craw/hide.hpp

   1 #pragma once
   2
   3 #include <windows.h>
   4
   5 struct hidden_module
   6 {
   7         unsigned
   8                 start_address,
   9                 size;
  10
  11         hidden_module();
  12         hidden_module(void * address, std::size_t size);
  13
  14         bool operator==(void const * address) const;
  15 };
  16
  17 //by Darawk
  18
  19 struct UNICODE_STRING
  20 {
  21         USHORT Length;
  22         USHORT MaximumLength;
  23         PWSTR Buffer;
  24 };
  25
  26 struct MODULE_INFO_NODE
  27 {
  28         LIST_ENTRY LoadOrder;
  29         LIST_ENTRY InitOrder;
  30         LIST_ENTRY MemoryOrder;
  31         HMODULE baseAddress;
  32         unsigned long entryPoint;
  33         unsigned int size;
  34         UNICODE_STRING fullPath;
  35         UNICODE_STRING name;
  36         unsigned long flags;
  37         unsigned short LoadCount;
  38         unsigned short TlsIndex;
  39         LIST_ENTRY HashTable;
  40         unsigned long timestamp;
  41 };
  42
  43 struct PROCESS_MODULE_INFO
  44 {
  45         unsigned int size;
  46         unsigned int initialized;
  47         HANDLE SsHandle;
  48         LIST_ENTRY LoadOrder;
  49         LIST_ENTRY InitOrder;
  50         LIST_ENTRY MemoryOrder;
  51 };
  52
  53 bool hide_module(void * module_base);
  54 bool hide_modules();
  55 bool is_hidden_module(void const * address);