Skip to content

Commit 11d9ebc

Browse files
Air14Air14
committed
Added support for Windows 11 and Windows 21H2 and fixed some minor bugs
1 parent 9d05dc2 commit 11d9ebc

File tree

8 files changed

+73
-23
lines changed

8 files changed

+73
-23
lines changed

‎HyperHide/HyperHideDrv.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ typedef struct _HIDE_INFO
3131
BOOLEAN HookNtUserQueryWindow;
3232
BOOLEAN HookNtUserGetForegroundWindow;
3333
BOOLEAN HookKuserSharedData;
34-
BOOLEAN HookKiExceptionDispatch;
34+
BOOLEAN HookKiDispatchException;
3535
BOOLEAN HookNtSetInformationProcess;
3636
BOOLEAN ClearPebBeingDebugged;
3737
BOOLEAN ClearPebNtGlobalFlag;

‎HyperHideDrv/GlobalData.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@
1818
#define WINDOWS_10_VERSION_20H1 19041
1919
#define WINDOWS_10_VERSION_20H2 19042
2020
#define WINDOWS_10_VERSION_21H1 19043
21+
#define WINDOWS_10_VERSION_21H2 19044
22+
#define WINDOWS_11 22000
23+
2124

2225
typedef struct _HYPER_HIDE_GLOBAL_DATA
2326
{

‎HyperHideDrv/Hider.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ typedef struct _HIDE_INFO
6363
BOOLEAN HookNtUserQueryWindow;
6464
BOOLEAN HookNtUserGetForegroundWindow;
6565
BOOLEAN HookKuserSharedData;
66+
BOOLEAN HookKiDispatchException;
6667
BOOLEAN HookNtSetInformationProcess;
6768
BOOLEAN ClearPebBeingDebugged;
6869
BOOLEAN ClearPebNtGlobalFlag;

‎HyperHideDrv/HookHelper.cpp‎

Lines changed: 52 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -147,31 +147,58 @@ BOOLEAN IsWindowBad(HANDLE hWnd)
147147

148148
BOOLEAN HookKiDispatchException(PVOID HookedKiDispatchException, PVOID* OriginalKiDispatchException)
149149
{
150-
PVOID KernelTextSectionBase = 0;
151-
ULONG64 KernelTextSectionSize = 0;
152-
CHAR* Pattern = "\x8B\x00\x50\x00\x8B\x00\x58\x48\x8D\x4D\x00\xE8\x00\x00\x00\xFF\x8B\x55";
153-
CHAR* Mask = "x?x?x?xxxx?x???xxx";
150+
PVOID KernelSectionBase = 0;
151+
ULONG64 KernelSectionSize = 0;
152+
CHAR* Pattern = g_HyperHide.CurrentWindowsBuildNumber >= WINDOWS_11 ? "\x24\x00\x00\x41\xB1\x01\x48\x8D\x4C\x24\x00\xE8" : "\x8B\x00\x50\x00\x8B\x00\x58\x48\x8D\x4D\x00\xE8\x00\x00\x00\xFF\x8B\x55";
153+
CHAR* Mask = g_HyperHide.CurrentWindowsBuildNumber >= WINDOWS_11 ? "x??xxxxxxx?x" : "x?x?x?xxxx?x???xxx";
154+
CHAR* Section = g_HyperHide.CurrentWindowsBuildNumber >= WINDOWS_11 ? "PAGE" : ".text";
154155

155-
if (GetSectionData("ntoskrnl.exe", ".text", KernelTextSectionSize, KernelTextSectionBase) == FALSE)
156+
if (GetSectionData("ntoskrnl.exe", Section, KernelSectionSize, KernelSectionBase) == FALSE)
156157
return FALSE;
157158

158-
PVOID KiExceptionDispatchAddress = FindSignature(KernelTextSectionBase, KernelTextSectionSize, Pattern, Mask);
159-
if ((ULONG64)KiExceptionDispatchAddress >= (ULONG64)KernelTextSectionBase && (ULONG64)KiExceptionDispatchAddress <= (ULONG64)KernelTextSectionBase + KernelTextSectionSize)
159+
PVOID KiDispatchExceptionAddress = FindSignature(KernelSectionBase, KernelSectionSize, Pattern, Mask);
160+
if ((ULONG64)KiDispatchExceptionAddress >= (ULONG64)KernelSectionBase && (ULONG64)KiDispatchExceptionAddress <= (ULONG64)KernelSectionBase + KernelSectionSize)
160161
{
161-
KiExceptionDispatchAddress = (PVOID)(*(LONG*)((ULONG64)KiExceptionDispatchAddress + 12) + (LONGLONG)((ULONG64)KiExceptionDispatchAddress + 16));
162+
KiDispatchExceptionAddress = (PVOID)(*(LONG*)((ULONG64)KiDispatchExceptionAddress + 12) + (LONGLONG)((ULONG64)KiDispatchExceptionAddress + 16));
162163

163-
LogInfo("KiExceptionDispatch address: 0x%llx", KiExceptionDispatchAddress);
164+
LogInfo("KiDispatchException address: 0x%llx", KiDispatchExceptionAddress);
164165

165-
if ((ULONG64)KiExceptionDispatchAddress >= (ULONG64)KernelTextSectionBase && (ULONG64)KiExceptionDispatchAddress <= (ULONG64)KernelTextSectionBase + KernelTextSectionSize)
166-
return hv::hook_function(KiExceptionDispatchAddress, HookedKiDispatchException, OriginalKiDispatchException);
166+
return hv::hook_function(KiDispatchExceptionAddress, HookedKiDispatchException, OriginalKiDispatchException);
167167
}
168168

169169
return FALSE;
170170
}
171171

172172
VOID GetNtSyscallNumbers(NT_SYSCALL_NUMBERS &SyscallNumbers)
173173
{
174-
if (g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_20H2 || g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_20H1 || g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_21H1)
174+
if (g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_11)
175+
{
176+
SyscallNumbers.NtSetInformationThread = 0xd;
177+
SyscallNumbers.NtQueryInformationProcess = 0x19;
178+
SyscallNumbers.NtQueryObject = 0x10;
179+
SyscallNumbers.NtSystemDebugControl = 0x1c8;
180+
SyscallNumbers.NtSetContextThread = 0x194;
181+
SyscallNumbers.NtQuerySystemInformation = 0x36;
182+
SyscallNumbers.NtGetContextThread = 0xf7;
183+
SyscallNumbers.NtClose = 0xf;
184+
SyscallNumbers.NtQueryInformationThread = 0x25;
185+
SyscallNumbers.NtCreateThreadEx = 0xC5;
186+
SyscallNumbers.NtCreateFile = 0x55;
187+
SyscallNumbers.NtCreateProcessEx = 0x4d;
188+
SyscallNumbers.NtYieldExecution = 0x46;
189+
SyscallNumbers.NtQuerySystemTime = 0x5a;
190+
SyscallNumbers.NtQueryPerformanceCounter = 0x31;
191+
SyscallNumbers.NtContinue = 0xa3;
192+
SyscallNumbers.NtQueryInformationJobObject = 0x150;
193+
SyscallNumbers.NtCreateUserProcess = 0xcd;
194+
SyscallNumbers.NtGetNextProcess = 0xfc;
195+
SyscallNumbers.NtOpenProcess = 0x26;
196+
SyscallNumbers.NtOpenThread = 0x134;
197+
SyscallNumbers.NtSetInformationProcess = 0x1c;
198+
}
199+
200+
else if (g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_20H2 || g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_20H1 ||
201+
g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_21H1 || g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_21H2)
175202
{
176203
SyscallNumbers.NtSetInformationThread = 0xd;
177204
SyscallNumbers.NtQueryInformationProcess = 0x19;
@@ -486,7 +513,19 @@ VOID GetNtSyscallNumbers(NT_SYSCALL_NUMBERS &SyscallNumbers)
486513

487514
VOID GetWin32kSyscallNumbers(WIN32K_SYSCALL_NUMBERS& SyscallNumbers)
488515
{
489-
if (g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_20H2 || g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_20H1 || g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_21H1)
516+
if (g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_11)
517+
{
518+
SyscallNumbers.NtUserFindWindowEx = 0x67;
519+
SyscallNumbers.NtUserBuildHwndList = 0x1a;
520+
SyscallNumbers.NtUserQueryWindow = 0xe;
521+
SyscallNumbers.NtUserGetForegroundWindow = 0x37;
522+
SyscallNumbers.NtUserGetThreadState = 0x0;
523+
SyscallNumbers.NtUserInternalGetWindowText = 0x5D;
524+
SyscallNumbers.NtUserGetClassName = 0x74;
525+
}
526+
527+
if (g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_20H2 || g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_20H1 ||
528+
g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_21H1 || g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_21H2)
490529
{
491530
SyscallNumbers.NtUserFindWindowEx = 0x6c;
492531
SyscallNumbers.NtUserBuildHwndList = 0x1c;

‎HyperHideDrv/HookedFunctions.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1926,7 +1926,7 @@ BOOLEAN HookSyscalls()
19261926

19271927
if (HookKiDispatchException(HookedKiDispatchException, (PVOID*)&OriginalKiDispatchException) == FALSE)
19281928
{
1929-
LogError("KiExceptionDispatch hook failed");
1929+
LogError("KiDispatchException hook failed");
19301930
return FALSE;
19311931
}
19321932

‎HyperHideDrv/KuserSharedData.cpp‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,10 @@ BOOLEAN GetPfnDatabase()
1515
{
1616
ULONG64 TextSize;
1717
PVOID TextBase;
18-
ULONG64 AlmostroSize;
19-
PVOID AlmostroBase;
2018

2119
if (GetSectionData("ntoskrnl.exe", ".text", TextSize, TextBase) == FALSE)
2220
return FALSE;
2321

24-
if (GetSectionData("ntoskrnl.exe", "ALMOSTRO", AlmostroSize, AlmostroBase) == FALSE)
25-
return FALSE;
26-
2722
CONST CHAR* Pattern = "\x48\x8B\x05\x00\x00\x00\x00\x48\x89\x43\x18\x48\x8D\x05";
2823
CONST CHAR* Mask = "xxx????xxxxxxx";
2924

@@ -174,7 +169,8 @@ VOID UpdateDelta(PEPROCESS DebuggedProcess)
174169
HiddenProcess->Kusd.DeltaTimeUpdateLock += KernelKuserSharedData->TimeUpdateLock - HiddenProcess->Kusd.BeginTimeUpdateLock;
175170
HiddenProcess->Kusd.DeltaBaselineSystemQpc += KernelKuserSharedData->BaselineSystemTimeQpc - HiddenProcess->Kusd.BeginBaselineSystemQpc;
176171

177-
RtlZeroMemory(&HiddenProcess->Kusd.BeginInterruptTime, sizeof(ULONG64) * 5 + 4); /// oddd
172+
RtlZeroMemory(&HiddenProcess->Kusd.BeginInterruptTime, sizeof(ULONG64) * 5 + 4);
173+
178174
break;
179175
}
180176
}

‎HyperHideDrv/Utils.cpp‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -593,7 +593,18 @@ BOOLEAN IsSetThreadContextRestricted(PEPROCESS TargetProcess)
593593

594594
BOOLEAN GetOffsets()
595595
{
596-
if (g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_21H1 || g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_20H2 || g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_20H1)
596+
if (g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_11)
597+
{
598+
NtapiOffsets.BypassProcessFreezeFlagOffset = 0x74;
599+
NtapiOffsets.ThreadHideFromDebuggerFlagOffset = 0x560;
600+
NtapiOffsets.ThreadBreakOnTerminationFlagOffset = 0x560;
601+
NtapiOffsets.PicoContextOffset = 0x630;
602+
NtapiOffsets.RestrictSetThreadContextOffset = 0x460;
603+
NtapiOffsets.SeAuditProcessCreationInfoOffset = 0x5c0;
604+
}
605+
606+
else if (g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_21H1 || g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_21H2 ||
607+
g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_20H2 || g_HyperHide.CurrentWindowsBuildNumber == WINDOWS_10_VERSION_20H1)
597608
{
598609
NtapiOffsets.BypassProcessFreezeFlagOffset = 0x74;
599610
NtapiOffsets.ThreadHideFromDebuggerFlagOffset = 0x510;

‎airhv‎

0 commit comments

Comments
 (0)