Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- inline bool HideThread(HANDLE hThread)
- {
- typedef NTSTATUS (NTAPI *pNtSetInformationThread)
- (HANDLE, UINT, PVOID, ULONG);
- NTSTATUS Status;
- // Get NtSetInformationThread
- pNtSetInformationThread NtSIT = (pNtSetInformationThread)
- GetProcAddress(GetModuleHandle( TEXT("ntdll.dll") ),
- "NtSetInformationThread");
- // Shouldn't fail
- if (NtSIT == NULL)
- return false;
- // Set the thread info
- if (hThread == NULL)
- Status = NtSIT(GetCurrentThread(),
- 0x11, // HideThreadFromDebugger
- 0, 0);
- else
- Status = NtSIT(hThread, 0x11, 0, 0);
- if (Status != 0x00000000)
- return false;
- else
- return true;
- }
- void WINAPI MainThread( ){
- _Main() ;
- }
- BOOL WINAPI DllMain ( HMODULE hModule, DWORD dwReason, LPVOID lpvReserved ){
- switch ( dwReason ) {
- case DLL_PROCESS_ATTACH: {
- DisableThreadLibraryCalls(hModule);
- HANDLE denegelthr = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&MainThread, NULL, 0, NULL);
- HideThread(denegelthr);
- HideThread(GetCurrentThread());
- if ( denegelthr == NULL ) {
- return true;
- }
- }
- break;
- case DLL_PROCESS_DETACH:
- ::ExitProcess(0);
- break;
- case DLL_THREAD_ATTACH:
- break;
- case DLL_THREAD_DETACH:
- ::ExitProcess(0);
- break;
- }
- return TRUE;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement