Click here to Skip to main content
15,891,567 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
Hi, I want hide files (in my program). I decided use NtQueryDirectoryFile. But files not hiding, the code did not work. I don't use a driver, I use user mode. Can anybody help me? Thanks.The code snippet:

C++
typedef NTSTATUS (WINAPI * NTQUERYDIRECTORYFILE) (IN HANDLE FileHandle,IN HANDLE Event OPTIONAL,IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,IN PVOID ApcContext OPTIONAL,OUT PIO_STATUS_BLOCK IoStatusBlock,OUT PVOID FileInformation,IN ULONG FileInformationLength,IN MYFILE_INFORMATION_CLASS FileInformationClass,IN BOOLEAN ReturnSingleEntry,IN PUNICODE_STRING FileName OPTIONAL,IN BOOLEAN RestartScan);

NTQUERYDIRECTORYFILE OriginalNtQueryDirectoryFile;

#define STATUS_NO_SUCH_FILE 0xC000000F

NTSTATUS
  HookedNtQueryDirectoryFile(
		IN HANDLE FileHandle,
		IN HANDLE Event OPTIONAL,
		IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
		IN PVOID ApcContext OPTIONAL,
		OUT PIO_STATUS_BLOCK IoStatusBlock,
		OUT PVOID FileInformation,
		IN ULONG FileInformationLength,
		IN MYFILE_INFORMATION_CLASS FileInformationClass,
		IN BOOLEAN ReturnSingleEntry,
		IN PUNICODE_STRING FileName OPTIONAL,
		IN BOOLEAN RestartScan)
{
	NTSTATUS status = OriginalNtQueryDirectoryFile(FileHandle,Event,ApcRoutine,ApcContext,IoStatusBlock,FileInformation,FileInformationLength,FileInformationClass,ReturnSingleEntry,FileName,RestartScan);

	vector<wstring> listDataForHidding;
	listDataForHidding.push_back(L"afile.txt");
	listDataForHidding.push_back(L"bfile.txt");
	listDataForHidding.push_back(L"cfile.txt");
        listDataForHidding.push_back(L"dfile.txt");

	if (NT_SUCCESS(status))
	{
		PMYFILE_DIRECTORY_INFORMATION FileDirectoryInfo, LastFileDirectoryInfo;
		PMYFILE_FULL_DIR_INFORMATION  LastFileFullDirectoryInfo, FileFullDirectoryInfo;
		PMYFILE_BOTH_DIR_INFORMATION  LastFileBothDirectoryInfo, FileBothDirectoryInfo;
		PMYFILE_NAMES_INFORMATION     LastFileNamesInfo, FileNamesInfo;

		ULONG Offset = 0;
		BOOL bNeedHide = FALSE;

		switch (FileInformationClass)
		{
			case FileDirectoryInformation :
				FileDirectoryInfo = NULL;
				
				do 
				{
					 
					FileDirectoryInfo = (PMYFILE_DIRECTORY_INFORMATION)((ULONG)FileInformation + Offset);
					LastFileDirectoryInfo = FileDirectoryInfo;

					wstring wstrCurrFileName = FileDirectoryInfo->FileName;
					bNeedHide = FALSE;
					for(size_t index = 0; index < listDataForHidding.size(); index ++)
					{ 
						if(wstrCurrFileName.find(listDataForHidding[index]) != wstring::npos)
						{
							 
							bNeedHide = TRUE;
							break;
						}
					} 
					if(bNeedHide == TRUE)
					{
						if (!FileDirectoryInfo->NextEntryOffset)
						{
							if (LastFileDirectoryInfo) LastFileDirectoryInfo->NextEntryOffset = 0;
							else status = STATUS_NO_SUCH_FILE;
							return status;
						} else 
						if (LastFileDirectoryInfo) LastFileDirectoryInfo->NextEntryOffset += FileDirectoryInfo->NextEntryOffset;						
					}

					Offset += FileDirectoryInfo->NextEntryOffset;

				} while (FileDirectoryInfo->NextEntryOffset);

			break;

			case FileFullDirectoryInformation :
				FileFullDirectoryInfo = NULL;
				do
				{
					LastFileFullDirectoryInfo = FileFullDirectoryInfo; 
					FileFullDirectoryInfo = (PMYFILE_FULL_DIR_INFORMATION)((ULONG)FileInformation + Offset);

					wstring wstrCurrFileName = FileDirectoryInfo->FileName;
					bNeedHide = FALSE;
					
					for(size_t index = 0; index < listDataForHidding.size(); index ++)
					{ 
						if(wstrCurrFileName.find(listDataForHidding[index]) != wstring::npos)
						{ 	 
							bNeedHide = TRUE;
							break;
						}
					} 
					if(bNeedHide == TRUE)
					{
						if (!FileFullDirectoryInfo->NextEntryOffset)
						{
							if (LastFileFullDirectoryInfo) LastFileFullDirectoryInfo->NextEntryOffset = 0;
							else status = STATUS_NO_SUCH_FILE;
							return status;
						} else 
						if (LastFileFullDirectoryInfo) LastFileFullDirectoryInfo->NextEntryOffset += FileFullDirectoryInfo->NextEntryOffset;
					}

					Offset += FileFullDirectoryInfo->NextEntryOffset;

				} while (FileFullDirectoryInfo->NextEntryOffset);
			break;

			case FileBothDirectoryInformation :
				FileBothDirectoryInfo = NULL;
				do
				{
					LastFileBothDirectoryInfo = FileBothDirectoryInfo; 
                    FileBothDirectoryInfo = (PMYFILE_BOTH_DIR_INFORMATION)((ULONG)FileInformation + Offset);
					
					wstring wstrCurrFileName = FileDirectoryInfo->FileName;
					bNeedHide = FALSE;
					
					for(size_t index = 0; index < listDataForHidding.size(); index ++)
					{ 
						if(FileBothDirectoryInfo->FileNameLength > 1 && wstrCurrFileName.find(listDataForHidding[index]) != wstring::npos)
						{
							 
							bNeedHide = TRUE;
							break;
						}
					}

					 
					if(bNeedHide == TRUE)
					{
						if (!FileBothDirectoryInfo->NextEntryOffset)
						{
							if (LastFileBothDirectoryInfo) LastFileBothDirectoryInfo->NextEntryOffset = 0;
							else status = STATUS_NO_SUCH_FILE;
							return status;
						} else 
						if (LastFileBothDirectoryInfo) LastFileBothDirectoryInfo->NextEntryOffset += FileBothDirectoryInfo->NextEntryOffset;
					}

					Offset += FileBothDirectoryInfo->NextEntryOffset;

				} while (FileBothDirectoryInfo->NextEntryOffset);
			break;

			case FileNamesInformation :
				FileNamesInfo = NULL;
				do
				{
					LastFileNamesInfo = FileNamesInfo; 
					FileNamesInfo = (PMYFILE_NAMES_INFORMATION)((ULONG)FileInformation + Offset);

					wstring wstrCurrFileName = FileDirectoryInfo->FileName;
					bNeedHide = FALSE;
					
					for(size_t index = 0; index < listDataForHidding.size(); index ++)
					{ 
						if(wstrCurrFileName.find(listDataForHidding[index]) != wstring::npos)
						{  
							bNeedHide = TRUE;
							break;
						}
					}
  
					if(bNeedHide == TRUE)
					{
						if (!FileNamesInfo->NextEntryOffset)
						{
							if(LastFileNamesInfo) LastFileNamesInfo->NextEntryOffset = 0;
							else status = STATUS_NO_SUCH_FILE;
							return status;
						} else 
						if (LastFileNamesInfo) LastFileNamesInfo->NextEntryOffset += FileNamesInfo->NextEntryOffset;
					}

					Offset += FileNamesInfo->NextEntryOffset;
				} while (FileNamesInfo->NextEntryOffset);

			break;
		}
	}

	return status;
}
Posted
Comments
Philippe Mori 25-Apr-13 19:07pm    
Don't hide what you do on another one computer. This is really a bad idea.

The only think you should do is to use the hidden file attribute. The file won't be displayed by default. User can always display hidden files.

If a file contains sensible information, you should crypt it.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900