Click here to Skip to main content
15,885,278 members
Articles / Programming Languages / C++

Driver to Hide Processes and Files. Second Edition: Splicing

,
Rate me:
Please Sign up or sign in to vote.
4.93/5 (33 votes)
11 Mar 2011CPOL9 min read 69.3K   8.8K   115  
This article describes a driver that hides processes and files using the method of splicing.
/*
    Test driver for a C++ run-time library that supports C++ exception
    handling and run-time type information.
    Copyright (C) 2003, 2004 Bo Branten.
*/

extern "C" {
#define POINTER_64
#include <ntddk.h>
}
#include "libcpp.h"
#include "typeinfo.h"

#include "CppLibTest.h"

class ClassA{virtual void f(){}};
class ClassAA : public ClassA{};
class ClassB{};

class Object {
public:
    Object(char* s) : m_name(s)                 { DbgPrint("Object %s was constructed\n", m_name); }
    Object(const Object& o) : m_name(o.m_name)  { DbgPrint("Object %s was copied\n", m_name); }
    ~Object()                                   { DbgPrint("Object %s was deleted\n", m_name); }
    char* GetName()                             { return m_name; }
private:
    char* m_name;
};

Object g("global");

void CppLibTest()
{
    //
    // Test run-time type information.
    //

    DbgPrint("Test run-time type information\n");

    const type_info& gt = typeid(g);

    DbgPrint("The name of the global object g is: %s\n", gt.name());

    
    ClassA a1, a2;
    ClassAA aa;
    ClassB b;

    void* pv = dynamic_cast<void*>(&a1);

    ClassA* ap = &aa;
    ClassAA* aap = dynamic_cast<ClassAA*>(ap);

    DbgPrint("The type name of the object ap points to is: %s\n", typeid(*ap).name());

    if (typeid(a1) == typeid(a2))
    {
        DbgPrint("%s and %s is of the same type\n", typeid(a1).name(), typeid(a2).name());
    }

    if (typeid(a1) != typeid(b))
    {
        DbgPrint("%s and %s is not of the same type\n", typeid(a1).name(), typeid(b).name());
    }

    DbgPrint("\n");

    //
    // Test exception handling.
    //
    DbgPrint("Test exception handling.\n");

    try {
        Object l1("local 1");
        DbgPrint("Throwing an exception\n");
        throw Object("an exception");
    }
    catch (Object& e) {
        DbgPrint("Catching %s\n", e.GetName());
    }

    DbgPrint("\n");

    //
    // Test re-throwing an exception.
    //
    DbgPrint("Test re-throwing an exception.\n");

    try {
        Object l3("local 3");
        try {
            Object l4("local 4");
            DbgPrint("Throwing an exception to re-throw\n");
            throw Object("an exception to re-throw");
        }
        catch (Object& e) {
            DbgPrint("Catching %s the first time\n", e.GetName());
            throw;
        }
    }
    catch (Object& e) {
        DbgPrint("Catching %s the second time\n", e.GetName());
    }

    DbgPrint("\n");

    //
    // Test exception handling at DISPATCH_LEVEL.
    //
    DbgPrint("Test exception handling at DISPATCH_LEVEL.\n");
    

    KIRQL SavedIrql;

    DbgPrint("Raising IRQL to DISPATCH_LEVEL\n");

    KeRaiseIrql(DISPATCH_LEVEL, &SavedIrql);

    try {
        Object l5("local 5");
        DbgPrint("Throwing an exception at DISPATCH_LEVEL\n");
        throw Object("an exception at DISPATCH_LEVEL");
    }
    catch (Object& e) {
        DbgPrint("Catching %s\n", e.GetName());
    }

    DbgPrint("Lower IRQL from DISPATCH_LEVEL\n");

    KeLowerIrql(SavedIrql);

    DbgPrint("\n");
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Chief Technology Officer Apriorit Inc.
United States United States
ApriorIT is a software research and development company specializing in cybersecurity and data management technology engineering. We work for a broad range of clients from Fortune 500 technology leaders to small innovative startups building unique solutions.

As Apriorit offers integrated research&development services for the software projects in such areas as endpoint security, network security, data security, embedded Systems, and virtualization, we have strong kernel and driver development skills, huge system programming expertise, and are reals fans of research projects.

Our specialty is reverse engineering, we apply it for security testing and security-related projects.

A separate department of Apriorit works on large-scale business SaaS solutions, handling tasks from business analysis, data architecture design, and web development to performance optimization and DevOps.

Official site: https://www.apriorit.com
Clutch profile: https://clutch.co/profile/apriorit
This is a Organisation

33 members

Written By
Technical Lead Apriorit Inc.
Ukraine Ukraine
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Comments and Discussions