Add(value); 58 | Except 59 | value.Free; 60 | Result := False; 61 | end; 62 | end; 63 | end; 64 | 65 | Constructor TPseudoRegistryValue.Create(Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD); 66 | begin 67 | Inherited Create; 68 | FData := Nil; 69 | FKeyName := WideCharToString(ARecord.KeyName); 70 | FValueName := WideCharToString(ARecord.ValueName); 71 | FProcessName := WideCharToString(ARecord.ProcessName); 72 | FValueType := ARecord.ValueType; 73 | FChangeMode := ARecord.ChangeMode; 74 | FDeleteMode := ARecord.DeleteMode; 75 | FDataLength := ARecord.DataLength; 76 | If FDataLength > 0 Then 77 | begin 78 | FData := HeapAlloc(GetProcessHeap, HEAP_ZERO_MEMORY, FDataLength); 79 | If Not Assigned(FData) Then 80 | Raise Exception.Create('Out of memory'); 81 | 82 | CopyMemory(FData, ARecord.Data, FDataLength); 83 | end; 84 | end; 85 | 86 | Destructor TPseudoRegistryValue.Destroy; 87 | begin 88 | If Assigned(FData) Then 89 | HeapFree(GetProcessHeap, 0, FData); 90 | 91 | Inherited Destroy; 92 | end; 93 | 94 | 95 | 96 | Class Function TPseudoRegistryValue.Enumerate(AList:TList):Cardinal; 97 | Var 98 | value : TPseudoRegistryValue; 99 | tmpList : TList; 100 | begin 101 | tmpList := TList.Create; 102 | Result := PseudoValuesEnum(_EnumCallback, tmpList); 103 | If Result = ERROR_SUCCESS Then 104 | begin 105 | For value In tmpList Do 106 | AList.Add(value); 107 | end; 108 | 109 | tmpList.Free; 110 | end; 111 | 112 | 113 | 114 | End. 115 | -------------------------------------------------------------------------------- /RHGUI/RHGUI.dpr: -------------------------------------------------------------------------------- 1 | program RHGUI; 2 | 3 | uses 4 | Windows, 5 | Vcl.Forms, 6 | MainForm in 'MainForm.pas' {Form1}, 7 | DllRegHider in '..\include\DllRegHider.pas', 8 | Utils in 'Utils.pas', 9 | HiddenRegistryKey in 'HiddenRegistryKey.pas', 10 | PseudoRegistryValue in 'PseudoRegistryValue.pas', 11 | NewPseudoValueForm in 'NewPseudoValueForm.pas' {NewPseudoValueFrm}; 12 | 13 | {$R *.res} 14 | 15 | Var 16 | err : Cardinal; 17 | begin 18 | Application.Initialize; 19 | err := DLLregHider.Init; 20 | If err = ERROR_SUCCESS Then 21 | begin 22 | Application.MainFormOnTaskbar := True; 23 | Application.CreateForm(TForm1, Form1); 24 | Application.Run; 25 | DllRegHider.Finit; 26 | end 27 | Else WindowsErrorMessage(err, 'Failed to initialize reghider.dll', []); 28 | end. 29 | 30 | -------------------------------------------------------------------------------- /RHGUI/RHGUI.res: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/RHGUI/RHGUI.res -------------------------------------------------------------------------------- /RHGUI/Utils.pas: -------------------------------------------------------------------------------- 1 | Unit Utils; 2 | 3 | Interface 4 | 5 | Uses 6 | Windows, DllRegHider, Classes; 7 | 8 | Function RegistryValueOpModeToStr(AMode:ERegistryValueOpMode):WideString; 9 | Function RegistryValueTypeToStr(AType:Cardinal):WideString; 10 | Function StringListToMultiStringData(AList:TStrings; Var AData:Pointer; Var ADataLength:Cardinal):Boolean; 11 | Procedure MultiStringToStringList(AM:PWideChar; AList:TStrings); 12 | Function StringToBinaryData(S:WideString; Var AData:Pointer; Var ADataLength:Cardinal):Boolean; 13 | Function BinaryDataToString(ABuffer:Pointer; ASize:Cardinal):WideString; 14 | 15 | Function WideCharToString(AWideChar:PWideChar):WideString; 16 | Procedure WindowsErrorMessage(AErrorCode:Cardinal; AMessage:WideString; AArgs:Array Of Const); 17 | 18 | Implementation 19 | 20 | Uses 21 | SysUtils; 22 | 23 | Function RegistryValueOpModeToStr(AMode:ERegistryValueOpMode):WideString; 24 | begin 25 | Case AMode Of 26 | rvdmDeny: Result := 'Deny'; 27 | rvdmAllow: Result := 'Allow'; 28 | rvdmPretend: Result := 'Pretend'; 29 | Else Result := Format(' (%d)', [Ord(AMode)]); 30 | end; 31 | end; 32 | 33 | Function RegistryValueTypeToStr(AType:Cardinal):WideString; 34 | begin 35 | Case AType Of 36 | REG_NONE : Result := 'REG_NONE'; 37 | REG_DWORD : Result := 'REG_DWORD'; 38 | REG_SZ : Result := 'REG_SZ'; 39 | REG_EXPAND_SZ : Result := 'REG_EXPAND_SZ'; 40 | REG_MULTI_SZ : Result := 'REG_MULTI_SZ'; 41 | REG_BINARY : Result := 'REG_BINARY'; 42 | 11 : Result := 'REG_QWORD'; 43 | Else Result := Format(' (%d)', [AType]); 44 | end; 45 | end; 46 | 47 | Function WideCharToString(AWideChar:PWideChar):WideString; 48 | begin 49 | Result := Copy(WideString(AWideChar), 1, StrLen(AWideChar)); 50 | end; 51 | 52 | Procedure WindowsErrorMessage(AErrorCode:Cardinal; AMessage:WideString; AArgs:Array Of Const); 53 | Var 54 | wholeMsg : WideString; 55 | errString : WideString; 56 | begin 57 | errString := Format(': %s (%d)', [SysErrorMessage(AErrorCode), AErrorCode]); 58 | wholeMsg := Format(AMessage, AArgs) + errString; 59 | MessageBoxW(0, PWideChar(wholeMsg), 'Error', MB_OK Or MB_ICONERROR); 60 | end; 61 | 62 | Function StringListToMultiStringData(AList:TStrings; Var AData:Pointer; Var ADataLength:Cardinal):Boolean; 63 | Var 64 | len : Cardinal; 65 | tmp : PWideChar; 66 | I : Integer; 67 | begin 68 | ADataLength := SizeOf(WideChar); 69 | For I := 0 To AList.Count - 1 Do 70 | Inc(ADataLength, (Length(AList[I]) + 1)*SizeOf(WideChar)); 71 | 72 | AData := AllocMem(ADataLength); 73 | Result := Assigned(AData); 74 | If Result Then 75 | begin 76 | tmp := AData; 77 | For I := 0 To AList.Count - 1 Do 78 | begin 79 | len := Length(AList[I]); 80 | CopyMemory(tmp, PWideChar(AList[I]), (len + 1)*SizeOf(WiDeChar)); 81 | Inc(tmp, len + 1); 82 | end; 83 | 84 | tmp^ := #0; 85 | end; 86 | end; 87 | 88 | Procedure MultiStringToStringList(AM:PWideChar; AList:TStrings); 89 | Var 90 | len : Cardinal; 91 | tmp : PWideChar; 92 | begin 93 | tmp := AM; 94 | While tmp^ <> #0 Do 95 | begin 96 | len := Strlen(tmp); 97 | AList.Add(WideCharToString(tmp)); 98 | Inc(tmp, len + 1); 99 | end; 100 | end; 101 | 102 | Function StringToBinaryData(S:WideString; Var AData:Pointer; Var ADataLength:Cardinal):Boolean; 103 | Var 104 | d : WideChar; 105 | b : Byte; 106 | value : Byte; 107 | p : PByte; 108 | I : Integer; 109 | begin 110 | Result := (Length(S) Mod 2) = 0; 111 | If Result Then 112 | begin 113 | For I := 1 To Length(S) Do 114 | begin 115 | Result := ( 116 | ((S[I] >= '0') And (S[I] <= '9')) Or 117 | ((S[I] >= 'a') And (S[I] <= 'f')) Or 118 | ((S[I] >= 'A') And (S[I] <= 'F')) 119 | ); 120 | If Not Result Then 121 | Break; 122 | end; 123 | 124 | If Result Then 125 | begin 126 | ADataLength := Length(S) Div 2; 127 | AData := AllocMem(ADataLength); 128 | If Assigned(AData) Then 129 | begin 130 | p := AData; 131 | For I := 0 To ADataLength - 1 Do 132 | begin 133 | d := S[2*I + 1]; 134 | If ((d >= '0') And (d <= '9')) Then 135 | b := Ord(d) - Ord('0') 136 | Else If ((d >= 'a') And (d <= 'f')) Then 137 | b := Ord(d) - Ord('a') + 10 138 | Else b := Ord(d) - Ord('A') + 10; 139 | 140 | value := b; 141 | 142 | d := S[2*I+2]; 143 | If ((d >= '0') And (d <= '9')) Then 144 | b := Ord(d) - Ord('0') 145 | Else If ((d >= 'a') And (d <= 'f')) Then 146 | b := Ord(d) - Ord('a') + 10 147 | Else b := Ord(d) - Ord('A') + 10; 148 | 149 | value := value + 16*b; 150 | p^ := value; 151 | Inc(p); 152 | end; 153 | end; 154 | end; 155 | end; 156 | end; 157 | 158 | Function BinaryDataToString(ABuffer:Pointer; ASize:Cardinal):WideString; 159 | Var 160 | p : PByte; 161 | I : Integer; 162 | begin 163 | Result := ''; 164 | p := ABuffer; 165 | For I := 0 To ASize - 1 Do 166 | begin 167 | Result := Result + IntToHex(p^, 2); 168 | Inc(p); 169 | end; 170 | end; 171 | 172 | End. 173 | 174 | -------------------------------------------------------------------------------- /StaticLibrary.props: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | $(SolutionDir)lib\$(Platform)\$(Configuration)\ 7 | 8 | 9 | 10 | -------------------------------------------------------------------------------- /bin/Win32/Release/RHGUI.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/bin/Win32/Release/RHGUI.exe -------------------------------------------------------------------------------- /bin/Win32/Release/ndisprot6-test.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/bin/Win32/Release/ndisprot6-test.exe -------------------------------------------------------------------------------- /bin/Win32/Release/ndisprot6.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/bin/Win32/Release/ndisprot6.sys -------------------------------------------------------------------------------- /bin/Win32/Release/reghider.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/bin/Win32/Release/reghider.dll -------------------------------------------------------------------------------- /bin/Win32/Release/reghider.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/bin/Win32/Release/reghider.sys -------------------------------------------------------------------------------- /bin/x64/Release/RHGUI.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/bin/x64/Release/RHGUI.exe -------------------------------------------------------------------------------- /bin/x64/Release/ndisprot6-test.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/bin/x64/Release/ndisprot6-test.exe -------------------------------------------------------------------------------- /bin/x64/Release/ndisprot6.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/bin/x64/Release/ndisprot6.sys -------------------------------------------------------------------------------- /bin/x64/Release/reghider.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/bin/x64/Release/reghider.dll -------------------------------------------------------------------------------- /bin/x64/Release/reghider.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/bin/x64/Release/reghider.sys -------------------------------------------------------------------------------- /dllreghider/dllreghider.c: -------------------------------------------------------------------------------- 1 | 2 | #include 3 | #include "reghider-types.h" 4 | #include "libreghider-types.h" 5 | #include "libreghider.h" 6 | #include "dllreghider.h" 7 | 8 | /************************************************************************/ 9 | /* EXPORTED FUNCTIONS */ 10 | /************************************************************************/ 11 | 12 | /**************/ 13 | /* HIDDEN KEY */ 14 | /**************/ 15 | 16 | REGHIDER_API DWORD WINAPI HiddenKeyAdd(PWCHAR KeyName) 17 | { 18 | return LibRegHiderHiddenKeyAdd(KeyName); 19 | } 20 | 21 | REGHIDER_API DWORD WINAPI HiddenKeyDelete(PWCHAR KeyName) 22 | { 23 | return LibRegHiderHiddenKeyDelete(KeyName); 24 | } 25 | 26 | REGHIDER_API DWORD WINAPI HiddenKeysEnum(REGHIDER_HIDDEN_KEY_CALLBACK *Callback, PVOID Context) 27 | { 28 | return LibRegHiderHiddenKeysEnum(Callback, Context); 29 | } 30 | 31 | /****************/ 32 | /* PSEUDO VALUE */ 33 | /****************/ 34 | 35 | REGHIDER_API DWORD WINAPI PseudoValueAdd(PWCHAR KeyName, PWCHAR ValueName, ULONG Valuetype, PVOID Data, ULONG DataLength, ERegistryValueOpMode DeleteMode, ERegistryValueOpMode ChangeMode, PWCHAR ProcessName) 36 | { 37 | return LibRegHiderPseudoValueAdd(KeyName, ValueName, Valuetype, Data, DataLength, DeleteMode, ChangeMode, ProcessName); 38 | } 39 | 40 | REGHIDER_API DWORD WINAPI PseudoValueDelete(PWCHAR KeyName, PWCHAR ValueName) 41 | { 42 | return LibRegHiderPseudoValueDelete(KeyName, ValueName); 43 | } 44 | 45 | REGHIDER_API DWORD WINAPI PseudoValuesEnum(REGHIDER_PSEUDO_VALUE_CALLBACK *Callback, PVOID Context) 46 | { 47 | return LibRegHiderPseudoValuesEnum(Callback, Context); 48 | } 49 | 50 | REGHIDER_API DWORD WINAPI PseudoValueSet(PWCHAR KeyName, PWCHAR ValueName, ULONG ValueType, PVOID Data, ULONG DataLength, ERegistryValueOpMode DeleteMode, ERegistryValueOpMode ChangeMode, PWCHAR ProcessName) 51 | { 52 | return LibRegHiderPseudoValueSet(KeyName, ValueName, ValueType, Data, DataLength, DeleteMode, ChangeMode, ProcessName); 53 | } 54 | 55 | 56 | /******************/ 57 | /* INIT AND FINIT */ 58 | /******************/ 59 | 60 | REGHIDER_API DWORD WINAPI Init(VOID) 61 | { 62 | return LibRegHiderInit(); 63 | } 64 | 65 | REGHIDER_API VOID WINAPI Finit(VOID) 66 | { 67 | LibRegHiderFinit(); 68 | 69 | return; 70 | } 71 | 72 | 73 | 74 | /************************************************************************/ 75 | /* INITIALIZATION AND FINALIZATION */ 76 | /************************************************************************/ 77 | 78 | BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, PVOID lpReserved) 79 | { 80 | BOOL ret = FALSE; 81 | 82 | switch (dwReason) { 83 | case DLL_PROCESS_ATTACH: 84 | ret = DisableThreadLibraryCalls(hInstance); 85 | break; 86 | } 87 | 88 | return ret; 89 | } 90 | -------------------------------------------------------------------------------- /dllreghider/dllreghider.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | 23 | 24 | Header Files 25 | 26 | 27 | Header Files 28 | 29 | 30 | Header Files 31 | 32 | 33 | Header Files 34 | 35 | 36 | -------------------------------------------------------------------------------- /hackerfest2015.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/hackerfest2015.suo -------------------------------------------------------------------------------- /hackerfest2015.v12.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/hackerfest2015.v12.suo -------------------------------------------------------------------------------- /hfdetector/FileSystemObject.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __FILE_SYSTEM_OBJECT_H__ 3 | #define __FILE_SYSTEM_OBJECT_H__ 4 | 5 | 6 | #include 7 | #include 8 | #include "utils.h" 9 | 10 | 11 | class CFileSystemObject { 12 | public: 13 | CFileSystemObject(const std::wstring & aFileName, const DWORD aFileAttributes, const ULONG64 aFileId) : 14 | name_(aFileName), fileAttributes_(aFileAttributes), fileId_(aFileId), foundById_(false), FoundByName_(false) {} 15 | CFileSystemObject(const FILE_ID_BOTH_DIR_INFORMATION & Record) 16 | : foundById_(false), FoundByName_(false) 17 | { 18 | fileAttributes_ = Record.FileAttributes; 19 | fileId_ = Record.FileId.QuadPart; 20 | name_ = std::wstring(Record.FileName, Record.FileNameLength / sizeof(WCHAR)); 21 | 22 | return; 23 | } 24 | ~CFileSystemObject(void) 25 | { 26 | for (auto o : children_) 27 | delete o.second; 28 | 29 | return; 30 | } 31 | DWORD FindChildren(HANDLE DirectoryHandle) 32 | { 33 | DWORD ret = ERROR_GEN_FAILURE; 34 | 35 | ret = ListDirectory(DirectoryHandle, FileCallback_, this); 36 | 37 | return ret; 38 | } 39 | void AddObject(std::wstring & aObjectName, CFileSystemObject *aObject) 40 | { 41 | size_t pos = aObjectName.find_first_of(L'\\'); 42 | 43 | if (pos == std::wstring::npos) { 44 | if (children_.find(aObjectName) == children_.end()) { 45 | aObject->foundById_ = true; 46 | aObject->name_ = aObjectName; 47 | children_.insert(std::make_pair(aObject->name_, aObject)); 48 | } else delete aObject; 49 | } else { 50 | std::wstring partName = aObjectName.substr(0, pos); 51 | auto it = children_.find(partName); 52 | if (it != children_.end()) { 53 | it->second->AddObject(aObjectName.substr(pos + 1), aObject); 54 | } else { 55 | CFileSystemObject *n = 0; 56 | 57 | n = new CFileSystemObject(partName, aObject->getFileAttributes(), aObject->getFileId()); 58 | children_.insert(std::make_pair(partName, n)); 59 | n->AddObject(aObjectName.substr(pos + 1), aObject); 60 | } 61 | } 62 | 63 | return; 64 | } 65 | std::map::iterator begin(void) { return children_.begin(); } 66 | std::map::iterator end(void) { return children_.end(); } 67 | 68 | std::wstring getName(void) const { return name_; } 69 | ULONG getFileAttributes(void) const { return fileAttributes_; } 70 | ULONG64 getFileId(void) const { return fileId_; } 71 | private: 72 | std::map children_; 73 | std::wstring name_; 74 | ULONG fileAttributes_; 75 | ULONG64 fileId_; 76 | bool FoundByName_; 77 | bool foundById_; 78 | static VOID WINAPI FileCallback_(const PFILE_ID_BOTH_DIR_INFORMATION FileInfo, PVOID Context) 79 | { 80 | CFileSystemObject *child = NULL; 81 | CFileSystemObject *o = (CFileSystemObject *)Context; 82 | 83 | if (FileInfo->FileNameLength > sizeof(WCHAR) || FileInfo->FileName[0] != L'.') { 84 | if (FileInfo->FileNameLength > 2 * sizeof(WCHAR) || FileInfo->FileName[0] != L'.' || FileInfo->FileName[1] != L'.') { 85 | child = new CFileSystemObject(*FileInfo); 86 | child->FoundByName_ = true; 87 | o->children_.insert(std::make_pair(child->name_, child)); 88 | } 89 | } 90 | 91 | return; 92 | } 93 | }; 94 | 95 | 96 | 97 | 98 | 99 | 100 | #endif 101 | -------------------------------------------------------------------------------- /hfdetector/hfdetector.cpp: -------------------------------------------------------------------------------- 1 | 2 | 3 | #include 4 | #include 5 | #include "utils.h" 6 | #include "FileSystemObject.h" 7 | 8 | 9 | 10 | static DWORD _OpenDirectoryName(const HANDLE RootHandle, const std::wstring & aName, PHANDLE Handle) 11 | { 12 | DWORD ret = ERROR_GEN_FAILURE; 13 | 14 | ret = OpenFileRelative(RootHandle, (PWCHAR)aName.c_str(), aName.size()*sizeof(WCHAR), FILE_READ_ATTRIBUTES | FILE_LIST_DIRECTORY, FILE_SHARE_READ | FILE_SHARE_WRITE, TRUE, TRUE, Handle); 15 | if (ret == ERROR_SHARING_VIOLATION) 16 | ret = OpenFileRelative(RootHandle, (PWCHAR)aName.c_str(), aName.size()*sizeof(WCHAR), FILE_READ_ATTRIBUTES | FILE_LIST_DIRECTORY, FILE_SHARE_WRITE, TRUE, TRUE, Handle); 17 | 18 | if (ret == ERROR_SHARING_VIOLATION) 19 | ret = OpenFileRelative(RootHandle, (PWCHAR)aName.c_str(), aName.size()*sizeof(WCHAR), FILE_READ_ATTRIBUTES | FILE_LIST_DIRECTORY, FILE_SHARE_READ, TRUE, TRUE, Handle); 20 | 21 | return ret; 22 | } 23 | 24 | static DWORD _OpenFileById(const HANDLE VolumeHint, const ULONG64 FileId, PHANDLE Handle) 25 | { 26 | DWORD ret = ERROR_GEN_FAILURE; 27 | FILE_ID_DESCRIPTOR fdd; 28 | HANDLE tmpHandle = NULL; 29 | 30 | fdd.dwSize = sizeof(fdd); 31 | fdd.Type = FileIdType; 32 | fdd.FileId.QuadPart = FileId | 0x50000000000000; 33 | 34 | tmpHandle = OpenFileById(VolumeHint, &fdd, FILE_READ_ATTRIBUTES | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, FILE_FLAG_BACKUP_SEMANTICS); 35 | ret = (tmpHandle != INVALID_HANDLE_VALUE) ? ERROR_SUCCESS : GetLastError(); 36 | if (ret == ERROR_SHARING_VIOLATION) { 37 | tmpHandle = OpenFileById(VolumeHint, &fdd, FILE_READ_ATTRIBUTES | SYNCHRONIZE, FILE_SHARE_READ, NULL, FILE_FLAG_BACKUP_SEMANTICS); 38 | ret = (tmpHandle != INVALID_HANDLE_VALUE) ? ERROR_SUCCESS : GetLastError(); 39 | } 40 | 41 | if (ret == ERROR_SHARING_VIOLATION) { 42 | tmpHandle = OpenFileById(VolumeHint, &fdd, FILE_READ_ATTRIBUTES | SYNCHRONIZE, FILE_SHARE_WRITE, NULL, FILE_FLAG_BACKUP_SEMANTICS); 43 | ret = (tmpHandle != INVALID_HANDLE_VALUE) ? ERROR_SUCCESS : GetLastError(); 44 | } 45 | 46 | if (ret == ERROR_SUCCESS) 47 | *Handle = tmpHandle; 48 | 49 | return ret; 50 | } 51 | 52 | static DWORD _ScanFileIds(const std::wstring VolumeName, CFileSystemObject & Root) 53 | { 54 | HANDLE volumeHandle = NULL; 55 | unsigned int i = 0; 56 | BY_HANDLE_FILE_INFORMATION bhfi; 57 | HANDLE fileHandle = INVALID_HANDLE_VALUE; 58 | DWORD ret = ERROR_GEN_FAILURE; 59 | 60 | volumeHandle = CreateFileW(VolumeName.c_str(), FILE_READ_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); 61 | ret = (volumeHandle != INVALID_HANDLE_VALUE) ? ERROR_SUCCESS : GetLastError(); 62 | if (ret == ERROR_SUCCESS) { 63 | for (i = 0; i < 16 * 1024 * 1024; ++i) { 64 | ret = _OpenFileById(volumeHandle, i, &fileHandle); 65 | if (ret == ERROR_SUCCESS) { 66 | POBJECT_NAME_INFORMATION oni = NULL; 67 | 68 | ret = (GetFileInformationByHandle(fileHandle, &bhfi)) ? ERROR_SUCCESS : GetLastError(); 69 | if (ret == ERROR_SUCCESS) { 70 | ret = QueryObjectName(fileHandle, &oni); 71 | if (ret == ERROR_SUCCESS) { 72 | CFileSystemObject *o = NULL; 73 | std::wstring fileName = std::wstring(oni->Name.Buffer, oni->Name.Length / sizeof(WCHAR)).substr(1); 74 | size_t pos = fileName.find_first_of(L'\\'); 75 | 76 | fileName = fileName.substr(pos + 1); 77 | pos = fileName.find_first_of(L'\\'); 78 | fileName = fileName.substr(pos + 1); 79 | o = new CFileSystemObject(L"", bhfi.dwFileAttributes, i); 80 | Root.AddObject(fileName, o); 81 | 82 | HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, oni); 83 | } 84 | } 85 | 86 | CloseHandle(fileHandle); 87 | } 88 | } 89 | 90 | CloseHandle(volumeHandle); 91 | } 92 | 93 | return ret; 94 | } 95 | 96 | static DWORD _BuildTreeLevel(const HANDLE hDirectory, CFileSystemObject & FSObject) 97 | { 98 | DWORD ret = ERROR_GEN_FAILURE; 99 | 100 | ret = FSObject.FindChildren(hDirectory); 101 | if (ret == ERROR_SUCCESS) { 102 | for (auto it = FSObject.begin(); it != FSObject.end(); ++it) { 103 | CFileSystemObject *ch = it->second; 104 | ULONG attr = ch->getFileAttributes(); 105 | 106 | if ((attr & FILE_ATTRIBUTE_REPARSE_POINT) == 0 && (attr & FILE_ATTRIBUTE_DIRECTORY) != 0) { 107 | HANDLE hChild = NULL; 108 | 109 | ret = _OpenDirectoryName(hDirectory, ch->getName(), &hChild); 110 | if (ret == ERROR_SUCCESS) { 111 | ret = _BuildTreeLevel(hChild, *ch); 112 | CloseHandle(hChild); 113 | } 114 | } 115 | 116 | // if (ret != ERROR_SUCCESS) 117 | // break; 118 | } 119 | } 120 | 121 | return ret; 122 | } 123 | 124 | void PrintLevel(const std::wstring & aParentName, CFileSystemObject & aObject) 125 | { 126 | std::wstring fullName = aParentName + L'\\' + aObject.getName(); 127 | printf("0x%x: %S\n", aObject.getFileAttributes(), fullName.c_str()); 128 | for (auto it = aObject.begin(); it != aObject.end(); ++it) { 129 | PrintLevel(fullName, *it->second); 130 | } 131 | 132 | return; 133 | } 134 | 135 | int main(int arbc, char *argv[]) 136 | { 137 | DWORD ret = ERROR_GEN_FAILURE; 138 | CFileSystemObject *root = NULL; 139 | 140 | ret = UtilsModuleInit(); 141 | if (ret == ERROR_SUCCESS) { 142 | ret = AdjustPrivilege(L"SeBackupPrivilege"); 143 | if (ret == ERROR_SUCCESS) { 144 | ret = AdjustPrivilege(L"SeRestorePrivilege"); 145 | if (ret == ERROR_SUCCESS) { 146 | HANDLE rootHandle = NULL; 147 | std::wstring rootPath = L"\\??\\C:\\"; 148 | 149 | 150 | ret = _OpenDirectoryName(NULL, rootPath, &rootHandle); 151 | if (ret == ERROR_SUCCESS) { 152 | root = new CFileSystemObject(rootPath, 0, 0); 153 | ret = _BuildTreeLevel(rootHandle, *root); 154 | _ScanFileIds(L"\\\\.\\C:", *root); 155 | CloseHandle(rootHandle); 156 | PrintLevel(L"", *root); 157 | } 158 | } 159 | } 160 | 161 | UtilsModuleFinit(); 162 | } 163 | 164 | return (int)ret; 165 | } 166 | -------------------------------------------------------------------------------- /hfdetector/hfdetector.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Debug 10 | x64 11 | 12 | 13 | Release 14 | Win32 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | {CCCDEB39-6835-48E5-9A89-3E6FB064376D} 23 | Win32Proj 24 | hfdetector 25 | 26 | 27 | 28 | Application 29 | true 30 | v120 31 | Unicode 32 | 33 | 34 | Application 35 | true 36 | v120 37 | Unicode 38 | 39 | 40 | Application 41 | false 42 | v120 43 | true 44 | Unicode 45 | 46 | 47 | Application 48 | false 49 | v120 50 | true 51 | Unicode 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | true 75 | 76 | 77 | true 78 | 79 | 80 | false 81 | 82 | 83 | false 84 | 85 | 86 | 87 | 88 | 89 | Level3 90 | Disabled 91 | WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) 92 | MultiThreadedDebug 93 | 94 | 95 | Console 96 | true 97 | 98 | 99 | 100 | 101 | 102 | 103 | Level3 104 | Disabled 105 | WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) 106 | MultiThreadedDebug 107 | 108 | 109 | Console 110 | true 111 | 112 | 113 | 114 | 115 | Level3 116 | 117 | 118 | MaxSpeed 119 | true 120 | true 121 | WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) 122 | MultiThreaded 123 | 124 | 125 | Console 126 | true 127 | true 128 | true 129 | 130 | 131 | 132 | 133 | Level3 134 | 135 | 136 | MaxSpeed 137 | true 138 | true 139 | WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) 140 | MultiThreaded 141 | 142 | 143 | Console 144 | true 145 | true 146 | true 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | -------------------------------------------------------------------------------- /hfdetector/hfdetector.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | Source Files 23 | 24 | 25 | 26 | 27 | Header Files 28 | 29 | 30 | Header Files 31 | 32 | 33 | -------------------------------------------------------------------------------- /hfdetector/utils.cpp: -------------------------------------------------------------------------------- 1 | 2 | #include 3 | #include 4 | #include "utils.h" 5 | 6 | 7 | 8 | /************************************************************************/ 9 | /* GLOBAL VARIABLES */ 10 | /************************************************************************/ 11 | 12 | static NTOPENFILE *_NtOpenFile = NULL; 13 | static NTQUERYDIRECTORYFILE *_NtQueryDirectoryFile = NULL; 14 | static RTLNTSTATUSTODOSERROR *_RtlNtStatusToDosError = NULL; 15 | static NTQUERYOBJECT *_NtQueryObject = NULL; 16 | 17 | /************************************************************************/ 18 | /* PUBLIC FUNCTIONS */ 19 | /************************************************************************/ 20 | 21 | DWORD AdjustPrivilege(const PWCHAR PrivilegeName) 22 | { 23 | HANDLE hToken = NULL; 24 | LUID privilegeValue; 25 | ULONG retLength = 0; 26 | TOKEN_PRIVILEGES newPrivs; 27 | TOKEN_PRIVILEGES oldPrivs; 28 | DWORD ret = ERROR_GEN_FAILURE; 29 | 30 | if (LookupPrivilegeValueW(NULL, PrivilegeName, &privilegeValue)) { 31 | if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) { 32 | newPrivs.PrivilegeCount = 1; 33 | newPrivs.Privileges[0].Luid = privilegeValue; 34 | newPrivs.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 35 | ret = (AdjustTokenPrivileges(hToken, FALSE, &newPrivs, sizeof(newPrivs), &oldPrivs, &retLength)) ? ERROR_SUCCESS : GetLastError(); 36 | CloseHandle(hToken); 37 | } else ret = GetLastError(); 38 | } else ret = GetLastError(); 39 | 40 | return ret; 41 | } 42 | 43 | DWORD ListDirectory(HANDLE hDirectory, FILE_CALLBACK *Callback, PVOID Context) 44 | { 45 | DWORD ret = ERROR_GEN_FAILURE; 46 | NTSTATUS status = 0xC0000001; 47 | ULONG bdiLen = 0; 48 | IO_STATUS_BLOCK iosb; 49 | PFILE_ID_BOTH_DIR_INFORMATION bdi = NULL; 50 | PFILE_ID_BOTH_DIR_INFORMATION tmp = NULL; 51 | 52 | bdiLen = 256 * sizeof(WCHAR) + 30 * sizeof(FILE_ID_BOTH_DIR_INFORMATION); 53 | bdi = (PFILE_ID_BOTH_DIR_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, bdiLen); 54 | if (bdi != NULL) { 55 | status = _NtQueryDirectoryFile(hDirectory, NULL, NULL, NULL, &iosb, bdi, bdiLen, FileIdBothDirectoryInformation, FALSE, NULL, TRUE); 56 | if (NT_SUCCESS(status) || status == 0x80000005) { 57 | do { 58 | tmp = bdi; 59 | Callback(tmp, Context); 60 | while (tmp->NextEntryOffset > 0) { 61 | tmp = (PFILE_ID_BOTH_DIR_INFORMATION)((PUCHAR)tmp + tmp->NextEntryOffset); 62 | Callback(tmp, Context); 63 | } 64 | 65 | status = _NtQueryDirectoryFile(hDirectory, NULL, NULL, NULL, &iosb, bdi, bdiLen, FileIdBothDirectoryInformation, FALSE, NULL, FALSE); 66 | } while (NT_SUCCESS(status) || status == 0x80000005); 67 | } 68 | 69 | if (status == 0x80000006) 70 | status = 0; 71 | 72 | if (NT_SUCCESS(status)) 73 | ret = ERROR_SUCCESS; 74 | 75 | if (!NT_SUCCESS(status)) 76 | ret = _RtlNtStatusToDosError(status); 77 | 78 | HeapFree(GetProcessHeap(), 0, bdi); 79 | } else ret = ERROR_NOT_ENOUGH_MEMORY; 80 | 81 | return ret; 82 | } 83 | 84 | DWORD OpenFileRelative(const HANDLE hDirectory, const PWCHAR FileName, const USHORT FileNameLength, const DWORD DesiredAccess, const DWORD ShareMode, const BOOLEAN Directory, const BOOLEAN BackupIntent, PHANDLE FileHandle) 85 | { 86 | IO_STATUS_BLOCK iosb; 87 | OBJECT_ATTRIBUTES oa; 88 | UNICODE_STRING uFileName; 89 | NTSTATUS status = 0xC0000001; 90 | DWORD ret = ERROR_GEN_FAILURE; 91 | 92 | uFileName.Length = FileNameLength; 93 | uFileName.MaximumLength = uFileName.Length; 94 | uFileName.Buffer = FileName; 95 | InitializeObjectAttributes(&oa, &uFileName, OBJ_CASE_INSENSITIVE, hDirectory, NULL); 96 | status = _NtOpenFile(FileHandle, DesiredAccess | SYNCHRONIZE, &oa, &iosb, ShareMode, (Directory ? FILE_DIRECTORY_FILE : FILE_NON_DIRECTORY_FILE) | (BackupIntent ? FILE_OPEN_FOR_BACKUP_INTENT : 0) | FILE_SYNCHRONOUS_IO_NONALERT); 97 | if (NT_SUCCESS(status)) 98 | ret = ERROR_SUCCESS; 99 | 100 | if (!NT_SUCCESS(status)) 101 | ret = _RtlNtStatusToDosError(status); 102 | 103 | return ret; 104 | } 105 | 106 | DWORD QueryObjectName(HANDLE Object, POBJECT_NAME_INFORMATION *Name) 107 | { 108 | ULONG retLength = 0; 109 | POBJECT_NAME_INFORMATION oni = NULL; 110 | DWORD ret = ERROR_GEN_FAILURE; 111 | NTSTATUS status = 0xC0000001; 112 | 113 | status = _NtQueryObject(Object, PrivateObjectNameInformation, NULL, 0, &retLength); 114 | if (status == 0xC0000004) { 115 | retLength += sizeof(OBJECT_NAME_INFORMATION); 116 | oni = (POBJECT_NAME_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, retLength); 117 | if (oni != NULL) { 118 | status = _NtQueryObject(Object, PrivateObjectNameInformation, oni, retLength, &retLength); 119 | if (NT_SUCCESS(status)) { 120 | *Name = oni; 121 | ret = ERROR_SUCCESS; 122 | } 123 | 124 | if (!NT_SUCCESS(status)) 125 | HeapFree(GetProcessHeap(), 0, oni); 126 | } 127 | } 128 | 129 | if (!NT_SUCCESS(status)) 130 | ret = _RtlNtStatusToDosError(status); 131 | 132 | return ret; 133 | } 134 | 135 | /************************************************************************/ 136 | /* INITIALIZATION AND FINALIZATION */ 137 | /************************************************************************/ 138 | 139 | DWORD UtilsModuleInit(VOID) 140 | { 141 | HMODULE hntdll = NULL; 142 | DWORD ret = ERROR_GEN_FAILURE; 143 | 144 | hntdll = GetModuleHandleW(L"ntdll.dll"); 145 | if (hntdll != NULL) { 146 | _RtlNtStatusToDosError = (RTLNTSTATUSTODOSERROR *)GetProcAddress(hntdll, "RtlNtStatusToDosError"); 147 | if (_RtlNtStatusToDosError != NULL) 148 | _NtQueryObject = (NTQUERYOBJECT *)GetProcAddress(hntdll, "NtQueryObject"); 149 | 150 | if (_NtQueryObject != NULL) 151 | _NtOpenFile = (NTOPENFILE *)GetProcAddress(hntdll, "NtOpenFile"); 152 | 153 | if (_NtOpenFile != NULL) 154 | _NtQueryDirectoryFile = (NTQUERYDIRECTORYFILE *)GetProcAddress(hntdll, "NtQueryDirectoryFile"); 155 | 156 | ret = (_NtQueryDirectoryFile != NULL) ? ERROR_SUCCESS : GetLastError(); 157 | } else ret = GetLastError(); 158 | 159 | return ret; 160 | } 161 | 162 | VOID UtilsModuleFinit(VOID) 163 | { 164 | _NtQueryDirectoryFile = NULL; 165 | _NtOpenFile = NULL; 166 | _NtQueryObject = NULL; 167 | _RtlNtStatusToDosError = NULL; 168 | 169 | return; 170 | } 171 | -------------------------------------------------------------------------------- /hfdetector/utils.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __HF_DETECT_H__ 3 | #define __HF_DETECT_H__ 4 | 5 | #include 6 | #include 7 | 8 | 9 | typedef struct _FILE_ID_BOTH_DIR_INFORMATION { 10 | ULONG NextEntryOffset; 11 | ULONG FileIndex; 12 | LARGE_INTEGER CreationTime; 13 | LARGE_INTEGER LastAccessTime; 14 | LARGE_INTEGER LastWriteTime; 15 | LARGE_INTEGER ChangeTime; 16 | LARGE_INTEGER EndOfFile; 17 | LARGE_INTEGER AllocationSize; 18 | ULONG FileAttributes; 19 | ULONG FileNameLength; 20 | ULONG EaSize; 21 | CCHAR ShortNameLength; 22 | WCHAR ShortName[12]; 23 | LARGE_INTEGER FileId; 24 | WCHAR FileName[1]; 25 | } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION; 26 | 27 | 28 | #define FileIdBothDirectoryInformation 37 29 | #define FileIdFullDirectoryInformation 38 30 | 31 | typedef NTSTATUS (NTAPI NTQUERYDIRECTORYFILE)( 32 | _In_ HANDLE FileHandle, 33 | _In_opt_ HANDLE Event, 34 | _In_opt_ PIO_APC_ROUTINE ApcRoutine, 35 | _In_opt_ PVOID ApcContext, 36 | _Out_ PIO_STATUS_BLOCK IoStatusBlock, 37 | _Out_ PVOID FileInformation, 38 | _In_ ULONG Length, 39 | _In_ ULONG FileInformationClass, 40 | _In_ BOOLEAN ReturnSingleEntry, 41 | _In_opt_ PUNICODE_STRING FileName, 42 | _In_ BOOLEAN RestartScan); 43 | 44 | typedef NTSTATUS (NTAPI NTOPENFILE)( 45 | _Out_ PHANDLE FileHandle, 46 | _In_ ACCESS_MASK DesiredAccess, 47 | _In_ POBJECT_ATTRIBUTES ObjectAttributes, 48 | _Out_ PIO_STATUS_BLOCK IoStatusBlock, 49 | _In_ ULONG ShareAccess, 50 | _In_ ULONG OpenOptions); 51 | 52 | typedef ULONG (WINAPI RTLNTSTATUSTODOSERROR)(_In_ NTSTATUS Status); 53 | 54 | // Mozne druhy informaci, ktere lze ziskat pres rutinu NtQueryObject 55 | typedef enum _PRIVATE_OBJECT_INFORMATION_CLASS { 56 | // Zakladni informace 57 | PrivateObjectBasicInformation, 58 | // Jmeno objektu 59 | PrivateObjectNameInformation, 60 | // Informace o typu objektu 61 | PrivateObjectTypeInformation, 62 | // Informace o vlastnostech a pocet objektu vsech typu 63 | PrivateObjectTypesInformation, 64 | // Atributy handle (P, I) 65 | PrivateObjectHandleFlagInformation, 66 | PrivateObjectSessionInformation, 67 | } PRIVATE_OBJECT_INFORMATION_CLASS; 68 | 69 | // Zakladni informace o objektu 70 | typedef struct _PRIVATE_OBJECT_BASIC_INFORMATION { 71 | ULONG Attributes; 72 | ACCESS_MASK GrantedAccess; 73 | ULONG HandleCount; 74 | ULONG PointerCount; 75 | ULONG PagedPoolCharge; 76 | ULONG NonPagedPoolCharge; 77 | ULONG Reserved[3]; 78 | ULONG NameInfoSize; 79 | ULONG TypeInfoSize; 80 | ULONG SecurityDescriptorSize; 81 | // Cas vytvoreni, platny pouze u symbolickych odkazu 82 | LARGE_INTEGER CreationTime; 83 | } PRIVATE_OBJECT_BASIC_INFORMATION, *PPRIVATE_OBJECT_BASIC_INFORMATION; 84 | 85 | // Jmeno objektu 86 | typedef struct _OBJECT_NAME_INFORMATION { // ntddk wdm nthal 87 | UNICODE_STRING Name; // ntddk wdm nthal 88 | } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION; // ntddk wdm nthal 89 | 90 | 91 | typedef NTSTATUS (NTAPI NTQUERYOBJECT)( 92 | _In_opt_ HANDLE Handle, 93 | _In_ PRIVATE_OBJECT_INFORMATION_CLASS ObjectInformationClass, 94 | _Out_opt_ PVOID ObjectInformation, 95 | _In_ ULONG ObjectInformationLength, 96 | _Out_opt_ PULONG ReturnLength); 97 | 98 | 99 | 100 | typedef VOID(WINAPI FILE_CALLBACK)(const PFILE_ID_BOTH_DIR_INFORMATION FileInfo, PVOID Context); 101 | 102 | 103 | 104 | DWORD AdjustPrivilege(const PWCHAR PrivilegeName); 105 | DWORD ListDirectory(HANDLE hDirectory, FILE_CALLBACK *Callback, PVOID Context); 106 | DWORD OpenFileRelative(const HANDLE hDirectory, const PWCHAR FileName, const USHORT FileNameLength, const DWORD DesiredAccess, const DWORD ShareMode, const BOOLEAN Directory, const BOOLEAN BackupIntent, PHANDLE FileHandle); 107 | DWORD QueryObjectName(HANDLE Object, POBJECT_NAME_INFORMATION *Name); 108 | 109 | DWORD UtilsModuleInit(VOID); 110 | VOID UtilsModuleFinit(VOID); 111 | 112 | 113 | 114 | #endif 115 | -------------------------------------------------------------------------------- /include/DllRegHider.pas: -------------------------------------------------------------------------------- 1 | Unit DllRegHider; 2 | 3 | Interface 4 | 5 | {$MINENUMSIZE 4} 6 | 7 | Uses 8 | Windows; 9 | 10 | Type 11 | _ERegistryValueOpMode = ( 12 | rvdmDeny, 13 | rvdmAllow, 14 | rvdmPretend); 15 | ERegistryValueOpMode = _ERegistryValueOpMode; 16 | PERegistryValueOpMode = ^ERegistryValueOpMode; 17 | 18 | _REGHIDER_HIDDEN_KEY_RECORD = Record 19 | KeyName:PWideChar; 20 | end; 21 | REGHIDER_HIDDEN_KEY_RECORD = _REGHIDER_HIDDEN_KEY_RECORD; 22 | PREGHIDER_HIDDEN_KEY_RECORD = ^REGHIDER_HIDDEN_KEY_RECORD; 23 | 24 | _REGHIDER_PSEUDO_VALUE_RECORD = Record 25 | KeyName : PWideChar; 26 | ValueName : PWideChar; 27 | ValueType : Cardinal; 28 | Data : Pointer; 29 | DataLength : Cardinal; 30 | ChangeMode : ERegistryValueOpMode; 31 | DeleteMode : ERegistryValueOpMode; 32 | ProcessName : PWideChar; 33 | end; 34 | REGHIDER_PSEUDO_VALUE_RECORD = _REGHIDER_PSEUDO_VALUE_RECORD; 35 | PREGHIDER_PSEUDO_VALUE_RECORD = ^REGHIDER_PSEUDO_VALUE_RECORD; 36 | 37 | REGHIDER_HIDDEN_KEY_CALLBACK = Function (Var ARecord:REGHIDER_HIDDEN_KEY_RECORD; AContext:Pointer):LongBool; StdCall; 38 | REGHIDER_PSEUDO_VALUE_CALLBACK = Function (Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD; AContext:Pointer):LongBool; StdCall; 39 | 40 | 41 | 42 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; 43 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; 44 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; 45 | 46 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 47 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; 48 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; 49 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 50 | 51 | Function Init:Cardinal; StdCall; 52 | Procedure Finit; StdCall; 53 | 54 | 55 | Implementation 56 | 57 | Const 58 | LibraryName = 'reghider.dll'; 59 | 60 | {$IFNDEF WIN32} 61 | 62 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 63 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 64 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 65 | 66 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 67 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName; 68 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 69 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 70 | 71 | Function Init:Cardinal; StdCall; External LibraryName; 72 | Procedure Finit; StdCall; External LibraryName; 73 | 74 | {$ELSE} 75 | 76 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyAdd@4'; 77 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyDelete@4'; 78 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_HiddenKeysEnum@8'; 79 | 80 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueAdd@32'; 81 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueDelete@8'; 82 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_PseudoValuesEnum@8'; 83 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueSet@32'; 84 | 85 | Function Init:Cardinal; StdCall; External LibraryName name '_Init@0'; 86 | Procedure Finit; StdCall; External LibraryName name '_Finit@0'; 87 | 88 | {$ENDIF} 89 | 90 | End. 91 | 92 | -------------------------------------------------------------------------------- /include/__history/DllRegHider.pas.~37~: -------------------------------------------------------------------------------- 1 | Unit DllRegHider; 2 | 3 | Interface 4 | 5 | {$MINENUMSIZE 4} 6 | 7 | Uses 8 | Windows; 9 | 10 | Type 11 | _ERegistryValueOpMode = ( 12 | rvdmDeny, 13 | rvdmAllow, 14 | rvdmPretend); 15 | ERegistryValueOpMode = _ERegistryValueOpMode; 16 | PERegistryValueOpMode = ^ERegistryValueOpMode; 17 | 18 | _REGHIDER_HIDDEN_KEY_RECORD = Record 19 | KeyName:PWideChar; 20 | end; 21 | REGHIDER_HIDDEN_KEY_RECORD = _REGHIDER_HIDDEN_KEY_RECORD; 22 | PREGHIDER_HIDDEN_KEY_RECORD = ^REGHIDER_HIDDEN_KEY_RECORD; 23 | 24 | _REGHIDER_PSEUDO_VALUE_RECORD = Record 25 | KeyName : PWideChar; 26 | ValueName : PWideChar; 27 | ValueType : Cardinal; 28 | Data : Pointer; 29 | DataLength : Cardinal; 30 | ChangeMode : ERegistryValueOpMode; 31 | DeleteMode : ERegistryValueOpMode; 32 | ProcessName : PWideChar; 33 | end; 34 | REGHIDER_PSEUDO_VALUE_RECORD = _REGHIDER_PSEUDO_VALUE_RECORD; 35 | PREGHIDER_PSEUDO_VALUE_RECORD = ^REGHIDER_PSEUDO_VALUE_RECORD; 36 | 37 | REGHIDER_HIDDEN_KEY_CALLBACK = Function (Var ARecord:REGHIDER_HIDDEN_KEY_RECORD; AContext:Pointer):LongBool; StdCall; 38 | REGHIDER_PSEUDO_VALUE_CALLBACK = Function (Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD; AContext:Pointer):LongBool; StdCall; 39 | 40 | 41 | 42 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; 43 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; 44 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; 45 | 46 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 47 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; 48 | Function PseudoValuesEnum(AKeyName:PWideChar; ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; 49 | 50 | Function Init:Cardinal; StdCall; 51 | Procedure Finit; StdCall; 52 | 53 | 54 | Implementation 55 | 56 | Const 57 | LibraryName = 'reghider.dll'; 58 | 59 | {$IFNDEF WIN32} 60 | 61 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 62 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 63 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 64 | 65 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 66 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName; 67 | Function PseudoValuesEnum(AKeyName:PWideChar; ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 68 | 69 | Function Init:Cardinal; StdCall; External LibraryName; 70 | Procedure Finit; StdCall; External LibraryName; 71 | 72 | {$ELSE} 73 | 74 | Function (AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyAdd@4'; 75 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyDelete@4'; 76 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_HiddenKeysEnum@8'; 77 | 78 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueAdd@32'; 79 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueDelete@8'; 80 | Function PseudoValuesEnum(AKeyName:PWideChar; ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_PseudoValuesEnum@12'; 81 | 82 | Function Init:Cardinal; StdCall; External LibraryName name '_Init@0'; 83 | Procedure Finit; StdCall; External LibraryName name '_Finit@0'; 84 | 85 | {$ENDIF} 86 | 87 | End. 88 | 89 | -------------------------------------------------------------------------------- /include/__history/DllRegHider.pas.~38~: -------------------------------------------------------------------------------- 1 | Unit DllRegHider; 2 | 3 | Interface 4 | 5 | {$MINENUMSIZE 4} 6 | 7 | Uses 8 | Windows; 9 | 10 | Type 11 | _ERegistryValueOpMode = ( 12 | rvdmDeny, 13 | rvdmAllow, 14 | rvdmPretend); 15 | ERegistryValueOpMode = _ERegistryValueOpMode; 16 | PERegistryValueOpMode = ^ERegistryValueOpMode; 17 | 18 | _REGHIDER_HIDDEN_KEY_RECORD = Record 19 | KeyName:PWideChar; 20 | end; 21 | REGHIDER_HIDDEN_KEY_RECORD = _REGHIDER_HIDDEN_KEY_RECORD; 22 | PREGHIDER_HIDDEN_KEY_RECORD = ^REGHIDER_HIDDEN_KEY_RECORD; 23 | 24 | _REGHIDER_PSEUDO_VALUE_RECORD = Record 25 | KeyName : PWideChar; 26 | ValueName : PWideChar; 27 | ValueType : Cardinal; 28 | Data : Pointer; 29 | DataLength : Cardinal; 30 | ChangeMode : ERegistryValueOpMode; 31 | DeleteMode : ERegistryValueOpMode; 32 | ProcessName : PWideChar; 33 | end; 34 | REGHIDER_PSEUDO_VALUE_RECORD = _REGHIDER_PSEUDO_VALUE_RECORD; 35 | PREGHIDER_PSEUDO_VALUE_RECORD = ^REGHIDER_PSEUDO_VALUE_RECORD; 36 | 37 | REGHIDER_HIDDEN_KEY_CALLBACK = Function (Var ARecord:REGHIDER_HIDDEN_KEY_RECORD; AContext:Pointer):LongBool; StdCall; 38 | REGHIDER_PSEUDO_VALUE_CALLBACK = Function (Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD; AContext:Pointer):LongBool; StdCall; 39 | 40 | 41 | 42 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; 43 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; 44 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; 45 | 46 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 47 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; 48 | Function PseudoValuesEnum(AKeyName:PWideChar; ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; 49 | 50 | Function Init:Cardinal; StdCall; 51 | Procedure Finit; StdCall; 52 | 53 | 54 | Implementation 55 | 56 | Const 57 | LibraryName = 'reghider.dll'; 58 | 59 | {$IFNDEF WIN32} 60 | 61 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 62 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 63 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 64 | 65 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 66 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName; 67 | Function PseudoValuesEnum(AKeyName:PWideChar; ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 68 | 69 | Function Init:Cardinal; StdCall; External LibraryName; 70 | Procedure Finit; StdCall; External LibraryName; 71 | 72 | {$ELSE} 73 | 74 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyAdd@4'; 75 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyDelete@4'; 76 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_HiddenKeysEnum@8'; 77 | 78 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueAdd@32'; 79 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueDelete@8'; 80 | Function PseudoValuesEnum(AKeyName:PWideChar; ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_PseudoValuesEnum@12'; 81 | 82 | Function Init:Cardinal; StdCall; External LibraryName name '_Init@0'; 83 | Procedure Finit; StdCall; External LibraryName name '_Finit@0'; 84 | 85 | {$ENDIF} 86 | 87 | End. 88 | 89 | -------------------------------------------------------------------------------- /include/__history/DllRegHider.pas.~39~: -------------------------------------------------------------------------------- 1 | Unit DllRegHider; 2 | 3 | Interface 4 | 5 | {$MINENUMSIZE 4} 6 | 7 | Uses 8 | Windows; 9 | 10 | Type 11 | _ERegistryValueOpMode = ( 12 | rvdmDeny, 13 | rvdmAllow, 14 | rvdmPretend); 15 | ERegistryValueOpMode = _ERegistryValueOpMode; 16 | PERegistryValueOpMode = ^ERegistryValueOpMode; 17 | 18 | _REGHIDER_HIDDEN_KEY_RECORD = Record 19 | KeyName:PWideChar; 20 | end; 21 | REGHIDER_HIDDEN_KEY_RECORD = _REGHIDER_HIDDEN_KEY_RECORD; 22 | PREGHIDER_HIDDEN_KEY_RECORD = ^REGHIDER_HIDDEN_KEY_RECORD; 23 | 24 | _REGHIDER_PSEUDO_VALUE_RECORD = Record 25 | KeyName : PWideChar; 26 | ValueName : PWideChar; 27 | ValueType : Cardinal; 28 | Data : Pointer; 29 | DataLength : Cardinal; 30 | ChangeMode : ERegistryValueOpMode; 31 | DeleteMode : ERegistryValueOpMode; 32 | ProcessName : PWideChar; 33 | end; 34 | REGHIDER_PSEUDO_VALUE_RECORD = _REGHIDER_PSEUDO_VALUE_RECORD; 35 | PREGHIDER_PSEUDO_VALUE_RECORD = ^REGHIDER_PSEUDO_VALUE_RECORD; 36 | 37 | REGHIDER_HIDDEN_KEY_CALLBACK = Function (Var ARecord:REGHIDER_HIDDEN_KEY_RECORD; AContext:Pointer):LongBool; StdCall; 38 | REGHIDER_PSEUDO_VALUE_CALLBACK = Function (Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD; AContext:Pointer):LongBool; StdCall; 39 | 40 | 41 | 42 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; 43 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; 44 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; 45 | 46 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 47 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; 48 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; 49 | 50 | Function Init:Cardinal; StdCall; 51 | Procedure Finit; StdCall; 52 | 53 | 54 | Implementation 55 | 56 | Const 57 | LibraryName = 'reghider.dll'; 58 | 59 | {$IFNDEF WIN32} 60 | 61 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 62 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 63 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 64 | 65 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 66 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName; 67 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 68 | 69 | Function Init:Cardinal; StdCall; External LibraryName; 70 | Procedure Finit; StdCall; External LibraryName; 71 | 72 | {$ELSE} 73 | 74 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyAdd@4'; 75 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyDelete@4'; 76 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_HiddenKeysEnum@8'; 77 | 78 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueAdd@32'; 79 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueDelete@8'; 80 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_PseudoValuesEnum@8'; 81 | 82 | Function Init:Cardinal; StdCall; External LibraryName name '_Init@0'; 83 | Procedure Finit; StdCall; External LibraryName name '_Finit@0'; 84 | 85 | {$ENDIF} 86 | 87 | End. 88 | 89 | -------------------------------------------------------------------------------- /include/__history/DllRegHider.pas.~40~: -------------------------------------------------------------------------------- 1 | Unit DllRegHider; 2 | 3 | Interface 4 | 5 | {$MINENUMSIZE 4} 6 | 7 | Uses 8 | Windows; 9 | 10 | Type 11 | _ERegistryValueOpMode = ( 12 | rvdmDeny, 13 | rvdmAllow, 14 | rvdmPretend); 15 | ERegistryValueOpMode = _ERegistryValueOpMode; 16 | PERegistryValueOpMode = ^ERegistryValueOpMode; 17 | 18 | _REGHIDER_HIDDEN_KEY_RECORD = Record 19 | KeyName:PWideChar; 20 | end; 21 | REGHIDER_HIDDEN_KEY_RECORD = _REGHIDER_HIDDEN_KEY_RECORD; 22 | PREGHIDER_HIDDEN_KEY_RECORD = ^REGHIDER_HIDDEN_KEY_RECORD; 23 | 24 | _REGHIDER_PSEUDO_VALUE_RECORD = Record 25 | KeyName : PWideChar; 26 | ValueName : PWideChar; 27 | ValueType : Cardinal; 28 | Data : Pointer; 29 | DataLength : Cardinal; 30 | ChangeMode : ERegistryValueOpMode; 31 | DeleteMode : ERegistryValueOpMode; 32 | ProcessName : PWideChar; 33 | end; 34 | REGHIDER_PSEUDO_VALUE_RECORD = _REGHIDER_PSEUDO_VALUE_RECORD; 35 | PREGHIDER_PSEUDO_VALUE_RECORD = ^REGHIDER_PSEUDO_VALUE_RECORD; 36 | 37 | REGHIDER_HIDDEN_KEY_CALLBACK = Function (Var ARecord:REGHIDER_HIDDEN_KEY_RECORD; AContext:Pointer):LongBool; StdCall; 38 | REGHIDER_PSEUDO_VALUE_CALLBACK = Function (Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD; AContext:Pointer):LongBool; StdCall; 39 | 40 | 41 | 42 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; 43 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; 44 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; 45 | 46 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 47 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; 48 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; 49 | 50 | Function Init:Cardinal; StdCall; 51 | Procedure Finit; StdCall; 52 | 53 | 54 | Implementation 55 | 56 | Const 57 | LibraryName = 'reghider.dll'; 58 | 59 | {$IFNDEF WIN32} 60 | 61 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 62 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 63 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 64 | 65 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 66 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName; 67 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 68 | 69 | Function Init:Cardinal; StdCall; External LibraryName; 70 | Procedure Finit; StdCall; External LibraryName; 71 | 72 | {$ELSE} 73 | 74 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyAdd@4'; 75 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyDelete@4'; 76 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_HiddenKeysEnum@8'; 77 | 78 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueAdd@32'; 79 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueDelete@8'; 80 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_PseudoValuesEnum@8'; 81 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLengthCardinal: ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name ''; 82 | 83 | Function Init:Cardinal; StdCall; External LibraryName name '_Init@0'; 84 | Procedure Finit; StdCall; External LibraryName name '_Finit@0'; 85 | 86 | {$ENDIF} 87 | 88 | End. 89 | 90 | -------------------------------------------------------------------------------- /include/__history/DllRegHider.pas.~41~: -------------------------------------------------------------------------------- 1 | Unit DllRegHider; 2 | 3 | Interface 4 | 5 | {$MINENUMSIZE 4} 6 | 7 | Uses 8 | Windows; 9 | 10 | Type 11 | _ERegistryValueOpMode = ( 12 | rvdmDeny, 13 | rvdmAllow, 14 | rvdmPretend); 15 | ERegistryValueOpMode = _ERegistryValueOpMode; 16 | PERegistryValueOpMode = ^ERegistryValueOpMode; 17 | 18 | _REGHIDER_HIDDEN_KEY_RECORD = Record 19 | KeyName:PWideChar; 20 | end; 21 | REGHIDER_HIDDEN_KEY_RECORD = _REGHIDER_HIDDEN_KEY_RECORD; 22 | PREGHIDER_HIDDEN_KEY_RECORD = ^REGHIDER_HIDDEN_KEY_RECORD; 23 | 24 | _REGHIDER_PSEUDO_VALUE_RECORD = Record 25 | KeyName : PWideChar; 26 | ValueName : PWideChar; 27 | ValueType : Cardinal; 28 | Data : Pointer; 29 | DataLength : Cardinal; 30 | ChangeMode : ERegistryValueOpMode; 31 | DeleteMode : ERegistryValueOpMode; 32 | ProcessName : PWideChar; 33 | end; 34 | REGHIDER_PSEUDO_VALUE_RECORD = _REGHIDER_PSEUDO_VALUE_RECORD; 35 | PREGHIDER_PSEUDO_VALUE_RECORD = ^REGHIDER_PSEUDO_VALUE_RECORD; 36 | 37 | REGHIDER_HIDDEN_KEY_CALLBACK = Function (Var ARecord:REGHIDER_HIDDEN_KEY_RECORD; AContext:Pointer):LongBool; StdCall; 38 | REGHIDER_PSEUDO_VALUE_CALLBACK = Function (Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD; AContext:Pointer):LongBool; StdCall; 39 | 40 | 41 | 42 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; 43 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; 44 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; 45 | 46 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 47 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; 48 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; 49 | 50 | Function Init:Cardinal; StdCall; 51 | Procedure Finit; StdCall; 52 | 53 | 54 | Implementation 55 | 56 | Const 57 | LibraryName = 'reghider.dll'; 58 | 59 | {$IFNDEF WIN32} 60 | 61 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 62 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 63 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 64 | 65 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 66 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName; 67 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 68 | 69 | Function Init:Cardinal; StdCall; External LibraryName; 70 | Procedure Finit; StdCall; External LibraryName; 71 | 72 | {$ELSE} 73 | 74 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyAdd@4'; 75 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyDelete@4'; 76 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_HiddenKeysEnum@8'; 77 | 78 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueAdd@32'; 79 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueDelete@8'; 80 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_PseudoValuesEnum@8'; 81 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLengthCardinal: ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueSet@32'; 82 | 83 | Function Init:Cardinal; StdCall; External LibraryName name '_Init@0'; 84 | Procedure Finit; StdCall; External LibraryName name '_Finit@0'; 85 | 86 | {$ENDIF} 87 | 88 | End. 89 | 90 | -------------------------------------------------------------------------------- /include/__history/DllRegHider.pas.~42~: -------------------------------------------------------------------------------- 1 | Unit DllRegHider; 2 | 3 | Interface 4 | 5 | {$MINENUMSIZE 4} 6 | 7 | Uses 8 | Windows; 9 | 10 | Type 11 | _ERegistryValueOpMode = ( 12 | rvdmDeny, 13 | rvdmAllow, 14 | rvdmPretend); 15 | ERegistryValueOpMode = _ERegistryValueOpMode; 16 | PERegistryValueOpMode = ^ERegistryValueOpMode; 17 | 18 | _REGHIDER_HIDDEN_KEY_RECORD = Record 19 | KeyName:PWideChar; 20 | end; 21 | REGHIDER_HIDDEN_KEY_RECORD = _REGHIDER_HIDDEN_KEY_RECORD; 22 | PREGHIDER_HIDDEN_KEY_RECORD = ^REGHIDER_HIDDEN_KEY_RECORD; 23 | 24 | _REGHIDER_PSEUDO_VALUE_RECORD = Record 25 | KeyName : PWideChar; 26 | ValueName : PWideChar; 27 | ValueType : Cardinal; 28 | Data : Pointer; 29 | DataLength : Cardinal; 30 | ChangeMode : ERegistryValueOpMode; 31 | DeleteMode : ERegistryValueOpMode; 32 | ProcessName : PWideChar; 33 | end; 34 | REGHIDER_PSEUDO_VALUE_RECORD = _REGHIDER_PSEUDO_VALUE_RECORD; 35 | PREGHIDER_PSEUDO_VALUE_RECORD = ^REGHIDER_PSEUDO_VALUE_RECORD; 36 | 37 | REGHIDER_HIDDEN_KEY_CALLBACK = Function (Var ARecord:REGHIDER_HIDDEN_KEY_RECORD; AContext:Pointer):LongBool; StdCall; 38 | REGHIDER_PSEUDO_VALUE_CALLBACK = Function (Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD; AContext:Pointer):LongBool; StdCall; 39 | 40 | 41 | 42 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; 43 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; 44 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; 45 | 46 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 47 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; 48 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; 49 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLengthCardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 50 | 51 | Function Init:Cardinal; StdCall; 52 | Procedure Finit; StdCall; 53 | 54 | 55 | Implementation 56 | 57 | Const 58 | LibraryName = 'reghider.dll'; 59 | 60 | {$IFNDEF WIN32} 61 | 62 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 63 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 64 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 65 | 66 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 67 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName; 68 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 69 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLengthCardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 70 | 71 | Function Init:Cardinal; StdCall; External LibraryName; 72 | Procedure Finit; StdCall; External LibraryName; 73 | 74 | {$ELSE} 75 | 76 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyAdd@4'; 77 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyDelete@4'; 78 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_HiddenKeysEnum@8'; 79 | 80 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueAdd@32'; 81 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueDelete@8'; 82 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_PseudoValuesEnum@8'; 83 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLengthCardinal: ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueSet@32'; 84 | 85 | Function Init:Cardinal; StdCall; External LibraryName name '_Init@0'; 86 | Procedure Finit; StdCall; External LibraryName name '_Finit@0'; 87 | 88 | {$ENDIF} 89 | 90 | End. 91 | 92 | -------------------------------------------------------------------------------- /include/__history/DllRegHider.pas.~43~: -------------------------------------------------------------------------------- 1 | Unit DllRegHider; 2 | 3 | Interface 4 | 5 | {$MINENUMSIZE 4} 6 | 7 | Uses 8 | Windows; 9 | 10 | Type 11 | _ERegistryValueOpMode = ( 12 | rvdmDeny, 13 | rvdmAllow, 14 | rvdmPretend); 15 | ERegistryValueOpMode = _ERegistryValueOpMode; 16 | PERegistryValueOpMode = ^ERegistryValueOpMode; 17 | 18 | _REGHIDER_HIDDEN_KEY_RECORD = Record 19 | KeyName:PWideChar; 20 | end; 21 | REGHIDER_HIDDEN_KEY_RECORD = _REGHIDER_HIDDEN_KEY_RECORD; 22 | PREGHIDER_HIDDEN_KEY_RECORD = ^REGHIDER_HIDDEN_KEY_RECORD; 23 | 24 | _REGHIDER_PSEUDO_VALUE_RECORD = Record 25 | KeyName : PWideChar; 26 | ValueName : PWideChar; 27 | ValueType : Cardinal; 28 | Data : Pointer; 29 | DataLength : Cardinal; 30 | ChangeMode : ERegistryValueOpMode; 31 | DeleteMode : ERegistryValueOpMode; 32 | ProcessName : PWideChar; 33 | end; 34 | REGHIDER_PSEUDO_VALUE_RECORD = _REGHIDER_PSEUDO_VALUE_RECORD; 35 | PREGHIDER_PSEUDO_VALUE_RECORD = ^REGHIDER_PSEUDO_VALUE_RECORD; 36 | 37 | REGHIDER_HIDDEN_KEY_CALLBACK = Function (Var ARecord:REGHIDER_HIDDEN_KEY_RECORD; AContext:Pointer):LongBool; StdCall; 38 | REGHIDER_PSEUDO_VALUE_CALLBACK = Function (Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD; AContext:Pointer):LongBool; StdCall; 39 | 40 | 41 | 42 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; 43 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; 44 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; 45 | 46 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 47 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; 48 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; 49 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLengthCardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 50 | 51 | Function Init:Cardinal; StdCall; 52 | Procedure Finit; StdCall; 53 | 54 | 55 | Implementation 56 | 57 | Const 58 | LibraryName = 'reghider.dll'; 59 | 60 | {$IFNDEF WIN32} 61 | 62 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 63 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 64 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 65 | 66 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 67 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName; 68 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 69 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLengthCardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 70 | 71 | Function Init:Cardinal; StdCall; External LibraryName; 72 | Procedure Finit; StdCall; External LibraryName; 73 | 74 | {$ELSE} 75 | 76 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyAdd@4'; 77 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyDelete@4'; 78 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_HiddenKeysEnum@8'; 79 | 80 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueAdd@32'; 81 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueDelete@8'; 82 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_PseudoValuesEnum@8'; 83 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLengthCardinal: ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueSet@32'; 84 | 85 | Function Init:Cardinal; StdCall; External LibraryName name '_Init@0'; 86 | Procedure Finit; StdCall; External LibraryName name '_Finit@0'; 87 | 88 | {$ENDIF} 89 | 90 | End. 91 | 92 | -------------------------------------------------------------------------------- /include/__history/DllRegHider.pas.~44~: -------------------------------------------------------------------------------- 1 | Unit DllRegHider; 2 | 3 | Interface 4 | 5 | {$MINENUMSIZE 4} 6 | 7 | Uses 8 | Windows; 9 | 10 | Type 11 | _ERegistryValueOpMode = ( 12 | rvdmDeny, 13 | rvdmAllow, 14 | rvdmPretend); 15 | ERegistryValueOpMode = _ERegistryValueOpMode; 16 | PERegistryValueOpMode = ^ERegistryValueOpMode; 17 | 18 | _REGHIDER_HIDDEN_KEY_RECORD = Record 19 | KeyName:PWideChar; 20 | end; 21 | REGHIDER_HIDDEN_KEY_RECORD = _REGHIDER_HIDDEN_KEY_RECORD; 22 | PREGHIDER_HIDDEN_KEY_RECORD = ^REGHIDER_HIDDEN_KEY_RECORD; 23 | 24 | _REGHIDER_PSEUDO_VALUE_RECORD = Record 25 | KeyName : PWideChar; 26 | ValueName : PWideChar; 27 | ValueType : Cardinal; 28 | Data : Pointer; 29 | DataLength : Cardinal; 30 | ChangeMode : ERegistryValueOpMode; 31 | DeleteMode : ERegistryValueOpMode; 32 | ProcessName : PWideChar; 33 | end; 34 | REGHIDER_PSEUDO_VALUE_RECORD = _REGHIDER_PSEUDO_VALUE_RECORD; 35 | PREGHIDER_PSEUDO_VALUE_RECORD = ^REGHIDER_PSEUDO_VALUE_RECORD; 36 | 37 | REGHIDER_HIDDEN_KEY_CALLBACK = Function (Var ARecord:REGHIDER_HIDDEN_KEY_RECORD; AContext:Pointer):LongBool; StdCall; 38 | REGHIDER_PSEUDO_VALUE_CALLBACK = Function (Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD; AContext:Pointer):LongBool; StdCall; 39 | 40 | 41 | 42 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; 43 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; 44 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; 45 | 46 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 47 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; 48 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; 49 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 50 | 51 | Function Init:Cardinal; StdCall; 52 | Procedure Finit; StdCall; 53 | 54 | 55 | Implementation 56 | 57 | Const 58 | LibraryName = 'reghider.dll'; 59 | 60 | {$IFNDEF WIN32} 61 | 62 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 63 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 64 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 65 | 66 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 67 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName; 68 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 69 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLengthCardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 70 | 71 | Function Init:Cardinal; StdCall; External LibraryName; 72 | Procedure Finit; StdCall; External LibraryName; 73 | 74 | {$ELSE} 75 | 76 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyAdd@4'; 77 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyDelete@4'; 78 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_HiddenKeysEnum@8'; 79 | 80 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueAdd@32'; 81 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueDelete@8'; 82 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_PseudoValuesEnum@8'; 83 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLengthCardinal: ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueSet@32'; 84 | 85 | Function Init:Cardinal; StdCall; External LibraryName name '_Init@0'; 86 | Procedure Finit; StdCall; External LibraryName name '_Finit@0'; 87 | 88 | {$ENDIF} 89 | 90 | End. 91 | 92 | -------------------------------------------------------------------------------- /include/__history/DllRegHider.pas.~45~: -------------------------------------------------------------------------------- 1 | Unit DllRegHider; 2 | 3 | Interface 4 | 5 | {$MINENUMSIZE 4} 6 | 7 | Uses 8 | Windows; 9 | 10 | Type 11 | _ERegistryValueOpMode = ( 12 | rvdmDeny, 13 | rvdmAllow, 14 | rvdmPretend); 15 | ERegistryValueOpMode = _ERegistryValueOpMode; 16 | PERegistryValueOpMode = ^ERegistryValueOpMode; 17 | 18 | _REGHIDER_HIDDEN_KEY_RECORD = Record 19 | KeyName:PWideChar; 20 | end; 21 | REGHIDER_HIDDEN_KEY_RECORD = _REGHIDER_HIDDEN_KEY_RECORD; 22 | PREGHIDER_HIDDEN_KEY_RECORD = ^REGHIDER_HIDDEN_KEY_RECORD; 23 | 24 | _REGHIDER_PSEUDO_VALUE_RECORD = Record 25 | KeyName : PWideChar; 26 | ValueName : PWideChar; 27 | ValueType : Cardinal; 28 | Data : Pointer; 29 | DataLength : Cardinal; 30 | ChangeMode : ERegistryValueOpMode; 31 | DeleteMode : ERegistryValueOpMode; 32 | ProcessName : PWideChar; 33 | end; 34 | REGHIDER_PSEUDO_VALUE_RECORD = _REGHIDER_PSEUDO_VALUE_RECORD; 35 | PREGHIDER_PSEUDO_VALUE_RECORD = ^REGHIDER_PSEUDO_VALUE_RECORD; 36 | 37 | REGHIDER_HIDDEN_KEY_CALLBACK = Function (Var ARecord:REGHIDER_HIDDEN_KEY_RECORD; AContext:Pointer):LongBool; StdCall; 38 | REGHIDER_PSEUDO_VALUE_CALLBACK = Function (Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD; AContext:Pointer):LongBool; StdCall; 39 | 40 | 41 | 42 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; 43 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; 44 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; 45 | 46 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 47 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; 48 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; 49 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 50 | 51 | Function Init:Cardinal; StdCall; 52 | Procedure Finit; StdCall; 53 | 54 | 55 | Implementation 56 | 57 | Const 58 | LibraryName = 'reghider.dll'; 59 | 60 | {$IFNDEF WIN32} 61 | 62 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 63 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 64 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 65 | 66 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 67 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName; 68 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 69 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 70 | 71 | Function Init:Cardinal; StdCall; External LibraryName; 72 | Procedure Finit; StdCall; External LibraryName; 73 | 74 | {$ELSE} 75 | 76 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyAdd@4'; 77 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyDelete@4'; 78 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_HiddenKeysEnum@8'; 79 | 80 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueAdd@32'; 81 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueDelete@8'; 82 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_PseudoValuesEnum@8'; 83 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLengthCardinal: ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueSet@32'; 84 | 85 | Function Init:Cardinal; StdCall; External LibraryName name '_Init@0'; 86 | Procedure Finit; StdCall; External LibraryName name '_Finit@0'; 87 | 88 | {$ENDIF} 89 | 90 | End. 91 | 92 | -------------------------------------------------------------------------------- /include/__history/DllRegHider.pas.~46~: -------------------------------------------------------------------------------- 1 | Unit DllRegHider; 2 | 3 | Interface 4 | 5 | {$MINENUMSIZE 4} 6 | 7 | Uses 8 | Windows; 9 | 10 | Type 11 | _ERegistryValueOpMode = ( 12 | rvdmDeny, 13 | rvdmAllow, 14 | rvdmPretend); 15 | ERegistryValueOpMode = _ERegistryValueOpMode; 16 | PERegistryValueOpMode = ^ERegistryValueOpMode; 17 | 18 | _REGHIDER_HIDDEN_KEY_RECORD = Record 19 | KeyName:PWideChar; 20 | end; 21 | REGHIDER_HIDDEN_KEY_RECORD = _REGHIDER_HIDDEN_KEY_RECORD; 22 | PREGHIDER_HIDDEN_KEY_RECORD = ^REGHIDER_HIDDEN_KEY_RECORD; 23 | 24 | _REGHIDER_PSEUDO_VALUE_RECORD = Record 25 | KeyName : PWideChar; 26 | ValueName : PWideChar; 27 | ValueType : Cardinal; 28 | Data : Pointer; 29 | DataLength : Cardinal; 30 | ChangeMode : ERegistryValueOpMode; 31 | DeleteMode : ERegistryValueOpMode; 32 | ProcessName : PWideChar; 33 | end; 34 | REGHIDER_PSEUDO_VALUE_RECORD = _REGHIDER_PSEUDO_VALUE_RECORD; 35 | PREGHIDER_PSEUDO_VALUE_RECORD = ^REGHIDER_PSEUDO_VALUE_RECORD; 36 | 37 | REGHIDER_HIDDEN_KEY_CALLBACK = Function (Var ARecord:REGHIDER_HIDDEN_KEY_RECORD; AContext:Pointer):LongBool; StdCall; 38 | REGHIDER_PSEUDO_VALUE_CALLBACK = Function (Var ARecord:REGHIDER_PSEUDO_VALUE_RECORD; AContext:Pointer):LongBool; StdCall; 39 | 40 | 41 | 42 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; 43 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; 44 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; 45 | 46 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 47 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; 48 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; 49 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; 50 | 51 | Function Init:Cardinal; StdCall; 52 | Procedure Finit; StdCall; 53 | 54 | 55 | Implementation 56 | 57 | Const 58 | LibraryName = 'reghider.dll'; 59 | 60 | {$IFNDEF WIN32} 61 | 62 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 63 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName; 64 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 65 | 66 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 67 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName; 68 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName; 69 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName; 70 | 71 | Function Init:Cardinal; StdCall; External LibraryName; 72 | Procedure Finit; StdCall; External LibraryName; 73 | 74 | {$ELSE} 75 | 76 | Function HiddenKeyAdd(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyAdd@4'; 77 | Function HiddenKeyDelete(AKeyName:PWideChar):Cardinal; StdCall; External LibraryName name '_HiddenKeyDelete@4'; 78 | Function HiddenKeysEnum(ACallback:REGHIDER_HIDDEN_KEY_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_HiddenKeysEnum@8'; 79 | 80 | Function PseudoValueAdd(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal; ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueAdd@32'; 81 | Function PseudoValueDelete(AKeyName:PWideChar; AValueName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueDelete@8'; 82 | Function PseudoValuesEnum(ACallback:REGHIDER_PSEUDO_VALUE_CALLBACK; AContext:Pointer):Cardinal; StdCall; External LibraryName name '_PseudoValuesEnum@8'; 83 | Function PseudoValueSet(AKeyName:PWideChar; AValueName:PWideChar; AValueType:Cardinal; AData:Pointer; ADataLength:Cardinal: ADeleteMode:ERegistryValueOpMode; AChangeMode:ERegistryValueOpMode; AProcessName:PWideChar):Cardinal; StdCall; External LibraryName name '_PseudoValueSet@32'; 84 | 85 | Function Init:Cardinal; StdCall; External LibraryName name '_Init@0'; 86 | Procedure Finit; StdCall; External LibraryName name '_Finit@0'; 87 | 88 | {$ENDIF} 89 | 90 | End. 91 | 92 | -------------------------------------------------------------------------------- /include/dllreghider.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __DLLREGHIDER_H__ 3 | #define __DLLREGHIDER_H__ 4 | 5 | #include 6 | #include "reghider-types.h" 7 | #include "libreghider-types.h" 8 | 9 | #ifdef DLLREGHIDER_EXPORTS 10 | 11 | #define REGHIDER_API EXTERN_C __declspec(dllexport) 12 | 13 | #else 14 | 15 | #define REGHIDER_API EXTERN_C __declspec(dllimport) 16 | 17 | #endif 18 | 19 | 20 | 21 | REGHIDER_API DWORD WINAPI HiddenKeyAdd(PWCHAR KeyName); 22 | REGHIDER_API DWORD WINAPI HiddenKeyDelete(PWCHAR KeyName); 23 | REGHIDER_API DWORD WINAPI HiddenKeysEnum(REGHIDER_HIDDEN_KEY_CALLBACK *Callback, PVOID Context); 24 | 25 | REGHIDER_API DWORD WINAPI PseudoValueAdd(PWCHAR KeyName, PWCHAR ValueName, ULONG Valuetype, PVOID Data, ULONG DataLength, ERegistryValueOpMode DeleteMode, ERegistryValueOpMode ChangeMode, PWCHAR ProcessName); 26 | REGHIDER_API DWORD WINAPI PseudoValueDelete(PWCHAR KeyName, PWCHAR ValueName); 27 | REGHIDER_API DWORD WINAPI PseudoValuesEnum(REGHIDER_PSEUDO_VALUE_CALLBACK *Callback, PVOID Context); 28 | REGHIDER_API DWORD WINAPI PseudoValueSet(PWCHAR KeyName, PWCHAR ValueName, ULONG ValueType, PVOID Data, ULONG DataLength, ERegistryValueOpMode DeleteMode, ERegistryValueOpMode ChangeMode, PWCHAR ProcessName); 29 | 30 | REGHIDER_API DWORD WINAPI Init(VOID); 31 | REGHIDER_API VOID WINAPI Finit(VOID); 32 | 33 | 34 | 35 | 36 | #endif 37 | -------------------------------------------------------------------------------- /include/libreghider-types.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __LIBREGHIDER_TYPES_H__ 3 | #define __LIBREGHIDER_TYPES_H__ 4 | 5 | #include 6 | #include "reghider-types.h" 7 | 8 | 9 | 10 | /** Stores information about one registry key hidden by the driver. */ 11 | typedef struct _REGHIDER_HIDDEN_KEY_RECORD { 12 | /** Full name of the key as it was specified when adding it to the list of hidden keys. */ 13 | PWCHAR KeyName; 14 | } REGHIDER_HIDDEN_KEY_RECORD, *PREGHIDER_HIDDEN_KEY_RECORD; 15 | 16 | /** Stores information about one registry value that is emulated by the driver. */ 17 | typedef struct _REGHIDER_PSEUDO_VALUE_RECORD { 18 | /** Full name of a registry key to which the value belongs. */ 19 | PWCHAR KeyName; 20 | /** Name of the value. */ 21 | PWCHAR ValueName; 22 | /** Type of the value data (REG_XXX). */ 23 | ULONG ValueType; 24 | /** Address of the value data buffer. */ 25 | PVOID Data; 26 | /** Length of the value data. */ 27 | ULONG DataLength; 28 | /** Determines what the driver should do when someone attempts to change value characteristics (SetValue operation). */ 29 | ERegistryValueOpMode ChangeMode; 30 | /** Determines what the driver should do when someone attempts to delete the value (DeleteValue operation). */ 31 | ERegistryValueOpMode DeleteMode; 32 | /** A suffix that determines which processes are able to see the value. Only processes with image file name ending 33 | with the suffix can see the value. */ 34 | PWCHAR ProcessName; 35 | } REGHIDER_PSEUDO_VALUE_RECORD, *PREGHIDER_PSEUDO_VALUE_RECORD; 36 | 37 | 38 | /** The callback is used to report one entry in the list of hidden registry keys. 39 | * 40 | * @param Record Address of the record with information about the key. 41 | * @param Context User-defined value passed to the @link(LibRegHiderHiddenKeysEnum) 42 | * as the second argument. 43 | * 44 | * @return 45 | * @value FALSE Abort the enumeration. 46 | * @value TRUE Continue with the enumeration. 47 | */ 48 | typedef BOOL(WINAPI REGHIDER_HIDDEN_KEY_CALLBACK)(PREGHIDER_HIDDEN_KEY_RECORD Record, PVOID Context); 49 | 50 | /** The callback is used to report one entry in the list of registry values emulated by the driver. 51 | * 52 | * @param Record Address of the record with information about the value. 53 | * @param Context User-defined value passed to the @link(LibRegHiderPseudoValuesEnum) 54 | * as the second argument. 55 | * 56 | * @return 57 | * @value FALSE Abort the enumeration. 58 | * @value TRUE Continue with the enumeration. 59 | */ 60 | typedef BOOL(WINAPI REGHIDER_PSEUDO_VALUE_CALLBACK)(PREGHIDER_PSEUDO_VALUE_RECORD Record, PVOID Context); 61 | 62 | 63 | 64 | 65 | #endif 66 | -------------------------------------------------------------------------------- /include/libreghider.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __LIBREGHIDER_H__ 3 | #define __LIBREGHIDER_H__ 4 | 5 | 6 | #include 7 | #include "reghider-types.h" 8 | #include "libreghider-types.h" 9 | 10 | 11 | /** @abstract 12 | * Hides a registry key. 13 | * 14 | * @description 15 | * Adds a new entry to the list of keys that will be hidden by the driver. 16 | * 17 | * The key name given in the only function argument must be an absolute path to the target 18 | * registry key. That menas, it must start with the \Registry prefix. The driver does not check 19 | * whether the given path is valid. 20 | * 21 | * @param KeyName A full name of the key to hide. 22 | * 23 | * @return 24 | * ERROR_XXX (ERROR_SUCCESS menas success). 25 | * 26 | * @remark 27 | * The absolute name of the key may be used in calls to other library functions manipulating with 28 | * hidden registry keys. 29 | */ 30 | DWORD LibRegHiderHiddenKeyAdd(PWCHAR KeyName); 31 | 32 | /** @abstract 33 | * Deletes a given name from the list of registry keys hidden by the driver. 34 | * 35 | * @param KeyName The name to delete. The name must match the one specified when adding the registry 36 | * key to the list. 37 | * 38 | * @return 39 | * ERROR_XXX (ERROR_SUCCESS menas success). 40 | */ 41 | DWORD LibRegHiderHiddenKeyDelete(PWCHAR KeyName); 42 | 43 | /** Enumerates all registry keys being hidden by the driver. 44 | * 45 | * @param Callback Address of a callback function that is invoked by the library with information about 46 | * each single registry key hidden by the driver. 47 | * @param Context User-defined value that is passed to each call of the callback. 48 | * 49 | * @return 50 | * ERROR_XXX (ERROR_SUCCESS menas success). 51 | */ 52 | DWORD LibRegHiderHiddenKeysEnum(REGHIDER_HIDDEN_KEY_CALLBACK *Callback, PVOID Context); 53 | 54 | /** @abstract 55 | * Instructs the driver to emulate a registry value. 56 | * 57 | * @param KeyName Full name of a registry key for which the value will be reported. The name must start with the 58 | * \Registry prefix. 59 | * @param ValueName Name of the value. If the key already has a value of such name, both values (the emulated one and the real one) 60 | * will be reported (the emulated one will be reported first) which might not be a good things to happen. 61 | * @param ValueType Type of the value data. 62 | * @param Data Buffer with value data. 63 | * @param DataLength Length of the value data buffer. 64 | * @param DeleteMode Determines what the driver should do when someone attempts to delete the emulated value. 65 | * @param ChangeMode Determines what the driver should do when someone attempts to change value's characteristics. 66 | * @param ProcessName A string. If non-NULL, the value will be presented only to processes the image file name of which 67 | * ends to this string. 68 | * 69 | * @return 70 | * ERROR_XXX (ERROR_SUCCESS menas success). 71 | */ 72 | DWORD LibRegHiderPseudoValueAdd(PWCHAR KeyName, PWCHAR ValueName, ULONG Valuetype, PVOID Data, ULONG DataLength, ERegistryValueOpMode DeleteMode, ERegistryValueOpMode ChangeMode, PWCHAR ProcessName); 73 | 74 | /** @abstract 75 | * Instructs the driver to stop emulating a given value. 76 | * 77 | * @param KeyName Full name of the key on which the value is emulated. 78 | * @param ValueName Name of the value. 79 | * 80 | * @return 81 | * ERROR_XXX (ERROR_SUCCESS menas success). 82 | */ 83 | DWORD LibRegHiderPseudoValueDelete(PWCHAR KeyName, PWCHAR ValueName); 84 | 85 | /** @abstract 86 | * Enumerates all registry values emulated by the driver. 87 | * 88 | * @param Callback Address of a callback routine that will be called to provide the user with 89 | * information about each value emulated by the driver. 90 | * @param Context User-defined value passed to every call of the callback. 91 | * 92 | * @return 93 | * ERROR_XXX (ERROR_SUCCESS menas success). 94 | */ 95 | DWORD LibRegHiderPseudoValuesEnum(REGHIDER_PSEUDO_VALUE_CALLBACK *Callback, PVOID Context); 96 | 97 | /** @abstract 98 | * Changes settings for a given emulated value. 99 | * 100 | * @description 101 | * The routine allows to change value type, data, change and delete modes and a process name. It is 102 | * not possible to change key or value name by this routine. 103 | * 104 | * @param KeyName Full name of the key. 105 | * @param ValueName Name of the emulated value. 106 | * @param ValueType Type of the value data. 107 | * @param Data Buffer with value data. 108 | * @param DataLength Length of the value data buffer. 109 | * @param DeleteMode Determines what the driver should do when someone attempts to delete the emulated value. 110 | * @param ChangeMode Determines what the driver should do when someone attempts to change value's characteristics. 111 | * @param ProcessName A string. If non-NULL, the value will be presented only to processes the image file name of which 112 | * ends to this string. 113 | * 114 | * @return 115 | * ERROR_XXX (ERROR_SUCCESS for success). 116 | */ 117 | DWORD LibRegHiderPseudoValueSet(PWCHAR KeyName, PWCHAR ValueName, ULONG ValueType, PVOID Data, ULONG DataLength, ERegistryValueOpMode DeleteMode, ERegistryValueOpMode ChangeMode, PWCHAR ProcessName); 118 | 119 | 120 | /** @abstract 121 | * Initializes the reghider.dll library. 122 | * 123 | * @description 124 | * The routine just attempts to get a handle to driver's device. It neither 125 | * installs, nor loads the driver. You must do these steps yourself. 126 | * 127 | * @return 128 | * @value ERROR_SUCCESS Initialization succeeded. 129 | * @value Other An error occurred. 130 | */ 131 | DWORD LibRegHiderInit(VOID); 132 | 133 | /** @abstract 134 | * Finalizes the library. 135 | * 136 | * @description 137 | * Just disconnects driver's device (closes the handle to it). 138 | */ 139 | VOID LibRegHiderFinit(VOID); 140 | 141 | 142 | 143 | #endif 144 | -------------------------------------------------------------------------------- /include/reghider-ioctl.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __IOCTL_H__ 3 | #define __IOCTL_H__ 4 | 5 | 6 | 7 | 8 | #include "reghider-types.h" 9 | 10 | 11 | #define REGHIDER_USERMODE_NAME L"\\\\.\\RegHider" 12 | 13 | #define IOCTL_REGHIDER_HIDDEN_KEY_ADD CTL_CODE(FILE_DEVICE_UNKNOWN, 0x01, METHOD_BUFFERED, FILE_WRITE_ACCESS) 14 | #define IOCTL_REGHIDER_HIDDEN_KEY_ENUM CTL_CODE(FILE_DEVICE_UNKNOWN, 0x02, METHOD_NEITHER, FILE_READ_ACCESS) 15 | #define IOCTL_REGHIDER_HIDDEN_KEY_DELETE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x03, METHOD_BUFFERED, FILE_WRITE_ACCESS) 16 | 17 | #define IOCTL_REGHIDER_PSEUDO_VALUE_ADD CTL_CODE(FILE_DEVICE_UNKNOWN, 0x11, METHOD_BUFFERED, FILE_WRITE_ACCESS) 18 | #define IOCTL_REGHIDER_PSEUDO_VALUE_ENUM CTL_CODE(FILE_DEVICE_UNKNOWN, 0x12, METHOD_NEITHER, FILE_READ_ACCESS) 19 | #define IOCTL_REGHIDER_PSEUDO_VALUE_DELETE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x13, METHOD_BUFFERED, FILE_WRITE_ACCESS) 20 | #define IOCTL_REGHIDER_PSUEDO_VALUE_SET CTL_CODE(FILE_DEVICE_UNKNOWN, 0x14, METHOD_BUFFERED, FILE_WRITE_ACCESS) 21 | 22 | 23 | /************************************************************************/ 24 | /* IOCTL_REGHIDER_HIDDEN_KEY_ADD */ 25 | /************************************************************************/ 26 | 27 | typedef struct _IOCTL_REGHIDER_HIDDEN_KEY_ADD_INPUT{ 28 | USHORT KeyNameLength; 29 | WCHAR KeyName[1]; 30 | } IOCTL_REGHIDER_HIDDEN_KEY_ADD_INPUT, *PIOCTL_REGHIDER_HIDDEN_KEY_ADD_INPUT; 31 | 32 | /************************************************************************/ 33 | /* IOCTL_REGHIDER_HIDDEN_KEY_ENUM */ 34 | /************************************************************************/ 35 | 36 | typedef struct _IOCTL_REGHIDER_HIDDEN_KEY_ENUM_OUTPUT { 37 | ULONG NextEntryOffset; 38 | USHORT KeyNameLength; 39 | WCHAR KeyName[1]; 40 | } IOCTL_REGHIDER_HIDDEN_KEY_ENUM_OUTPUT, *PIOCTL_REGHIDER_HIDDEN_KEY_ENUM_OUTPUT; 41 | 42 | /************************************************************************/ 43 | /* IOCTL_REGHIDER_HIDDEN_KEY_DELETE */ 44 | /************************************************************************/ 45 | 46 | typedef struct _IOCTL_REGHIDER_HIDDEN_KEY_DELETE_INPUT { 47 | USHORT KeyNameLength; 48 | WCHAR KeyName[1]; 49 | } IOCTL_REGHIDER_HIDDEN_KEY_DELETE_INPUT, *PIOCTL_REGHIDER_HIDDEN_KEY_DELETE_INPUT; 50 | 51 | /************************************************************************/ 52 | /* IOCTL_REGHIDER_PSEUDO_VALUE_ADD */ 53 | /************************************************************************/ 54 | 55 | typedef struct _IOCTL_REGHIDER_PSEUDO_VALUE_ADD_INPUT { 56 | ULONG ValueType; 57 | ERegistryValueOpMode ChangeMode; 58 | ERegistryValueOpMode DeleteMode; 59 | ULONG DataLength; 60 | ULONG DataOffset; 61 | USHORT NameLength; 62 | ULONG NameOffset; 63 | USHORT ProcessNameLength; 64 | ULONG ProcessNameOffset; 65 | USHORT KeyNameLength; 66 | ULONG KeyNameOffset; 67 | } IOCTL_REGHIDER_PSEUDO_VALUE_ADD_INPUT, *PIOCTL_REGHIDER_PSEUDO_VALUE_ADD_INPUT; 68 | 69 | /************************************************************************/ 70 | /* IOCTL_REGHIDER_PSEUDO_VALUE_ENUM */ 71 | /************************************************************************/ 72 | 73 | typedef struct _IOCTL_REGHIDER_PSEUDO_VALUE_ENUM_OUTPUT { 74 | ULONG NextEntryOffset; 75 | ULONG Valuetype; 76 | ERegistryValueOpMode ChangeMode; 77 | ERegistryValueOpMode DeleteMode; 78 | ULONG DataLength; 79 | ULONG DataOffset; 80 | USHORT NameLength; 81 | ULONG NameOffset; 82 | USHORT ProcessNameLength; 83 | ULONG ProcessNameOffset; 84 | USHORT KeyNameLength; 85 | ULONG KeyNameOffset; 86 | } IOCTL_REGHIDER_PSEUDO_VALUE_ENUM_OUTPUT, *PIOCTL_REGHIDER_PSEUDO_VALUE_ENUM_OUTPUT; 87 | 88 | /************************************************************************/ 89 | /* IOCTL_REGHIDER_PSEUDO_VALUE_DELETE */ 90 | /************************************************************************/ 91 | 92 | typedef struct _IOCTL_REGHIDER_PSEUDO_VALUE_DELETE_INPUT { 93 | USHORT KeyNameLength; 94 | ULONG KeyNameOffset; 95 | USHORT ValueNameLength; 96 | ULONG ValueNameOffset; 97 | } IOCTL_REGHIDER_PSEUDO_VALUE_DELETE_INPUT, *PIOCTL_REGHIDER_PSEUDO_VALUE_DELETE_INPUT; 98 | 99 | /************************************************************************/ 100 | /* IOCTL_REGHIDER_PSUEDO_VALUE_SET */ 101 | /************************************************************************/ 102 | 103 | typedef struct _IOCTL_REGHIDER_PSUEDO_VALUE_SET_INPUT { 104 | ULONG KeyNameOffset; 105 | ULONG ValueNameOffset; 106 | ULONG ProcessNameOffset; 107 | ULONG DataOffset; 108 | ULONG DataLength; 109 | ULONG ValueType; 110 | ERegistryValueOpMode ChangeMode; 111 | ERegistryValueOpMode DeleteMode; 112 | USHORT KeyNameLength; 113 | USHORT ValeNameLength; 114 | USHORT ProcessNameLength; 115 | } IOCTL_REGHIDER_PSUEDO_VALUE_SET_INPUT, *PIOCTL_REGHIDER_PSUEDO_VALUE_SET_INPUT; 116 | 117 | 118 | 119 | #endif 120 | -------------------------------------------------------------------------------- /include/reghider-types.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __REGHIDER_TYPES_H__ 3 | #define __REGHIDER_TYPES_H__ 4 | 5 | 6 | 7 | /** Lists possible behaviors of the driver when someone attempts to change or delete a registry value 8 | * the driver emulates. */ 9 | typedef enum _ERegistryValueOpMode { 10 | /** Deny the operation (the initiator gets STATUS_ACCESS_DENIED). */ 11 | rvdmDeny, 12 | /** Permit the operation (the emulated value's characteristics change, or it is completely deleted (its emulation stops)). */ 13 | rvdmAllow, 14 | /** Pretend that the operaton succeeded (The initiator gets STATUS_SUCCESS but nothing actually happens to the emulated value)). */ 15 | rvdmPretend, 16 | } ERegistryValueOpMode, *PERegistryValueOpMode; 17 | 18 | 19 | 20 | 21 | 22 | #endif 23 | -------------------------------------------------------------------------------- /libreghider/ReadMe.txt: -------------------------------------------------------------------------------- 1 | ======================================================================== 2 | STATIC LIBRARY : libreghider Project Overview 3 | ======================================================================== 4 | 5 | AppWizard has created this libreghider library project for you. 6 | 7 | No source files were created as part of your project. 8 | 9 | 10 | libreghider.vcxproj 11 | This is the main project file for VC++ projects generated using an Application Wizard. 12 | It contains information about the version of Visual C++ that generated the file, and 13 | information about the platforms, configurations, and project features selected with the 14 | Application Wizard. 15 | 16 | libreghider.vcxproj.filters 17 | This is the filters file for VC++ projects generated using an Application Wizard. 18 | It contains information about the association between the files in your project 19 | and the filters. This association is used in the IDE to show grouping of files with 20 | similar extensions under a specific node (for e.g. ".cpp" files are associated with the 21 | "Source Files" filter). 22 | 23 | ///////////////////////////////////////////////////////////////////////////// 24 | Other notes: 25 | 26 | AppWizard uses "TODO:" comments to indicate parts of the source code you 27 | should add to or customize. 28 | 29 | ///////////////////////////////////////////////////////////////////////////// 30 | -------------------------------------------------------------------------------- /libreghider/libreghider.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Debug 10 | x64 11 | 12 | 13 | Release 14 | Win32 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | {6C76D5F4-9CB5-4318-9ABF-F3847E580E16} 32 | Win32Proj 33 | libreghider 34 | 35 | 36 | 37 | StaticLibrary 38 | true 39 | v120 40 | Unicode 41 | 42 | 43 | StaticLibrary 44 | true 45 | v120 46 | Unicode 47 | 48 | 49 | StaticLibrary 50 | false 51 | v120 52 | true 53 | Unicode 54 | 55 | 56 | StaticLibrary 57 | false 58 | v120 59 | true 60 | Unicode 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | Level3 92 | Disabled 93 | WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions) 94 | MultiThreadedDebug 95 | 96 | 97 | Windows 98 | true 99 | 100 | 101 | 102 | 103 | 104 | 105 | Level3 106 | Disabled 107 | WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions) 108 | MultiThreadedDebug 109 | 110 | 111 | Windows 112 | true 113 | 114 | 115 | 116 | 117 | Level3 118 | 119 | 120 | MaxSpeed 121 | true 122 | true 123 | WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions) 124 | MultiThreaded 125 | 126 | 127 | Windows 128 | true 129 | true 130 | true 131 | 132 | 133 | 134 | 135 | Level3 136 | 137 | 138 | MaxSpeed 139 | true 140 | true 141 | WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions) 142 | MultiThreaded 143 | 144 | 145 | Windows 146 | true 147 | true 148 | true 149 | 150 | 151 | 152 | 153 | 154 | -------------------------------------------------------------------------------- /libreghider/libreghider.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | 23 | 24 | Header Files 25 | 26 | 27 | Header Files 28 | 29 | 30 | Header Files 31 | 32 | 33 | Header Files 34 | 35 | 36 | -------------------------------------------------------------------------------- /ndisprot6-test/ip-headers.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __IP_HEADERS_H__ 3 | #define __IP_HEADERS_H__ 4 | 5 | 6 | #include 7 | 8 | 9 | 10 | #define MAC_ADDR_LEN 6 11 | 12 | 13 | #include 14 | 15 | 16 | // Ethernet header 17 | 18 | typedef struct _ETH_HEADER { 19 | unsigned char DstAddr[MAC_ADDR_LEN]; 20 | unsigned char SrcAddr[MAC_ADDR_LEN]; 21 | unsigned short EthType; 22 | } ETH_HEADER, *PETH_HEADER; 23 | 24 | // IPv4 header 25 | 26 | typedef struct ip_hdr { 27 | unsigned char ip_verlen; // 4-bit IPv4 version, 4-bit header length (in 32-bit words) 28 | unsigned char ip_tos; // IP type of service 29 | unsigned short ip_totallength; // Total length 30 | unsigned short ip_id; // Unique identifier 31 | unsigned short ip_offset; // Fragment offset field 32 | unsigned char ip_ttl; // Time to live 33 | unsigned char ip_protocol; // Protocol(TCP,UDP etc) 34 | unsigned short ip_checksum; // IP checksum 35 | unsigned int ip_srcaddr; // Source address 36 | unsigned int ip_destaddr; // Source address 37 | } IPV4_HDR, *PIPV4_HDR, FAR * LPIPV4_HDR; 38 | 39 | // ICMP header 40 | 41 | typedef struct icmp_hdr { 42 | unsigned char icmp_type; 43 | unsigned char icmp_code; 44 | unsigned short icmp_checksum; 45 | unsigned short icmp_id; 46 | unsigned short icmp_sequence; 47 | unsigned long icmp_timestamp; 48 | } ICMP_HDR, *PICMP_HDR, FAR *LPICMP_HDR; 49 | 50 | #include 51 | 52 | typedef struct addrinfo { 53 | int ai_flags; 54 | int ai_family; 55 | int ai_socktype; 56 | int ai_protocol; 57 | size_t ai_addrlen; 58 | char *ai_canonname; 59 | struct sockaddr *ai_addr; 60 | struct addrinfo *ai_next; 61 | } ADDRINFOA, *PADDRINFOA; 62 | 63 | 64 | 65 | 66 | #endif 67 | -------------------------------------------------------------------------------- /ndisprot6-test/ndisprot6-test.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | 23 | 24 | Header Files 25 | 26 | 27 | -------------------------------------------------------------------------------- /ndisprot6/debug.h: -------------------------------------------------------------------------------- 1 | /*++ 2 | 3 | Copyright (c) 2000 Microsoft Corporation 4 | 5 | Module Name: 6 | 7 | debug.h 8 | 9 | Abstract: 10 | 11 | Debug macros for NDISPROT 12 | 13 | Revision History: 14 | 15 | Notes: 16 | 17 | --*/ 18 | 19 | #ifndef _NPROTDEBUG__H 20 | #define _NPROTDEBUG__H 21 | 22 | // 23 | // Message verbosity: lower values indicate higher urgency 24 | // 25 | #define DL_EXTRA_LOUD 20 26 | #define DL_VERY_LOUD 10 27 | #define DL_LOUD 8 28 | #define DL_INFO 6 29 | #define DL_WARN 4 30 | #define DL_ERROR 2 31 | #define DL_FATAL 0 32 | 33 | #if DBG_SPIN_LOCK 34 | 35 | typedef struct _NPROT_LOCK 36 | { 37 | ULONG Signature; 38 | ULONG IsAcquired; 39 | PKTHREAD OwnerThread; 40 | ULONG TouchedByFileNumber; 41 | ULONG TouchedInLineNumber; 42 | NDIS_SPIN_LOCK NdisLock; 43 | } NPROT_LOCK, *PNPROT_LOCK; 44 | 45 | #define NPROTL_SIG 'KCOL' 46 | 47 | extern NDIS_SPIN_LOCK ndisprotDbgLogLock; 48 | 49 | extern 50 | VOID 51 | ndisprotAllocateSpinLock( 52 | IN PNPROT_LOCK pLock, 53 | IN ULONG FileNumber, 54 | IN ULONG LineNumber 55 | ); 56 | 57 | extern 58 | VOID 59 | ndisprotFreeSpinLock( 60 | IN PNPROT_LOCK pLock, 61 | IN ULONG FileNumber, 62 | IN ULONG LineNumber 63 | ); 64 | 65 | extern 66 | VOID 67 | ndisprotAcquireSpinLock( 68 | IN PNPROT_LOCK pLock, 69 | IN BOOLEAN DispatchLevel, 70 | IN ULONG FileNumber, 71 | IN ULONG LineNumber 72 | ); 73 | 74 | extern 75 | VOID 76 | ndisprotReleaseSpinLock( 77 | IN PNPROT_LOCK pLock, 78 | IN BOOLEAN DispatchLevel, 79 | IN ULONG FileNumber, 80 | IN ULONG LineNumber 81 | ); 82 | 83 | extern 84 | VOID 85 | ndisprotFreeDbgLock( 86 | VOID 87 | ); 88 | 89 | #define CHECK_LOCK_COUNT(Count) \ 90 | { \ 91 | if ((INT)(Count) < 0) \ 92 | { \ 93 | DbgPrint("Lock Count %d is < 0! File %s, Line %d\n",\ 94 | Count, __FILE__, __LINE__); \ 95 | DbgBreakPoint(); \ 96 | } \ 97 | } 98 | #else 99 | 100 | #define CHECK_LOCK_COUNT(Count) 101 | 102 | typedef NDIS_SPIN_LOCK NPROT_LOCK; 103 | typedef PNDIS_SPIN_LOCK PNPROT_LOCK; 104 | 105 | #endif // DBG_SPIN_LOCK 106 | 107 | #if DBG 108 | 109 | extern INT ndisprotDebugLevel; 110 | 111 | 112 | #define DEBUGP(lev, stmt) \ 113 | { \ 114 | if ((lev) <= ndisprotDebugLevel) \ 115 | { \ 116 | DbgPrint("Ndisprot: "); DbgPrint stmt; \ 117 | } \ 118 | } 119 | 120 | #define DEBUGPDUMP(lev, pBuf, Len) \ 121 | { \ 122 | if ((lev) <= ndisprotDebugLevel) \ 123 | { \ 124 | DbgPrintHexDump((PUCHAR)(pBuf), (ULONG)(Len)); \ 125 | } \ 126 | } 127 | 128 | #define NPROT_ASSERT(exp) \ 129 | { \ 130 | if (!(exp)) \ 131 | { \ 132 | DbgPrint("Ndisprot: assert " #exp " failed in" \ 133 | " file %s, line %d\n", __FILE__, __LINE__); \ 134 | DbgBreakPoint(); \ 135 | } \ 136 | } 137 | 138 | #define NPROT_SET_SIGNATURE(s, t)\ 139 | (s)->t##_sig = t##_signature; 140 | 141 | #define NPROT_STRUCT_ASSERT(s, t) \ 142 | if ((s)->t##_sig != t##_signature) \ 143 | { \ 144 | DbgPrint("ndisprot: assertion failure" \ 145 | " for type " #t " at 0x%p in file %s, line %d\n", \ 146 | s, __FILE__, __LINE__); \ 147 | DbgBreakPoint(); \ 148 | } 149 | 150 | 151 | // 152 | // Memory Allocation/Freeing Audit: 153 | // 154 | 155 | // 156 | // The NPROTD_ALLOCATION structure stores all info about one allocation 157 | // 158 | typedef struct _NPROTD_ALLOCATION { 159 | 160 | ULONG Signature; 161 | struct _NPROTD_ALLOCATION *Next; 162 | struct _NPROTD_ALLOCATION *Prev; 163 | ULONG FileNumber; 164 | ULONG LineNumber; 165 | ULONG Size; 166 | ULONG_PTR Location; // where the returned ptr was stored 167 | union 168 | { 169 | ULONGLONG Alignment; 170 | UCHAR UserData; 171 | }; 172 | 173 | } NPROTD_ALLOCATION, *PNPROTD_ALLOCATION; 174 | 175 | #define NPROTD_MEMORY_SIGNATURE (ULONG)'CSII' 176 | 177 | extern 178 | PVOID 179 | ndisprotAuditAllocMem ( 180 | PVOID pPointer, 181 | ULONG Size, 182 | ULONG FileNumber, 183 | ULONG LineNumber 184 | ); 185 | 186 | extern 187 | VOID 188 | ndisprotAuditFreeMem( 189 | PVOID Pointer 190 | ); 191 | 192 | extern 193 | VOID 194 | ndisprotAuditShutdown( 195 | VOID 196 | ); 197 | 198 | extern 199 | VOID 200 | DbgPrintHexDump( 201 | PUCHAR pBuffer, 202 | ULONG Length 203 | ); 204 | 205 | #else 206 | 207 | // 208 | // No debug 209 | // 210 | #define DEBUGP(lev, stmt) 211 | #define DEBUGPDUMP(lev, pBuf, Len) 212 | 213 | #define NPROT_ASSERT(exp) 214 | #define NPROT_SET_SIGNATURE(s, t) 215 | #define NPROT_STRUCT_ASSERT(s, t) 216 | 217 | #endif // DBG 218 | 219 | 220 | #endif // _NPROTDEBUG__H 221 | 222 | -------------------------------------------------------------------------------- /ndisprot6/excallbk.c: -------------------------------------------------------------------------------- 1 | /*++ 2 | 3 | Copyright (c) Microsoft Corporation. All rights reserved. 4 | 5 | THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY 6 | KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE 7 | IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR 8 | PURPOSE. 9 | 10 | Module Name: 11 | 12 | ExCallbk.c 13 | 14 | Abstract: The routines in this module helps to solve driver load order 15 | dependency between this sample and NDISWDM sample. These 16 | routines are not required in a typical protocol driver. By default 17 | this module is not included in the sample. You include these routines 18 | by adding EX_CALLBACK defines to the 'sources' file. Read the 19 | NDISWDM samples readme file for more information on how ExCallback 20 | kernel interfaces are used to solve driver load order issue. 21 | 22 | 23 | Environment: 24 | 25 | Kernel mode 26 | 27 | 28 | Revision History: 29 | 30 | --*/ 31 | 32 | #include "precomp.h" 33 | 34 | #ifdef EX_CALLBACK 35 | 36 | #define __FILENUMBER 'LCxE' 37 | 38 | #define NDISPROT_CALLBACK_NAME L"\\Callback\\NdisProtCallbackObject" 39 | 40 | #define CALLBACK_SOURCE_NDISPROT 0 41 | #define CALLBACK_SOURCE_NDISWDM 1 42 | 43 | PCALLBACK_OBJECT CallbackObject = NULL; 44 | PVOID CallbackRegisterationHandle = NULL; 45 | 46 | typedef VOID (* NOTIFY_PRESENCE_CALLBACK)(OUT PVOID Source); 47 | 48 | #ifdef ALLOC_PRAGMA 49 | 50 | #pragma alloc_text(PAGE, ndisprotRegisterExCallBack) 51 | #pragma alloc_text(PAGE, ndisprotUnregisterExCallBack) 52 | 53 | #endif // ALLOC_PRAGMA 54 | 55 | BOOLEAN 56 | ndisprotRegisterExCallBack() 57 | { 58 | OBJECT_ATTRIBUTES ObjectAttr; 59 | UNICODE_STRING CallBackObjectName; 60 | NTSTATUS Status; 61 | BOOLEAN bResult = TRUE; 62 | 63 | DEBUGP(DL_LOUD, ("--> ndisprotRegisterExCallBack\n")); 64 | 65 | PAGED_CODE(); 66 | 67 | do { 68 | 69 | RtlInitUnicodeString(&CallBackObjectName, NDISPROT_CALLBACK_NAME); 70 | 71 | InitializeObjectAttributes(&ObjectAttr, 72 | &CallBackObjectName, 73 | OBJ_CASE_INSENSITIVE | OBJ_PERMANENT, 74 | NULL, 75 | NULL); 76 | 77 | Status = ExCreateCallback(&CallbackObject, 78 | &ObjectAttr, 79 | TRUE, 80 | TRUE); 81 | 82 | 83 | if (!NT_SUCCESS(Status)) 84 | { 85 | 86 | DEBUGP(DL_ERROR, ("RegisterExCallBack: failed to create callback %lx\n", Status)); 87 | bResult = FALSE; 88 | break; 89 | } 90 | 91 | CallbackRegisterationHandle = ExRegisterCallback(CallbackObject, 92 | ndisprotCallback, 93 | (PVOID)NULL); 94 | if (CallbackRegisterationHandle == NULL) 95 | { 96 | DEBUGP(DL_ERROR,("RegisterExCallBack: failed to register a Callback routine%lx\n", Status)); 97 | bResult = FALSE; 98 | break; 99 | } 100 | 101 | ExNotifyCallback(CallbackObject, 102 | (PVOID)CALLBACK_SOURCE_NDISPROT, 103 | (PVOID)NULL); 104 | 105 | 106 | }while(FALSE); 107 | 108 | if(!bResult) { 109 | if (CallbackRegisterationHandle) 110 | { 111 | ExUnregisterCallback(CallbackRegisterationHandle); 112 | CallbackRegisterationHandle = NULL; 113 | } 114 | 115 | if (CallbackObject) 116 | { 117 | ObDereferenceObject(CallbackObject); 118 | CallbackObject = NULL; 119 | } 120 | } 121 | 122 | DEBUGP(DL_LOUD, ("<-- ndisprotRegisterExCallBack\n")); 123 | 124 | return bResult; 125 | 126 | } 127 | 128 | VOID 129 | ndisprotUnregisterExCallBack() 130 | { 131 | DEBUGP(DL_LOUD, ("--> ndisprotUnregisterExCallBack\n")); 132 | 133 | PAGED_CODE(); 134 | 135 | if (CallbackRegisterationHandle) 136 | { 137 | ExUnregisterCallback(CallbackRegisterationHandle); 138 | CallbackRegisterationHandle = NULL; 139 | } 140 | 141 | if (CallbackObject) 142 | { 143 | ObDereferenceObject(CallbackObject); 144 | CallbackObject = NULL; 145 | } 146 | 147 | DEBUGP(DL_LOUD, ("<-- ndisprotUnregisterExCallBack\n")); 148 | 149 | } 150 | 151 | VOID 152 | ndisprotCallback( 153 | PVOID CallBackContext, 154 | PVOID Source, 155 | PVOID CallbackAddr 156 | ) 157 | { 158 | NOTIFY_PRESENCE_CALLBACK func; 159 | 160 | DEBUGP(DL_LOUD, ("==>ndisprotoCallback: Source %lx, CallbackAddr %p\n", 161 | Source, CallbackAddr)); 162 | 163 | // 164 | // if we are the one issuing this notification, just return 165 | // 166 | if (Source == CALLBACK_SOURCE_NDISPROT) { 167 | return; 168 | } 169 | 170 | // 171 | // Notification is coming from NDISWDM 172 | // let it know that you are here 173 | // 174 | ASSERT(Source == (PVOID)CALLBACK_SOURCE_NDISWDM); 175 | 176 | if(Source == (PVOID)CALLBACK_SOURCE_NDISWDM) { 177 | 178 | ASSERT(CallbackAddr); 179 | 180 | if (CallbackAddr == NULL) 181 | { 182 | DEBUGP(DL_ERROR, ("Callback called with invalid address %p\n", CallbackAddr)); 183 | return; 184 | } 185 | 186 | func = CallbackAddr; 187 | 188 | func(CALLBACK_SOURCE_NDISPROT); 189 | } 190 | 191 | DEBUGP(DL_LOUD, ("<==ndisprotoCallback: Source, %lx\n", Source)); 192 | 193 | } 194 | 195 | #endif 196 | 197 | -------------------------------------------------------------------------------- /ndisprot6/ndisprot.htm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/ndisprot6/ndisprot.htm -------------------------------------------------------------------------------- /ndisprot6/ndisprot.inf: -------------------------------------------------------------------------------- 1 | ;------------------------------------------------------------------------- 2 | ; NDISPROT.INF -- Sample NDIS Protocol Driver 3 | ; 4 | ; Copyright (c) 2003, Microsoft Corporation 5 | ;------------------------------------------------------------------------- 6 | [version] 7 | Signature = "$Windows NT$" 8 | Class = NetTrans 9 | ClassGUID = {4d36e975-e325-11ce-bfc1-08002be10318} 10 | Provider = %Msft% 11 | DriverVer =10/01/2002,6.0.5019.0 12 | 13 | [Manufacturer] 14 | %Msft%=MSFT,NTx86,NTia64,NTamd64 15 | 16 | [MSFT.NTx86] 17 | %NDISPROT_Desc%=Install, MS_NDISPROT 18 | 19 | [MSFT.NTia64] 20 | %NDISPROT_Desc%=Install, MS_NDISPROT 21 | 22 | [MSFT.NTamd64] 23 | %NDISPROT_Desc%=Install, MS_NDISPROT 24 | 25 | ;------------------------------------------------------------------------- 26 | ; Installation Section 27 | ;------------------------------------------------------------------------- 28 | [Install] 29 | AddReg=Inst_Ndi 30 | Characteristics=0x0 ; 31 | CopyFiles=CpyFiles_Sys 32 | 33 | ;------------------------------------------------------------------------- 34 | ; Ndi installation support 35 | ;------------------------------------------------------------------------- 36 | [Inst_Ndi] 37 | HKR,Ndi,Service,,"Ndisprot6" 38 | HKR,Ndi,HelpText,,%NDISPROT_HelpText% 39 | HKR,Ndi\Interfaces, UpperRange,, noupper 40 | HKR,"Ndi\Interfaces","LowerRange",,"ndis5,ndis4,ndis5_prot" 41 | 42 | ;------------------------------------------------------------------------- 43 | ; Service installation support 44 | ;------------------------------------------------------------------------- 45 | [Install.Services] 46 | AddService=Ndisprot6,,NDISPROT_Service_Inst 47 | 48 | [NDISPROT_Service_Inst] 49 | DisplayName = %NDISPROT_Desc% 50 | ServiceType = 1 ;SERVICE_KERNEL_DRIVER 51 | StartType = 3 ;SERVICE_DEMAND_START 52 | ErrorControl = 1 ;SERVICE_ERROR_NORMAL 53 | ServiceBinary = %12%\ndisprot6.sys 54 | LoadOrderGroup = NDIS 55 | Description = %NDISPROT_Desc% 56 | 57 | [Install.Remove.Services] 58 | DelService=Ndisprot6,0x200 59 | 60 | ;------------------------------------------------------------------------- 61 | ; Declare Destination Directories for file copy/deletion 62 | ;------------------------------------------------------------------------- 63 | [SourceDisksNames] 64 | 1=%DiskDescription%,"",, 65 | 66 | [SourceDisksFiles] 67 | ndisprot6.sys=1 68 | 69 | 70 | [DestinationDirs] 71 | CpyFiles_Sys = 12 ; DIRID_DRIVERS 72 | 73 | 74 | ;------------------------------------------------------------------------- 75 | ; Files to Copy/Delete - Referenced by Install and Remove sections above 76 | ;------------------------------------------------------------------------- 77 | [CpyFiles_Sys] 78 | Ndisprot6.sys,,,2 79 | 80 | [Strings] 81 | Msft = "Microsoft" 82 | DiskDescription = "Raw Frame Driver Disk" 83 | NDISPROT_Desc = "Raw Frame Driver" 84 | NDISPROT_HelpText = "A driver to support user-mode I/O on NDIS devices" 85 | 86 | 87 | 88 | 89 | 90 | 91 | -------------------------------------------------------------------------------- /ndisprot6/ndisprot.rc: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | /*-----------------------------------------------*/ 5 | /* the following lines are specific to this file */ 6 | /*-----------------------------------------------*/ 7 | 8 | /* VER_FILETYPE, VER_FILESUBTYPE, VER_FILEDESCRIPTION_STR 9 | * and VER_INTERNALNAME_STR must be defined before including COMMON.VER 10 | * The strings don't need a '\0', since common.ver has them. 11 | */ 12 | #define VER_FILETYPE VFT_DRV 13 | /* possible values: VFT_UNKNOWN 14 | VFT_APP 15 | VFT_DLL 16 | VFT_DRV 17 | VFT_FONT 18 | VFT_VXD 19 | VFT_STATIC_LIB 20 | */ 21 | #define VER_FILESUBTYPE VFT2_DRV_NETWORK 22 | /* possible values VFT2_UNKNOWN 23 | VFT2_DRV_PRINTER 24 | VFT2_DRV_KEYBOARD 25 | VFT2_DRV_LANGUAGE 26 | VFT2_DRV_DISPLAY 27 | VFT2_DRV_MOUSE 28 | VFT2_DRV_NETWORK 29 | VFT2_DRV_SYSTEM 30 | VFT2_DRV_INSTALLABLE 31 | VFT2_DRV_SOUND 32 | VFT2_DRV_COMM 33 | */ 34 | #define VER_FILEDESCRIPTION_STR "NDIS User mode I/O Driver" 35 | #define VER_INTERNALNAME_STR "NDISPROT.SYS" 36 | #define VER_ORIGINALFILENAME_STR "NDISPROT.SYS" 37 | #define VER_LANGNEUTRAL 38 | 39 | #include "common.ver" 40 | 41 | 42 | -------------------------------------------------------------------------------- /ndisprot6/ndisprot6.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {8E41214B-6785-4CFE-B992-037D68949A14} 18 | inf;inv;inx;mof;mc; 19 | 20 | 21 | 22 | 23 | Source Files 24 | 25 | 26 | Source Files 27 | 28 | 29 | Source Files 30 | 31 | 32 | Source Files 33 | 34 | 35 | Source Files 36 | 37 | 38 | Source Files 39 | 40 | 41 | 42 | 43 | Header Files 44 | 45 | 46 | Header Files 47 | 48 | 49 | Header Files 50 | 51 | 52 | Header Files 53 | 54 | 55 | Header Files 56 | 57 | 58 | 59 | 60 | Resource Files 61 | 62 | 63 | -------------------------------------------------------------------------------- /ndisprot6/precomp.h: -------------------------------------------------------------------------------- 1 | #pragma warning(disable:4214) // bit field types other than int 2 | 3 | #pragma warning(disable:4201) // nameless struct/union 4 | #pragma warning(disable:4115) // named type definition in parentheses 5 | #pragma warning(disable:4127) // conditional expression is constant 6 | #pragma warning(disable:4054) // cast of function pointer to PVOID 7 | #pragma warning(disable:4244) // conversion from 'int' to 'BOOLEAN', possible loss of data 8 | #pragma warning(disable:4206) // nonstandard extension used : translation unit is empty 9 | 10 | #include "ndis.h" 11 | #include "ntddk.h" 12 | #include 13 | #include 14 | #include 15 | #include "debug.h" 16 | #include "ndisprot.h" 17 | #include "macros.h" 18 | #include "protuser.h" 19 | 20 | -------------------------------------------------------------------------------- /ndisprot6/protuser.h: -------------------------------------------------------------------------------- 1 | /*++ 2 | 3 | Copyright (c) 2000 Microsoft Corporation 4 | 5 | Module Name: 6 | 7 | nuiouser.h 8 | 9 | Abstract: 10 | 11 | Constants and types to access the NDISPROT driver. 12 | Users must also include ntddndis.h 13 | 14 | Environment: 15 | 16 | User/Kernel mode. 17 | 18 | Revision History: 19 | 20 | --*/ 21 | 22 | #ifndef __NPROTUSER__H 23 | #define __NPROTUSER__H 24 | 25 | 26 | #define FSCTL_NDISPROT_BASE FILE_DEVICE_NETWORK 27 | 28 | #define _NDISPROT_CTL_CODE(_Function, _Method, _Access) \ 29 | CTL_CODE(FSCTL_NDISPROT_BASE, _Function, _Method, _Access) 30 | 31 | #define IOCTL_NDISPROT_OPEN_DEVICE \ 32 | _NDISPROT_CTL_CODE(0x200, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) 33 | 34 | #define IOCTL_NDISPROT_QUERY_OID_VALUE \ 35 | _NDISPROT_CTL_CODE(0x201, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) 36 | 37 | #define IOCTL_NDISPROT_SET_OID_VALUE \ 38 | _NDISPROT_CTL_CODE(0x205, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) 39 | 40 | #define IOCTL_NDISPROT_QUERY_BINDING \ 41 | _NDISPROT_CTL_CODE(0x203, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) 42 | 43 | #define IOCTL_NDISPROT_BIND_WAIT \ 44 | _NDISPROT_CTL_CODE(0x204, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS) 45 | 46 | 47 | // 48 | // Structure to go with IOCTL_NDISPROT_QUERY_OID_VALUE. 49 | // The Data part is of variable length, determined by 50 | // the input buffer length passed to DeviceIoControl. 51 | // 52 | typedef struct _NDISPROT_QUERY_OID 53 | { 54 | NDIS_OID Oid; 55 | NDIS_PORT_NUMBER PortNumber; 56 | UCHAR Data[sizeof(ULONG)]; 57 | } NDISPROT_QUERY_OID, *PNDISPROT_QUERY_OID; 58 | 59 | // 60 | // Structure to go with IOCTL_NDISPROT_SET_OID_VALUE. 61 | // The Data part is of variable length, determined 62 | // by the input buffer length passed to DeviceIoControl. 63 | // 64 | typedef struct _NDISPROT_SET_OID 65 | { 66 | NDIS_OID Oid; 67 | NDIS_PORT_NUMBER PortNumber; 68 | UCHAR Data[sizeof(ULONG)]; 69 | } NDISPROT_SET_OID, *PNDISPROT_SET_OID; 70 | 71 | 72 | // 73 | // Structure to go with IOCTL_NDISPROT_QUERY_BINDING. 74 | // The input parameter is BindingIndex, which is the 75 | // index into the list of bindings active at the driver. 76 | // On successful completion, we get back a device name 77 | // and a device descriptor (friendly name). 78 | // 79 | typedef struct _NDISPROT_QUERY_BINDING 80 | { 81 | ULONG BindingIndex; // 0-based binding number 82 | ULONG DeviceNameOffset; // from start of this struct 83 | ULONG DeviceNameLength; // in bytes 84 | ULONG DeviceDescrOffset; // from start of this struct 85 | ULONG DeviceDescrLength; // in bytes 86 | 87 | } NDISPROT_QUERY_BINDING, *PNDISPROT_QUERY_BINDING; 88 | 89 | #endif // __NPROTUSER__H 90 | 91 | -------------------------------------------------------------------------------- /ppt/hiding-things-on-windows-platform.odp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/ppt/hiding-things-on-windows-platform.odp -------------------------------------------------------------------------------- /ppt/hiding-things-on-windows-platform.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/ppt/hiding-things-on-windows-platform.pdf -------------------------------------------------------------------------------- /ppt/registry.avi: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/ppt/registry.avi -------------------------------------------------------------------------------- /reghider/allocator.h: -------------------------------------------------------------------------------- 1 | 2 | /** 3 | * @file 4 | * 5 | * Header file exporting routines of our special memory allocator capable of 6 | * detecting memory leaks and buffer overflows. 7 | */ 8 | 9 | #ifndef __PNPMON_ALLOCATOR_H__ 10 | #define __PNPMON_ALLOCATOR_H__ 11 | 12 | #include 13 | 14 | 15 | /** Magic signature of block header, used to detect overrides. */ 16 | #define BLOCK_HEADER_SIGNATURE 0xfeadefdf 17 | /** Magic signature of block footer, used to detect overrides. */ 18 | #define BLOCK_FOOTER_SIGNATURE 0xf00defdf 19 | 20 | 21 | /** Structure of the header of memory block allocated by the allocator. */ 22 | typedef struct { 23 | ULONG Signature; 24 | /** Used to store the block within list of allocated blocks. */ 25 | LIST_ENTRY Entry; 26 | /** Name of function that allocated the block. */ 27 | PCHAR Function; 28 | /** Line of code where the allocation occurred. */ 29 | ULONG Line; 30 | /** Type of memory pool the block is allocated from. */ 31 | POOL_TYPE PoolType; 32 | /** Size of the block, in bytes (without the header and the footer). */ 33 | SIZE_T NumberOfBytes; 34 | /** Header signature */ 35 | ULONG Signature2; 36 | } DEBUG_BLOCK_HEADER, *PDEBUG_BLOCK_HEADER; 37 | 38 | /** Structure of the footer of memory block allocated by the allocator. */ 39 | typedef struct { 40 | /** Signature of the footer. */ 41 | ULONG Signature; 42 | } DEBUG_BLOCK_FOOTER, *PDEBUG_BLOCK_FOOTER; 43 | 44 | 45 | PVOID DebugAllocatorAlloc(POOL_TYPE PoolType, SIZE_T NumberOfBytes, PCHAR Function, ULONG Line); 46 | VOID DebugAllocatorFree(PVOID Address); 47 | 48 | #ifdef _DEBUG 49 | 50 | #define HeapMemoryAlloc(PoolType,NumberOfBytes) DebugAllocatorAlloc(PoolType, NumberOfBytes, __FUNCTION__, __LINE__) 51 | #define HeapMemoryFree(Buffer) DebugAllocatorFree(Buffer) 52 | 53 | #else 54 | 55 | #define HeapMemoryAlloc(PoolType,NumberOfBytes) ExAllocatePool(PoolType,NumberOfBytes) 56 | #define HeapMemoryFree(Buffer) ExFreePool(Buffer) 57 | 58 | #endif 59 | 60 | #define HeapMemoryAllocPaged(NumberOfBytes) HeapMemoryAlloc(PagedPool, NumberOfBytes) 61 | #define HeapMemoryAllocNonPaged(NumberOfBytes) HeapMemoryAlloc(NonPagedPool, NumberOfBytes) 62 | 63 | 64 | NTSTATUS DebugAllocatorModuleInit(VOID); 65 | VOID DebugAllocatorModuleFinit(VOID); 66 | 67 | 68 | #endif 69 | -------------------------------------------------------------------------------- /reghider/key-record.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __KEY_RECORD_H__ 3 | #define __KEY_RECORD_H__ 4 | 5 | #include 6 | #include "reghider-types.h" 7 | #include "hash_table.h" 8 | #include "string-hash-table.h" 9 | 10 | 11 | 12 | typedef struct _REGISTRY_VALUE_RECORD { 13 | LIST_ENTRY Entry; 14 | volatile LONG ReferenceCount; 15 | BOOLEAN DeletePending; 16 | UNICODE_STRING ValueName; 17 | ERESOURCE DataLock; 18 | ULONG ValueType; 19 | ULONG DataLength; 20 | PVOID Data; 21 | ERESOURCE ProcessNameLock; 22 | UNICODE_STRING ProcessName; 23 | ERESOURCE ModeLock; 24 | ERegistryValueOpMode DeleteMode; 25 | ERegistryValueOpMode ChangeMode; 26 | } REGISTRY_VALUE_RECORD, *PREGISTRY_VALUE_RECORD; 27 | 28 | 29 | typedef struct _REGISTRY_SUBKEY_RECORD { 30 | LIST_ENTRY Entry; 31 | volatile LONG ReferenceCount; 32 | BOOLEAN DeletePending; 33 | UNICODE_STRING Name; 34 | UNICODE_STRING ProcessName; 35 | } REGISTRY_SUBKEY_RECORD, *PREGISTRY_SUBKEY_RECORD; 36 | 37 | typedef struct _REGISTRY_KEY_RECORD { 38 | /** Links all key records together to make their enumeration more easy. */ 39 | LIST_ENTRY Entry; 40 | /** Number of references pointing to the record. If it drops to zero, the record 41 | is automatically freed. */ 42 | volatile LONG ReferenceCount; 43 | BOOLEAN DeletePending; 44 | UNICODE_STRING Name; 45 | /** Contains subkeys that will be hidden. 46 | Key = name of the subkey 47 | data = REGISTRY_SUBKEY_RECORD */ 48 | PHASH_TABLE HiddenSubkeys; 49 | LIST_ENTRY HiddenSubkeyListHead; 50 | ERESOURCE HiddenSubkeyLock; 51 | /** Contains values that will be emulated by the driver. 52 | key = value name 53 | data = REGISTRY_VALUE_RECORD */ 54 | PHASH_TABLE PseudoValues; 55 | LIST_ENTRY PseudoValueListHead; 56 | ERESOURCE PseudoValueLock; 57 | } REGISTRY_KEY_RECORD, *PREGISTRY_KEY_RECORD; 58 | 59 | 60 | 61 | 62 | NTSTATUS KeyRecordCreate(_In_ PUNICODE_STRING KeyName, _Out_ PREGISTRY_KEY_RECORD *Record); 63 | NTSTATUS KeyRecordDelete(_In_ PUNICODE_STRING KeyName); 64 | VOID KeyRecordDereference(_Inout_ PREGISTRY_KEY_RECORD Record); 65 | NTSTATUS KeyRecordGet(_In_ PUNICODE_STRING KeyName, _Out_ PREGISTRY_KEY_RECORD *Record); 66 | NTSTATUS KeyRecordsEnumerate(_Out_ PREGISTRY_KEY_RECORD **Array, _Out_ PSIZE_T Count); 67 | VOID KeyRecordsDereference(_Inout_ PREGISTRY_KEY_RECORD *Array, _In_ SIZE_T Count); 68 | 69 | NTSTATUS KeyRecordAddHiddenSubkey(_In_ PREGISTRY_KEY_RECORD Record, _In_ PUNICODE_STRING SubkyName, _In_opt_ PUNICODE_STRING ProcessName); 70 | NTSTATUS KeyRecordDeleteHiddenSubkey(_In_ PREGISTRY_KEY_RECORD Record, _In_ PUNICODE_STRING SubkeyName); 71 | NTSTATUS KeyRecordGetHiddenSubkey(_In_ PREGISTRY_KEY_RECORD Record, _In_ PUNICODE_STRING SubkeyName, _Out_ PREGISTRY_SUBKEY_RECORD *SubkeyRecord); 72 | VOID KeyRecordHiddenSubkeyDereference(_In_ PREGISTRY_KEY_RECORD Record, _Inout_ PREGISTRY_SUBKEY_RECORD SubkeyRecord); 73 | NTSTATUS KeyRecordHiddenSubkeysEnumerate(_In_ PREGISTRY_KEY_RECORD Record, _Out_ PREGISTRY_SUBKEY_RECORD **Array, _Out_ PSIZE_T Count); 74 | VOID KeyRecordHiddenSubkeysDereference(_Inout_ PREGISTRY_KEY_RECORD Record, _Inout_ PREGISTRY_SUBKEY_RECORD *Array, _In_ SIZE_T Count); 75 | 76 | NTSTATUS KeyRecordAddPseudoValue(_In_ PREGISTRY_KEY_RECORD Record, _In_ PUNICODE_STRING ValueName, _In_ ULONG ValueType, _In_opt_ ULONG ValueDataLength, _In_opt_ PVOID ValueData, _In_ ERegistryValueOpMode DeleteMode, _In_ ERegistryValueOpMode ChangeMode, _In_opt_ PUNICODE_STRING ProcessName); 77 | NTSTATUS KeyRecordChangePseudoValue(_In_ PREGISTRY_KEY_RECORD Record, _In_ PREGISTRY_VALUE_RECORD ValueRecord, _In_ ULONG ValueType, _In_opt_ PVOID Data, _In_opt_ ULONG DataLength, _In_ ERegistryValueOpMode ChangeMode, _In_ ERegistryValueOpMode DeleteMode, _In_opt_ PUNICODE_STRING ProcessName); 78 | NTSTATUS KeyRecordDeletePsuedoValue(_In_ PREGISTRY_KEY_RECORD Record, _In_ PUNICODE_STRING ValueName); 79 | NTSTATUS KeyRecordGetPseudoValue(_In_ PREGISTRY_KEY_RECORD Record, _In_ PUNICODE_STRING ValueName, _Out_ PREGISTRY_VALUE_RECORD *ValueRecord); 80 | NTSTATUS KeyRecordGetPseudoValueByIndex(_In_ PREGISTRY_KEY_RECORD Record, _In_ ULONG Index, _Out_ PREGISTRY_VALUE_RECORD *ValueRecord); 81 | ULONG KeyRecordGetPseudoValuesCount(_In_ PREGISTRY_KEY_RECORD Record); 82 | VOID KeyRecordPseudoValueDereference(_In_ PREGISTRY_KEY_RECORD Record, _Inout_ PREGISTRY_VALUE_RECORD ValueRecord); 83 | NTSTATUS KeyRecordPseudoValuesEnumerate(_In_ PREGISTRY_KEY_RECORD Record, _Out_ PREGISTRY_VALUE_RECORD **Array, _Out_ PSIZE_T Count); 84 | VOID KeyRecordPseudoValuesDereference(_Inout_ PREGISTRY_KEY_RECORD Record, _Inout_ PREGISTRY_VALUE_RECORD *Array, _In_ SIZE_T Count); 85 | 86 | 87 | NTSTATUS KeyRecordModuleInit(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath); 88 | VOID KeyRecordModuleFInit(_In_ PDRIVER_OBJECT DriverObject); 89 | 90 | 91 | 92 | #endif 93 | -------------------------------------------------------------------------------- /reghider/preprocessor.h: -------------------------------------------------------------------------------- 1 | #ifndef __PREPROCESSOR_H_ 2 | #define __PREPROCESSOR_H_ 3 | 4 | #include 5 | 6 | /* 7 | * Thanks for these macros: 8 | * http://www.decompile.com/cpp/faq/file_and_line_error_string.htm 9 | */ 10 | #define STRINGIFY(x) #x 11 | #define TOSTRING(x) STRINGIFY(x) 12 | 13 | #define AT_FUNCTION __FUNCTION__ 14 | #define AT_LINE AT_FUNCTION ":" TOSTRING(__LINE__) 15 | 16 | 17 | #ifdef DBG 18 | 19 | #define DEBUG_TRACE_ENABLED 1 20 | #define DEBUG_DISPLAY_PID_TID_IRQL 1 21 | 22 | /* 23 | * Prints the source file and function name. Determined for non-parametric 24 | * functions. 25 | */ 26 | #define DEBUG_ENTER_FUNCTION_NO_ARGS() \ 27 | DbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_TRACE_LEVEL, AT_FUNCTION "()\n") \ 28 | 29 | /* 30 | * Prints the source file, function name and parameters. 31 | */ 32 | #define DEBUG_ENTER_FUNCTION(paramsFormat,...) \ 33 | DbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_TRACE_LEVEL, AT_FUNCTION "(" paramsFormat ")\n", __VA_ARGS__) \ 34 | 35 | /* 36 | * Prints the source file, function name and the return value. 37 | */ 38 | #define DEBUG_EXIT_FUNCTION(returnValueFormat,...) \ 39 | DbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_TRACE_LEVEL, AT_FUNCTION "(-):" returnValueFormat "\n", __VA_ARGS__) \ 40 | 41 | /* 42 | * Prints the source file and function name. Determined for ending a function 43 | * without a return value. 44 | */ 45 | #define DEBUG_EXIT_FUNCTION_VOID() \ 46 | DbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_TRACE_LEVEL, AT_FUNCTION "(-):void\n") \ 47 | 48 | /* 49 | * Prints the source file, function name and the number of the line. 50 | */ 51 | #define DEBUG_PRINT_LOCATION_VOID() \ 52 | DbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_TRACE_LEVEL, AT_LINE "\n") 53 | 54 | /* 55 | * Prints the source file, function name and the number of the line. 56 | */ 57 | #define DEBUG_PRINT_LOCATION(format,...) \ 58 | DbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_TRACE_LEVEL, AT_LINE " " format "\n", __VA_ARGS__) 59 | 60 | /* 61 | * Macro for reporting error conditions. 62 | */ 63 | #define DEBUG_ERROR(format,...) \ 64 | DbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_ERROR_LEVEL, AT_LINE " ERROR: " format "\n", __VA_ARGS__); \ 65 | // __debugbreak() \ 66 | 67 | 68 | #define DEBUG_IRQL_LESS_OR_EQUAL(aIrql) \ 69 | if (KeGetCurrentIrql() > (aIrql)) { \ 70 | DEBUG_ERROR("Current IRQL (%d) is too high. Expected at most %d", KeGetCurrentIrql(), (aIrql)); \ 71 | } \ 72 | 73 | #define DEBUG_IRQL_EQUAL(aIrql) \ 74 | if (KeGetCurrentIrql() != (aIrql)) { \ 75 | DEBUG_ERROR("Current IRQL (%d) is not valid. Expected %d", KeGetCurrentIrql(), (aIrql)); \ 76 | } \ 77 | 78 | #else // ifdef ENABLE_DEBUG_LOGS 79 | 80 | #define DEBUG_ENTER_FUNCTION_NO_ARGS() { } 81 | #define DEBUG_ENTER_FUNCTION(paramsFormat,...) { } 82 | #define DEBUG_EXIT_FUNCTION(returnValueFormat,...) { } 83 | #define DEBUG_EXIT_FUNCTION_VOID() { } 84 | #define DEBUG_PRINT_LOCATION_VOID() { } 85 | #define DEBUG_PRINT_LOCATION(format,...) { } 86 | #define DEBUG_IRQL_LESS_OR_EQUAL(aIrql) { } 87 | #define DEBUG_IRQL_EQUAL(aIrql) { } 88 | 89 | /* 90 | * Macro for reporting error conditions. 91 | */ 92 | #define DEBUG_ERROR(format,...) \ 93 | DbgPrintEx(DPFLTR_DEFAULT_ID, DPFLTR_ERROR_LEVEL, AT_LINE format "\n", __VA_ARGS__) 94 | 95 | #endif // ifdef ENABLE_DEBUG_LOGS 96 | 97 | 98 | 99 | 100 | #endif // ifndef __PREPROCESSOR_H_ 101 | 102 | -------------------------------------------------------------------------------- /reghider/process-db.c: -------------------------------------------------------------------------------- 1 | 2 | #include 3 | #include "preprocessor.h" 4 | #include "allocator.h" 5 | #include "hash_table.h" 6 | #include "process-db.h" 7 | 8 | /************************************************************************/ 9 | /* GLOBAL VARIABLES */ 10 | /************************************************************************/ 11 | 12 | static PHASH_TABLE _processTable = NULL; 13 | static ERESOURCE _processTableLock; 14 | 15 | /************************************************************************/ 16 | /* HELPER FUNCTIONS */ 17 | /************************************************************************/ 18 | 19 | static ULONG32 _HashFunction(PVOID Key) 20 | { 21 | return ((ULONG32)Key >> 2); 22 | } 23 | 24 | static BOOLEAN _CompareFunction(PHASH_ITEM Item, PVOID Key) 25 | { 26 | PPROCESSDB_PROCESS_RECORD rec = CONTAINING_RECORD(Item, PROCESSDB_PROCESS_RECORD, HashItem); 27 | 28 | return (rec->ProcessId == Key); 29 | } 30 | 31 | static VOID _FreeFunction(PHASH_ITEM Item, PVOID FreeContext) 32 | { 33 | PPROCESSDB_PROCESS_RECORD rec = CONTAINING_RECORD(Item, PROCESSDB_PROCESS_RECORD, HashItem); 34 | DEBUG_ENTER_FUNCTION("Item=0x%p; FreeContext=0x%p", Item, FreeContext); 35 | 36 | ProcessDBRecordDereference(rec); 37 | 38 | DEBUG_EXIT_FUNCTION_VOID(); 39 | return; 40 | } 41 | 42 | static VOID _ProcessNotifyEx(_Inout_ PEPROCESS Process, _In_ HANDLE ProcessId, _In_opt_ PPS_CREATE_NOTIFY_INFO CreateInfo) 43 | { 44 | PPROCESSDB_PROCESS_RECORD rec = NULL; 45 | NTSTATUS status = STATUS_UNSUCCESSFUL; 46 | DEBUG_ENTER_FUNCTION("Process=0x%p; ProcessId=0x%p; CreateInfo=0x%p", Process, ProcessId, CreateInfo); 47 | 48 | if (CreateInfo != NULL) { 49 | USHORT imageFileNameLen = (CreateInfo->ImageFileName != NULL) ? CreateInfo->ImageFileName->Length : 0; 50 | 51 | rec = (PPROCESSDB_PROCESS_RECORD)HeapMemoryAllocPaged(sizeof(PROCESSDB_PROCESS_RECORD) + imageFileNameLen); 52 | if (rec != NULL) { 53 | rec->ReferenceCount = 1; 54 | rec->ProcessId = ProcessId; 55 | rec->ParentId = CreateInfo->ParentProcessId; 56 | memset(&rec->ImageFileName, 0, sizeof(UNICODE_STRING)); 57 | if (imageFileNameLen > 0) { 58 | rec->ImageFileName.Buffer = (PWCH)(rec + 1); 59 | rec->ImageFileName.Length = CreateInfo->ImageFileName->Length; 60 | rec->ImageFileName.MaximumLength = rec->ImageFileName.Length; 61 | memcpy(rec->ImageFileName.Buffer, CreateInfo->ImageFileName->Buffer, rec->ImageFileName.Length); 62 | } 63 | 64 | KeEnterCriticalRegion(); 65 | ExAcquireResourceExclusiveLite(&_processTableLock, TRUE); 66 | HashTableInsert(_processTable, &rec->HashItem, ProcessId); 67 | ExReleaseResourceLite(&_processTableLock); 68 | KeLeaveCriticalRegion(); 69 | status = STATUS_SUCCESS; 70 | } else status = STATUS_INSUFFICIENT_RESOURCES; 71 | } else { 72 | PHASH_ITEM h = NULL; 73 | 74 | KeEnterCriticalRegion(); 75 | ExAcquireResourceExclusiveLite(&_processTableLock, TRUE); 76 | h = HashTableDelete(_processTable, ProcessId); 77 | ExReleaseResourceLite(&_processTableLock); 78 | KeLeaveCriticalRegion(); 79 | if (h != NULL) { 80 | rec = CONTAINING_RECORD(h, PROCESSDB_PROCESS_RECORD, HashItem); 81 | ProcessDBRecordDereference(rec); 82 | } 83 | } 84 | 85 | DEBUG_EXIT_FUNCTION_VOID(); 86 | return; 87 | } 88 | 89 | /************************************************************************/ 90 | /* PUBLIC FUNCTIONS */ 91 | /************************************************************************/ 92 | 93 | NTSTATUS ProcessDBRecordGet(_In_ HANDLE ProcessId, _Out_ PPROCESSDB_PROCESS_RECORD *Record) 94 | { 95 | PHASH_ITEM h = NULL; 96 | NTSTATUS status = STATUS_UNSUCCESSFUL; 97 | PPROCESSDB_PROCESS_RECORD tmpRecord = NULL; 98 | DEBUG_ENTER_FUNCTION("ProcessId=0x%p; Record=0x%p", ProcessId, Record); 99 | 100 | KeEnterCriticalRegion(); 101 | ExAcquireResourceSharedLite(&_processTableLock, TRUE); 102 | h = HashTableGet(_processTable, ProcessId); 103 | if (h != NULL) { 104 | tmpRecord = CONTAINING_RECORD(h, PROCESSDB_PROCESS_RECORD, HashItem); 105 | InterlockedIncrement(&tmpRecord->ReferenceCount); 106 | *Record = tmpRecord; 107 | status = STATUS_SUCCESS; 108 | } else status = STATUS_NOT_FOUND; 109 | 110 | ExReleaseResourceLite(&_processTableLock); 111 | KeLeaveCriticalRegion(); 112 | 113 | DEBUG_EXIT_FUNCTION("0x%x, *Record=0x%p", status, *Record); 114 | return status; 115 | } 116 | 117 | VOID ProcessDBRecordDereference(_Inout_ PPROCESSDB_PROCESS_RECORD Record) 118 | { 119 | DEBUG_ENTER_FUNCTION("Record=0x%p", Record); 120 | 121 | if (InterlockedDecrement(&Record->ReferenceCount) == 0) 122 | HeapMemoryFree(Record); 123 | 124 | DEBUG_EXIT_FUNCTION_VOID(); 125 | return; 126 | } 127 | 128 | 129 | /************************************************************************/ 130 | /* INITIALIZATION AND FINALIZATION */ 131 | /************************************************************************/ 132 | 133 | NTSTATUS ProcessDBModuleInit(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) 134 | { 135 | NTSTATUS status = STATUS_UNSUCCESSFUL; 136 | DEBUG_ENTER_FUNCTION("DriverObject=0x%p; RegistryPath=\"%wZ\"", DriverObject, RegistryPath); 137 | 138 | status = ExInitializeResourceLite(&_processTableLock); 139 | if (NT_SUCCESS(status)) { 140 | status = HashTableCreate(httNoSynchronization, 37, _HashFunction, _CompareFunction, _FreeFunction, &_processTable); 141 | if (NT_SUCCESS(status)) { 142 | status = PsSetCreateProcessNotifyRoutineEx(_ProcessNotifyEx, FALSE); 143 | if (!NT_SUCCESS(status)) 144 | HashTableDestroy(_processTable); 145 | } 146 | 147 | if (!NT_SUCCESS(status)) 148 | ExDeleteResourceLite(&_processTableLock); 149 | } 150 | 151 | DEBUG_EXIT_FUNCTION("0x%x", status); 152 | return status; 153 | } 154 | 155 | 156 | VOID ProcessDBModuleFinit(_In_ PDRIVER_OBJECT DriverObject) 157 | { 158 | DEBUG_ENTER_FUNCTION("DriverObject=0x%p", DriverObject); 159 | 160 | PsSetCreateProcessNotifyRoutineEx(_ProcessNotifyEx, TRUE); 161 | HashTableDestroy(_processTable); 162 | ExDeleteResourceLite(&_processTableLock); 163 | 164 | DEBUG_EXIT_FUNCTION_VOID(); 165 | return; 166 | } 167 | -------------------------------------------------------------------------------- /reghider/process-db.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __PROCESS_DB_H__ 3 | #define __PROCESS_DB_H__ 4 | 5 | #include 6 | #include "hash_table.h" 7 | 8 | 9 | typedef struct _PROCESSDB_PROCESS_RECORD { 10 | HASH_ITEM HashItem; 11 | volatile LONG ReferenceCount; 12 | HANDLE ProcessId; 13 | HANDLE ParentId; 14 | UNICODE_STRING ImageFileName; 15 | } PROCESSDB_PROCESS_RECORD, *PPROCESSDB_PROCESS_RECORD; 16 | 17 | 18 | 19 | NTSTATUS ProcessDBRecordGet(_In_ HANDLE ProcessId, _Out_ PPROCESSDB_PROCESS_RECORD *Record); 20 | VOID ProcessDBRecordDereference(_Inout_ PPROCESSDB_PROCESS_RECORD Record); 21 | 22 | NTSTATUS ProcessDBModuleInit(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath); 23 | VOID ProcessDBModuleFinit(_In_ PDRIVER_OBJECT DriverObject); 24 | 25 | 26 | 27 | #endif 28 | -------------------------------------------------------------------------------- /reghider/reghider.c: -------------------------------------------------------------------------------- 1 | 2 | #include 3 | #include "allocator.h" 4 | #include "preprocessor.h" 5 | #include "reghider-ioctl.h" 6 | #include "key-record.h" 7 | #include "process-db.h" 8 | #include "registry-callback.h" 9 | #include "um-services.h" 10 | #include "reghider.h" 11 | 12 | 13 | 14 | /************************************************************************/ 15 | /* GLOBAL VARIABLES */ 16 | /************************************************************************/ 17 | 18 | static PDEVICE_OBJECT _controlDeviceObject = NULL; 19 | 20 | /************************************************************************/ 21 | /* HELPER FUNCTIONS */ 22 | /************************************************************************/ 23 | 24 | _IRQL_requires_(PASSIVE_LEVEL) 25 | static NTSTATUS _DriverInit(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) 26 | { 27 | UNICODE_STRING uDeviceName; 28 | UNICODE_STRING uSymbolicLinkName; 29 | NTSTATUS status = STATUS_UNSUCCESSFUL; 30 | DEBUG_ENTER_FUNCTION("DriverObject=0x%p; RegistryPath=\"%wZ\"", DriverObject, RegistryPath); 31 | 32 | RtlInitUnicodeString(&uDeviceName, REGHIDER_CONTROL_DEVICE_NAME); 33 | status = IoCreateDevice(DriverObject, 0, &uDeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &_controlDeviceObject); 34 | if (NT_SUCCESS(status)) { 35 | RtlInitUnicodeString(&uSymbolicLinkName, REGHIDER_SYMBOLIC_LINK_NAME); 36 | status = IoCreateSymbolicLink(&uSymbolicLinkName, &uDeviceName); 37 | if (NT_SUCCESS(status)) { 38 | DriverObject->DriverUnload = DriverUnload; 39 | DriverObject->MajorFunction[IRP_MJ_CREATE] = DriverDispatch; 40 | DriverObject->MajorFunction[IRP_MJ_CLOSE] = DriverDispatch; 41 | DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DriverDispatch; 42 | } 43 | 44 | if (!NT_SUCCESS(status)) { 45 | IoDeleteDevice(_controlDeviceObject); 46 | _controlDeviceObject = NULL; 47 | } 48 | } 49 | 50 | DEBUG_EXIT_FUNCTION("0x%x", status); 51 | return status; 52 | } 53 | 54 | static VOID _DriverFinit(_In_ PDRIVER_OBJECT DriverObject) 55 | { 56 | UNICODE_STRING uSymbolicLinkName; 57 | DEBUG_ENTER_FUNCTION("DriverObject=0x%p", DriverObject); 58 | 59 | RtlInitUnicodeString(&uSymbolicLinkName, REGHIDER_SYMBOLIC_LINK_NAME); 60 | IoDeleteSymbolicLink(&uSymbolicLinkName); 61 | IoDeleteDevice(_controlDeviceObject); 62 | _controlDeviceObject = NULL; 63 | 64 | DEBUG_EXIT_FUNCTION_VOID(); 65 | return; 66 | } 67 | 68 | /************************************************************************/ 69 | /* PUBLIC FUNCTIONS */ 70 | /************************************************************************/ 71 | 72 | _Function_class_(DRIVER_DISPATCH) 73 | NTSTATUS DriverDispatch(_In_ PDEVICE_OBJECT DeviceObject, _In_ PIRP Irp) 74 | { 75 | PIO_STACK_LOCATION irpStack = NULL; 76 | NTSTATUS status = STATUS_UNSUCCESSFUL; 77 | DEBUG_ENTER_FUNCTION("DeviceObject=0x%p; Irp=0x%p", DeviceObject, Irp); 78 | 79 | irpStack = IoGetCurrentIrpStackLocation(Irp); 80 | switch (irpStack->MajorFunction) { 81 | case IRP_MJ_CREATE: 82 | case IRP_MJ_CLOSE: { 83 | status = STATUS_SUCCESS; 84 | if (irpStack->MajorFunction == IRP_MJ_CREATE) 85 | Irp->IoStatus.Information = FILE_OPENED; 86 | } break; 87 | case IRP_MJ_DEVICE_CONTROL: { 88 | ULONG controlCode = irpStack->Parameters.DeviceIoControl.IoControlCode; 89 | ULONG inputBufferLength = irpStack->Parameters.DeviceIoControl.InputBufferLength; 90 | ULONG outputBufferLength = irpStack->Parameters.DeviceIoControl.OutputBufferLength; 91 | PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer; 92 | PVOID outputBuffer = Irp->AssociatedIrp.SystemBuffer; 93 | 94 | switch (controlCode) { 95 | case IOCTL_REGHIDER_HIDDEN_KEY_ADD: 96 | status = UMHiddenKeyAdd((PIOCTL_REGHIDER_HIDDEN_KEY_ADD_INPUT)inputBuffer, inputBufferLength); 97 | break; 98 | case IOCTL_REGHIDER_HIDDEN_KEY_ENUM: 99 | outputBuffer = Irp->UserBuffer; 100 | status = UMHiddenKeyEnum((PIOCTL_REGHIDER_HIDDEN_KEY_ENUM_OUTPUT)outputBuffer, outputBufferLength); 101 | break; 102 | case IOCTL_REGHIDER_HIDDEN_KEY_DELETE: 103 | status = UMHiddenKeyDelete((PIOCTL_REGHIDER_HIDDEN_KEY_DELETE_INPUT)inputBuffer, inputBufferLength); 104 | break; 105 | case IOCTL_REGHIDER_PSEUDO_VALUE_ADD: 106 | status = UMPseudoValueAdd((PIOCTL_REGHIDER_PSEUDO_VALUE_ADD_INPUT)inputBuffer, inputBufferLength); 107 | break; 108 | case IOCTL_REGHIDER_PSEUDO_VALUE_ENUM: 109 | outputBuffer = Irp->UserBuffer; 110 | status = UMPseudoValueEnum((PIOCTL_REGHIDER_PSEUDO_VALUE_ENUM_OUTPUT)outputBuffer, outputBufferLength); 111 | break; 112 | case IOCTL_REGHIDER_PSEUDO_VALUE_DELETE: 113 | status = UMPseudoValueDelete((PIOCTL_REGHIDER_PSEUDO_VALUE_DELETE_INPUT)inputBuffer, inputBufferLength); 114 | break; 115 | case IOCTL_REGHIDER_PSUEDO_VALUE_SET: 116 | status = UMPseudoValueSet((PIOCTL_REGHIDER_PSUEDO_VALUE_SET_INPUT)inputBuffer, inputBufferLength); 117 | break; 118 | default: 119 | status = STATUS_INVALID_DEVICE_REQUEST; 120 | break; 121 | } 122 | } break; 123 | default: { 124 | status = STATUS_INVALID_DEVICE_REQUEST; 125 | } break; 126 | } 127 | 128 | Irp->IoStatus.Status = status; 129 | IoCompleteRequest(Irp, IO_NO_INCREMENT); 130 | 131 | DEBUG_EXIT_FUNCTION("0x%x", status); 132 | return status; 133 | } 134 | 135 | 136 | _Function_class_(DRIVER_UNLOAD) 137 | VOID DriverUnload(_In_ PDRIVER_OBJECT DriverObject) 138 | { 139 | DEBUG_ENTER_FUNCTION("DriverObject=0x%p", DriverObject); 140 | 141 | _DriverFinit(DriverObject); 142 | RegistryCallbackModuleFinit(DriverObject); 143 | ProcessDBModuleFinit(DriverObject); 144 | KeyRecordModuleFInit(DriverObject); 145 | DebugAllocatorModuleFinit(); 146 | 147 | DEBUG_EXIT_FUNCTION_VOID(); 148 | return; 149 | } 150 | 151 | NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) 152 | { 153 | NTSTATUS status = STATUS_UNSUCCESSFUL; 154 | DEBUG_ENTER_FUNCTION("DriverObject=0x%p; RegistryPath=\"%wZ\"", DriverObject, RegistryPath); 155 | 156 | status = DebugAllocatorModuleInit(); 157 | if (NT_SUCCESS(status)) { 158 | status = KeyRecordModuleInit(DriverObject, RegistryPath); 159 | if (NT_SUCCESS(status)) { 160 | status = ProcessDBModuleInit(DriverObject, RegistryPath); 161 | if (NT_SUCCESS(status)) { 162 | status = RegistryCallbackModuleInit(DriverObject, RegistryPath); 163 | if (NT_SUCCESS(status)) { 164 | status = _DriverInit(DriverObject, RegistryPath); 165 | if (!NT_SUCCESS(status)) 166 | RegistryCallbackModuleFinit(DriverObject); 167 | } 168 | 169 | if (!NT_SUCCESS(status)) 170 | ProcessDBModuleFinit(DriverObject); 171 | } 172 | 173 | if (!NT_SUCCESS(status)) 174 | KeyRecordModuleFInit(DriverObject); 175 | } 176 | 177 | if (!NT_SUCCESS(status)) 178 | DebugAllocatorModuleFinit(); 179 | } 180 | 181 | DEBUG_EXIT_FUNCTION("0x%x", status); 182 | return status; 183 | } 184 | -------------------------------------------------------------------------------- /reghider/reghider.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __REGHIDER_H__ 3 | #define __REGHIDER_H__ 4 | 5 | #include 6 | 7 | 8 | 9 | #define REGHIDER_CONTROL_DEVICE_NAME L"\\Device\\RegHider" 10 | #define REGHIDER_SYMBOLIC_LINK_NAME L"\\DosDevices\\RegHider" 11 | 12 | 13 | _Function_class_(DRIVER_UNLOAD) 14 | VOID DriverUnload(_In_ PDRIVER_OBJECT DriverObject); 15 | 16 | _Function_class_(DRIVER_DISPATCH) 17 | NTSTATUS DriverDispatch(_In_ PDEVICE_OBJECT DeviceObject, _In_ PIRP Irp); 18 | 19 | 20 | 21 | #endif 22 | -------------------------------------------------------------------------------- /reghider/reghider.v12.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/MartinDrab/Hackerfest2015/1a7ab4e917bec6c54c2e0257750315c3848f61e8/reghider/reghider.v12.suo -------------------------------------------------------------------------------- /reghider/reghider.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | {A83EA840-9FA1-45E8-B50A-C2B82735BFE7} 23 | {f2f62967-0815-4fd7-9b86-6eedcac766eb} 24 | v4.5 25 | 11.0 26 | Win8.1 Debug 27 | Win32 28 | reghider 29 | 30 | 31 | 32 | Windows7 33 | true 34 | WindowsKernelModeDriver8.1 35 | Driver 36 | WDM 37 | 38 | 39 | Windows7 40 | false 41 | WindowsKernelModeDriver8.1 42 | Driver 43 | WDM 44 | 45 | 46 | Windows7 47 | true 48 | WindowsKernelModeDriver8.1 49 | Driver 50 | WDM 51 | 52 | 53 | Windows7 54 | false 55 | WindowsKernelModeDriver8.1 56 | Driver 57 | WDM 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | DbgengKernelDebugger 85 | 86 | 87 | DbgengKernelDebugger 88 | 89 | 90 | DbgengKernelDebugger 91 | 92 | 93 | DbgengKernelDebugger 94 | 95 | 96 | 97 | $(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies) 98 | /INTEGRITYCHECK %(AdditionalOptions) 99 | 100 | 101 | ..\include;%(AdditionalIncludeDirectories) 102 | 103 | 104 | 105 | 106 | $(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies) 107 | /INTEGRITYCHECK %(AdditionalOptions) 108 | 109 | 110 | ..\include;%(AdditionalIncludeDirectories) 111 | 112 | 113 | 114 | 115 | $(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies) 116 | /INTEGRITYCHECK %(AdditionalOptions) 117 | 118 | 119 | ..\include;%(AdditionalIncludeDirectories) 120 | 121 | 122 | 123 | 124 | $(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies) 125 | /INTEGRITYCHECK %(AdditionalOptions) 126 | 127 | 128 | ..\include;%(AdditionalIncludeDirectories) 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | 137 | 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | -------------------------------------------------------------------------------- /reghider/reghider.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | Source Files 23 | 24 | 25 | Source Files 26 | 27 | 28 | Source Files 29 | 30 | 31 | Source Files 32 | 33 | 34 | Source Files 35 | 36 | 37 | Source Files 38 | 39 | 40 | Source Files 41 | 42 | 43 | Source Files 44 | 45 | 46 | 47 | 48 | Header Files 49 | 50 | 51 | Header Files 52 | 53 | 54 | Header Files 55 | 56 | 57 | Header Files 58 | 59 | 60 | Header Files 61 | 62 | 63 | Header Files 64 | 65 | 66 | Header Files 67 | 68 | 69 | Header Files 70 | 71 | 72 | Header Files 73 | 74 | 75 | Header Files 76 | 77 | 78 | Header Files 79 | 80 | 81 | Header Files 82 | 83 | 84 | Header Files 85 | 86 | 87 | -------------------------------------------------------------------------------- /reghider/registry-callback.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __REGISTRY_CALLBACK_H__ 3 | #define __REGISTRY_CALLBACK_H__ 4 | 5 | #include 6 | 7 | 8 | 9 | NTSTATUS RegistryCallbackModuleInit(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath); 10 | VOID RegistryCallbackModuleFinit(_In_ PDRIVER_OBJECT DriverObject); 11 | 12 | 13 | 14 | #endif 15 | -------------------------------------------------------------------------------- /reghider/string-hash-table.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __STRING_HASH_TABLE_H__ 3 | #define __STRING_HASH_TABLE_H__ 4 | 5 | #include 6 | #include "hash_table.h" 7 | 8 | 9 | typedef VOID (STRING_HASH_TABLE_ACTION_ROUTINE)(PWCHAR String, PVOID Data, PVOID Context); 10 | typedef BOOLEAN (STRING_HASH_TABLE_ACTION_WITH_FEEDBACK_ROUTINE)(PWCHAR String, PVOID Data, PVOID Context); 11 | 12 | 13 | typedef struct { 14 | STRING_HASH_TABLE_ACTION_ROUTINE *Routine; 15 | PVOID Context; 16 | } STRING_HASH_TABLE_ACTION_ROUTINE_CONTEXT, *PSTRING_HASH_TABLE_ACTION_ROUTINE_CONTEXT; 17 | 18 | typedef struct { 19 | STRING_HASH_TABLE_ACTION_WITH_FEEDBACK_ROUTINE *Routine; 20 | PVOID Context; 21 | } STRING_HASH_TABLE_ACTION_WITH_FEEDBACK_ROUTINE_CONTEXT, *PSTRING_HASH_TABLE_ACTION_WITH_FEEDBACK_ROUTINE_CONTEXT; 22 | 23 | typedef struct { 24 | HASH_ITEM Item; 25 | PVOID Data; 26 | ULONG StringLength; 27 | WCHAR String[1]; 28 | } STRING_HASH_ITEM, *PSTRING_HASH_ITEM; 29 | 30 | 31 | 32 | NTSTATUS StringHashTableCreate(EHashTableType Type, ULONG Size, PHASH_TABLE *Table); 33 | VOID StringHashTableDestroy(PHASH_TABLE Table); 34 | NTSTATUS StringHashTableInsert(PHASH_TABLE Table, PWCHAR String, PVOID Data); 35 | NTSTATUS stringHashTableInsertUnicodeString(PHASH_TABLE Table, PUNICODE_STRING String, PVOID Data); 36 | PVOID StringHashTableGet(PHASH_TABLE Table, PWCHAR String); 37 | PVOID StringHashTableGetUnicodeString(PHASH_TABLE Table, PUNICODE_STRING String); 38 | PVOID StringHashTableDelete(PHASH_TABLE Table, PWCHAR String); 39 | PVOID StringHashTableDeleteUnicodeString(PHASH_TABLE Table, PUNICODE_STRING String); 40 | VOID StringHashTablePerform(PHASH_TABLE Table, STRING_HASH_TABLE_ACTION_ROUTINE *Routine, PVOID Context); 41 | VOID StringHashTablePerformWithFeedback(PHASH_TABLE Table, STRING_HASH_TABLE_ACTION_WITH_FEEDBACK_ROUTINE *Routine, PVOID Context); 42 | ULONG StringHashTableGetItemCount(PHASH_TABLE Table); 43 | 44 | #define StringHashTableClear(aHashTable) \ 45 | HashTableClear(aHashTable, TRUE) 46 | 47 | 48 | 49 | #endif 50 | -------------------------------------------------------------------------------- /reghider/um-services.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __UM_SERVICES_H__ 3 | #define __UM_SERVICES_H__ 4 | 5 | #include 6 | #include "reghider-ioctl.h" 7 | 8 | 9 | 10 | NTSTATUS UMHiddenKeyAdd(_In_ PIOCTL_REGHIDER_HIDDEN_KEY_ADD_INPUT InputBuffer, _In_ ULONG InputBufferLength); 11 | NTSTATUS UMHiddenKeyEnum(_Out_ PIOCTL_REGHIDER_HIDDEN_KEY_ENUM_OUTPUT OutputBuffer, _In_ ULONG OutputBufferLength); 12 | NTSTATUS UMHiddenKeyDelete(_In_ PIOCTL_REGHIDER_HIDDEN_KEY_DELETE_INPUT InputBuffer, _In_ ULONG InputBufferLength); 13 | 14 | NTSTATUS UMPseudoValueAdd(_In_ PIOCTL_REGHIDER_PSEUDO_VALUE_ADD_INPUT InputBuffer, _In_ ULONG InputBufferLength); 15 | NTSTATUS UMPseudoValueEnum(_Out_ PIOCTL_REGHIDER_PSEUDO_VALUE_ENUM_OUTPUT OutputBuffer, _In_ ULONG OutputBufferLength); 16 | NTSTATUS UMPseudoValueDelete(_In_ PIOCTL_REGHIDER_PSEUDO_VALUE_DELETE_INPUT InputBuffer, _In_ ULONG InputBufferLength); 17 | NTSTATUS UMPseudoValueSet(_In_ PIOCTL_REGHIDER_PSUEDO_VALUE_SET_INPUT InputBuffer, _In_ ULONG InputBufferLength); 18 | 19 | 20 | 21 | 22 | #endif 23 | -------------------------------------------------------------------------------- /reghider/utils-dym-array-types.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __UTILS_DYMARRAY_TYPES_H_ 3 | #define __UTILS_DYMARRAY_TYPES_H_ 4 | 5 | #include 6 | 7 | 8 | #define DYM_ARRAY_INITIAL_ALLOC_LENGTH 16 9 | #define DYM_ARRAY_INCREASE_PER_CENTS 20 10 | 11 | typedef struct { 12 | POOL_TYPE PoolType; 13 | SIZE_T ValidLength; 14 | SIZE_T AllocatedLength; 15 | PERESOURCE LockPaged; 16 | PKSPIN_LOCK LockNonPaged; 17 | PVOID *Data; 18 | } UTILS_DYM_ARRAY, *PUTILS_DYM_ARRAY; 19 | 20 | 21 | #endif 22 | -------------------------------------------------------------------------------- /reghider/utils-dym-array.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __UTILS_DYM_ARRAY_H_ 3 | #define __UTILS_DYM_ARRAY_H_ 4 | 5 | #include 6 | #include "utils-dym-array-types.h" 7 | 8 | 9 | 10 | NTSTATUS DymArrayCreate(POOL_TYPE PoolType, PUTILS_DYM_ARRAY *Array); 11 | VOID DymArrayDestroy(PUTILS_DYM_ARRAY Array); 12 | NTSTATUS DymArrayReserve(PUTILS_DYM_ARRAY Array, SIZE_T Length); 13 | NTSTATUS DymArrayPushBack(PUTILS_DYM_ARRAY Array, PVOID Value); 14 | PVOID DymArrayPopBack(PUTILS_DYM_ARRAY Array); 15 | NTSTATUS DymArrayPushFront(PUTILS_DYM_ARRAY Array, PVOID Value); 16 | PVOID DymArrayPopFront(PUTILS_DYM_ARRAY Array); 17 | SIZE_T DymArrayLength(PUTILS_DYM_ARRAY Array); 18 | SIZE_T DymArrayAllocatedLength(PUTILS_DYM_ARRAY Array); 19 | PVOID DymArrayItem(PUTILS_DYM_ARRAY Array, SIZE_T Index); 20 | VOID DymArrayLock(PUTILS_DYM_ARRAY Array, PKIRQL Irql); 21 | VOID DymArrayUnlock(PUTILS_DYM_ARRAY Array, KIRQL Irql); 22 | VOID DymArrayToStaticArray(PUTILS_DYM_ARRAY Array, PVOID StaticArray); 23 | NTSTATUS DymArrayToStaticArrayAlloc(PUTILS_DYM_ARRAY Array, POOL_TYPE PoolType, PVOID **StaticArray); 24 | VOID DymArrayPushBackNoAlloc(PUTILS_DYM_ARRAY Array, PVOID Value); 25 | VOID DymArrayClear(PUTILS_DYM_ARRAY Array); 26 | VOID DymArrayPushArrayNoAlloc(PUTILS_DYM_ARRAY DymArray, PVOID *Array, ULONG Count); 27 | NTSTATUS DymArrayPushArray(PUTILS_DYM_ARRAY DymArray, PVOID *Array, ULONG Count); 28 | NTSTATUS DymArrayInsert(PUTILS_DYM_ARRAY DymArray, SIZE_T Index, PVOID Value); 29 | VOID DymArrayInsertNoAlloc(PUTILS_DYM_ARRAY DymArray, SIZE_T Index, PVOID Value); 30 | PVOID DymArrayRemove(PUTILS_DYM_ARRAY DymArray, SIZE_T Index); 31 | 32 | 33 | #endif 34 | --------------------------------------------------------------------------------