BC NtQuerySystemInformation

bool Detour_NtQuerySystemInformation()
{
    static NtQuerySystemInformation _NtQuerySystemInformation = reinterpret_cast<NtQuerySystemInformation>(GetProcAddress(NTDLL, "NtQuerySystemInformation"));

    NtQuerySystemInformation NtQuerySystemInformation_Hook = [](
        _In_      SYSTEM_INFORMATION_CLASS SystemInformationClass,
        _Inout_   PVOID                    SystemInformation,
        _In_      ULONG                    SystemInformationLength,
        _Out_opt_ PULONG                   ReturnLength
        ) -> NTSTATUS
    {
        NTSTATUS ntStatus = _NtQuerySystemInformation(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);

        if (SystemInformationClass == SystemProcessInformation)
        {
            PSYSTEM_PROCESS_INFORMATION pSystemProcess;
            PSYSTEM_PROCESS_INFORMATION pNextSystemProcess;

            pSystemProcess = reinterpret_cast<PSYSTEM_PROCESS_INFORMATION>(reinterpret_cast<PBYTE*>(SystemInformation));
            pNextSystemProcess = reinterpret_cast<PSYSTEM_PROCESS_INFORMATION>(reinterpret_cast<LPBYTE>(pSystemProcess)+pSystemProcess->NextEntryDelta);

            while (pNextSystemProcess->NextEntryDelta != 0)
            {
                if (lstrcmp((&pNextSystemProcess->ProcessName)->Buffer, L"MapleStory.exe") != 0 &&
                    lstrcmp((&pNextSystemProcess->ProcessName)->Buffer, L"BlackCipher.aes") != 0)
                {
                    printf(L"Process name:[%s]\n", pNextSystemProcess->ProcessName.Buffer);

                    pSystemProcess->NextEntryDelta += pNextSystemProcess->NextEntryDelta;
                }

                pSystemProcess = pNextSystemProcess;
                pNextSystemProcess = reinterpret_cast<PSYSTEM_PROCESS_INFORMATION>(reinterpret_cast<LPBYTE>(pSystemProcess)+pSystemProcess->NextEntryDelta);
            }
        }
        else if (SystemInformationClass == SystemModuleInformation)
        {
            SYSTEM_MODULE_INFORMATION *pModuleInfo = reinterpret_cast<SYSTEM_MODULE_INFORMATION*>(reinterpret_cast<PBYTE*>(SystemInformation));

            CHAR szDriver[MAX_PATH];

            for (unsigned int i = 0; i < pModuleInfo->NumberOfModules; i++)
            {
                StringCchPrintfA(szDriver, MAX_PATH, "%s", pModuleInfo->Modules[i].FullPathName);

                printf("driver:[%d] name:[%s]\n", i, szDriver);
            }
        }
        else if (SystemInformationClass == SystemHandleInformation)
        {
            SYSTEM_HANDLE_INFORMATION *pHandleInfo = reinterpret_cast<SYSTEM_HANDLE_INFORMATION*>(reinterpret_cast<PBYTE*>(SystemInformation));

            for (unsigned int i = 0; i < pHandleInfo->NumberOfHandles; i++)
            {
                if (pHandleInfo->Information[i].ObjectTypeNumber != 0) //HANDLE_TYPE_PROCESS
                {
                    DWORD dwProcessId = pHandleInfo->Information[i].ProcessId;
                    if (isCSRSS(dwProcessId))
                    {
                        HANDLE hProcess = OpenProcess(PROCESS_DUP_HANDLE, FALSE, dwProcessId);
                        if (hProcess != NULL)
                        {
                            HANDLE hTarget = NULL;
                            if (DuplicateHandle(hProcess, (HANDLE)pHandleInfo->Information[i].Handle, GetCurrentProcess(), &hTarget, PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, 0))
                            {
                                DWORD dwTargetId = GetProcessId(hTarget);

                                if (dwTargetId != (DWORD)-1)
                                    dwTargetId = GetCurrentProcessId();

                                CloseHandle(hTarget);
                            }
                            CloseHandle(hProcess);
                        }
                    }
                }
            }
        }

        return ntStatus;
    };

    return DetourFunction(true, reinterpret_cast<void**>(&_NtQuerySystemInformation), NtQuerySystemInformation_Hook);
}