home *** CD-ROM | disk | FTP | other *** search
/ Cracking 2 / Cracking II..iso / Tools / ApiHooks 2.2 / examples / ASM / Invisible / InvisibleDLL.bat < prev   
Encoding:
DOS Batch File  |  2000-04-10  |  6.6 KB  |  210 lines
  1. ;@goto translate
  2.  
  3.  
  4. .586P
  5.  
  6. .MODEL        FLAT, STDCALL
  7.  
  8.    OPTION     CASEMAP: NONE
  9.  
  10.    INCLUDE    WINDOWS.inc
  11.    UNICODE    = FALSE
  12.    INCLUDE    APIMACRO.mac
  13.  
  14.    INCLUDELIB iKERNEL32.lib
  15.    INCLUDELIB iUSER32.lib
  16.    INCLUDELIB iNTDLL.lib
  17.    INCLUDELIB iApiHooks.lib
  18.  
  19.    INCLUDE    ApiHooks.inc
  20.  
  21.   OPTION      NOKEYWORD: <LENGTH>
  22.  
  23. .DATA?
  24.    PROCESS_BASIC_INFORMATION  STRUCT
  25.     ExitStatus        DWORD ? 
  26.     PebBaseAddress    DWORD ?
  27.     AffinityMask      DWORD ?
  28.     BasePriority      DWORD ?
  29.     UniqueProcessId   DWORD ?
  30.     InheritedFromUniqueProcessId DWORD ?
  31.    PROCESS_BASIC_INFORMATION  ENDS
  32.  
  33.     ProcessBasicInformation = 0
  34.    SystemProcessInformation = 5
  35.  
  36.    OrigEnumWinProc  DWORD ?
  37.    pbi        PROCESS_BASIC_INFORMATION <>
  38.    pbi2       PROCESS_BASIC_INFORMATION <>
  39.  
  40.    PathHooks  SIGN  MAX_PATH DUP (?)
  41.  
  42. .CODE
  43.    BeginHooks Entry
  44.    MkHook    , NTDLL, NtCreateThread,      HOOK_BY_ADDRESS, KERNEL32
  45.    MkHook    , NTDLL, CsrClientCallServer, HOOK_BY_ADDRESS, KERNEL32
  46.    MkHook    , NTDLL, NtQuerySystemInformation
  47.    MkHook    ,USER32, EnumWindows
  48.    MkHook    ,USER32, GetWindow
  49.    EndHooks
  50.  
  51.    TEXTA      NTDLL,                    <NTDLL.dll/0>
  52.    TEXTA      KERNEL32,                 <KERNEL32.dll/0>
  53.    TEXTA      USER32,                   <USER32.dll/0>
  54.    TEXTA      NtCreateThread,           <NtCreateThread/0>
  55.    TEXTA      CsrClientCallServer,      <CsrClientCallServer/0>
  56.    TEXTA      NtQuerySystemInformation, <NtQuerySystemInformation/0>
  57.    TEXTA      EnumWindows,              <EnumWindows/0>
  58.    TEXTA      GetWindow,                <GetWindow/0>
  59.  
  60.    TEXTW      Proc2Hide,                <Calc.exe/0>
  61.    TEXT       Wind2Hide,                <SciCalc/0>
  62. ;--------------------------------------------------------------------------------
  63.   DllMain:
  64.    CMP        DWORD PTR [ESP+8], DLL_PROCESS_ATTACH
  65.    JNE        @F
  66.    iWin32i    GetModuleFileName, [ESP+12], OFFSET PathHooks, MAX_PATH
  67.   @@:
  68.    PUSH       TRUE
  69.    POP        EAX
  70.    RETN       12    
  71. ;--------------------------------------------------------------------------------
  72.   NewNtCreateThread PROC lpThreadHandle, DesiredAccess, lpObjectAttributes,\
  73.                          ProcessHandle, lpClientId, lpInitialContext,\
  74.                          lpUserStackDescriptor, CreateSuspended
  75.     AND       pbi2.UniqueProcessId, 0 
  76.     iWin32    NtQueryInformationProcess, ProcessHandle, ProcessBasicInformation,\
  77.                          OFFSET pbi, SIZEOF pbi, NULL
  78.     PUSH      EAX
  79.     iWin32    NtCreateThread, lpThreadHandle, DesiredAccess, lpObjectAttributes,\
  80.                          ProcessHandle, lpClientId, lpInitialContext,\
  81.                          lpUserStackDescriptor, CreateSuspended
  82.     POP       ECX
  83.     PUSH      EAX         
  84.     TEST      ECX, ECX
  85.     JL        @F
  86.     TEST      EAX, EAX
  87.     JL        @F
  88.     CMP       CreateSuspended, FALSE
  89.     JE        @F
  90.     CMP       pbi.UniqueProcessId, 0 ;new process hasn't ID before 1st thread creation
  91.     JNE       @F  
  92.     iWin32    NtQueryInformationProcess, ProcessHandle, ProcessBasicInformation,\
  93.                          OFFSET pbi2, SIZEOF pbi2, NULL
  94.    @@:
  95.     POP       EAX
  96.     RET
  97.   NewNtCreateThread ENDP
  98. ;--------------------------------------------------------------------------------
  99.   NewCsrClientCallServer  PROC  lpStruc, Par1, dwCommand, StrucSize
  100.    iWin32     CsrClientCallServer, lpStruc, Par1, dwCommand, StrucSize
  101.    CMP        dwCommand, 10000H
  102.    JNE        @F
  103.    MOV        EDX, lpStruc  
  104.    CMP        DWORD PTR [EDX+20H], 0
  105.    JL         @F
  106.    MOV        ECX, pbi2.UniqueProcessId
  107.    JECXZ      @F
  108.    PUSH       EAX
  109.    iWin32i    EstablishApiHooksTime, OFFSET PathHooks, ECX, 10000 
  110.    POP        EAX    
  111.   @@:
  112.    RET 
  113.   NewCsrClientCallServer ENDP
  114. ;--------------------------------------------------------------------------------
  115.   NewNtQuerySystemInformation PROC USES EBX ESI, SystemInformationClass, SystemInformation,\
  116.                                    Length, ResultLength
  117.    iWin32     NtQuerySystemInformation, SystemInformationClass, SystemInformation,\
  118.                                    Length, ResultLength
  119.    TEST       EAX, EAX
  120.    JL         Fin
  121.    CMP        SystemInformationClass, SystemProcessInformation
  122.    JNE        Fin
  123.    MOV        ESI, SystemInformation
  124.   @@:
  125.    MOV        EBX, ESI        ;prev proc
  126.    CMP        DWORD PTR [ESI], 0
  127.    JE         Fin
  128.    ADD        ESI, [ESI]
  129.    MOV        ECX, [ESI+3CH]
  130.    JECXZ      @B
  131.    PUSH       EAX
  132.    iWin32     lstrcmpiW, ECX, sProc2Hide
  133.    TEST       EAX, EAX
  134.    POP        EAX 
  135.    JNE        @B
  136.    MOV        EDX, [ESI]
  137.    TEST       EDX, EDX
  138.    JE         FillZero
  139.    ADD        [EBX], EDX                 
  140.    JMP        @B             ;all with my name
  141.   FillZero:
  142.    AND        [EBX], EDX 
  143.    JMP        @B             ;all with my name
  144.   Fin:
  145.    RET
  146.   NewNtQuerySystemInformation ENDP
  147. ;--------------------------------------------------------------------------------
  148.   NewEnumWindows PROC lpEnumFunc, lParam
  149.    CMP        OrigEnumWinProc, NULL
  150.    JE         @F
  151.    iWin32     EnumWindows, lpEnumFunc, lParam
  152.    RET
  153.   @@:
  154.    PUSH       lpEnumFunc 
  155.    POP        OrigEnumWinProc
  156.    iWin32     EnumWindows, NewEnumProc, lParam
  157.    AND        OrigEnumWinProc, NULL
  158.    RET
  159.   NewEnumWindows ENDP
  160.  
  161.   NewEnumProc PROC USES ESI, hwnd, lParam
  162.    iWin32i    FindWindow, sWind2Hide, NULL
  163.    TEST       EAX, EAX
  164.    JE         OrigEnumP
  165.    CMP        EAX, hwnd
  166.    PUSH       TRUE
  167.    POP        EAX
  168.    JE         @F
  169.   OrigEnumP:
  170.    sWin32     OrigEnumWinProc, hwnd, lParam
  171.   @@:
  172.    RET
  173.   NewEnumProc ENDP
  174. ;--------------------------------------------------------------------------------
  175.   NewGetWindow PROC  USES EBX, hWnd, uCmd
  176.    iWin32i    FindWindow, sWind2Hide, NULL
  177.    TEST       EAX, EAX
  178.    JE         NotMe
  179.    MOV        EBX, EAX
  180.    CMP        EAX, hWnd
  181.    JNE        NotMe
  182.    CMP        uCmd, GW_CHILD
  183.    JNE        @F
  184.    SUB        EAX, EAX
  185.    RET
  186.   @@:
  187.    iWin32     GetWindow, EAX, uCmd
  188.   Next:
  189.    MOV        hWnd, EAX
  190.   NotMe:
  191.    iWin32     GetWindow, hWnd, uCmd
  192.    TEST       EAX, EAX
  193.    JE         Fin
  194.    CMP        EAX, EBX
  195.    JE         Next
  196.   Fin: 
  197.    RET
  198.   NewGetWindow ENDP
  199. ;--------------------------------------------------------------------------------
  200. END DllMain
  201.  
  202. :translate
  203. @echo off
  204. ML   /c /coff /nologo InvisibleDLL.bat
  205. eLINK InvisibleDLL /out:Invisible.dll /dll /nologo /optidata /section:.text,EWR /export:Entry,@1,NONAME /base:0x47280000 /SUBSYSTEM:WINDOWS /MERGE:.rdata=.text /IGNORE:4078,4086
  206. DEL  InvisibleDLL.obj
  207. DEL  Invisible.lib
  208. DEL  Invisible.exp
  209. PAUSE
  210. CLS