Click here to Skip to main content
15,880,725 members
Articles / Desktop Programming / MFC

Driver to Hide Processes and Files

, ,
Rate me:
Please Sign up or sign in to vote.
4.57/5 (145 votes)
17 Aug 2009CPOL12 min read 654K   28.5K   369  
In this article, we describe the driver we created to hide processes and files in a system.
#include "StdAfx.h"
#include ".\drvwork.h"
SC_HANDLE DriverWork::scm = NULL;
DriverWork::DriverWork(void)
{
}

DriverWork::~DriverWork(void)
{
	CloseServiceHandle (scm);
}

BOOL DriverWork::Install(LPCTSTR DriverName,LPCTSTR driverExec,DWORD startType)
{
	if(scm == NULL)
		scm = OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);

	SC_HANDLE Service =
		CreateService ( scm,    // �������� ���������� � SCManager
		DriverName,				// ��� ������� 
		DriverName,				// ��� ������ �� �����
		SERVICE_ALL_ACCESS,		// �������� ������
		SERVICE_KERNEL_DRIVER,	// ��� �������
		startType,				// ��� ������� 
		SERVICE_ERROR_NORMAL,	// ��� �������������� ������
		driverExec,				// ���� � ��������� �����
		// ��������� ��������� �� ������������ � ������ NULL
		NULL,    // �� ���������� ������ ��������
		NULL, NULL, NULL, NULL);
	if (Service == NULL) 
	{
		// failure
		DWORD err = GetLastError();
		if (err == ERROR_SERVICE_EXISTS) 
		{
			/* OK. Service already exist */
			return TRUE;
		}
		else  
		{
			// Print additional information
			CString str;
			str.Format(_T("ERR: Can't create service. Err=%d\n"),err);
			AfxMessageBox(str);
		}
		return FALSE;
	}
	CloseServiceHandle (Service);
	return TRUE;
}

BOOL DriverWork::Remove(LPCTSTR DriverName,LPCTSTR driverExec)
{
	if(scm == NULL)
		scm = OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);

	SC_HANDLE Service =	OpenService (scm, DriverName, SERVICE_ALL_ACCESS);
	if (Service == NULL) // No access to service manager
	{
		CloseServiceHandle(scm); // Disconnecting from SCM
		scm = NULL;
		return FALSE;
	}
	BOOL ret = DeleteService (Service);
	if (!ret) 
	{
		// failure
		// Print additional information
		DWORD err = GetLastError();
		CString str;
		str.Format(_T("ERR: Can't delete service. Err=%d\n"),err);
		AfxMessageBox(str);
	} 

	CloseServiceHandle (Service);
	return ret;
}
BOOL DriverWork::Start(LPCTSTR DriverName)
{
	if(scm == NULL)
		scm = OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);

	SC_HANDLE Service =	OpenService(scm, DriverName, SERVICE_ALL_ACCESS);
	if (Service == NULL) // No access to service manager
	{
		CloseServiceHandle(scm); // Disconnecting from SCM
		scm = NULL;
		return FALSE;
	}
	BOOL ret =
		StartService(	Service, // ����������
						0,       // ����� ����������
						NULL  ); // ���������  �� ���������
	if (!ret) 
	{ 
		// failure
		DWORD err = GetLastError();
		if (err == ERROR_SERVICE_ALREADY_RUNNING)
			ret = TRUE; // OK, driver already running
		else 
		{ 
			/* other troubles */
			// Print additional information
			CString str;
			str.Format(_T("ERR: Can't start service. Err=%d\n"),err);
			AfxMessageBox(str);
		}
	}

	CloseServiceHandle (Service);
	return ret;
}
BOOL DriverWork::Stop(LPCTSTR DriverName)
{
	if(scm == NULL)
		scm = OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);


	SC_HANDLE Service =	OpenService (scm, DriverName, SERVICE_ALL_ACCESS );
	if (Service == NULL) // No access to service manager
	{
		DWORD err = GetLastError();
		CloseServiceHandle(scm); // Disconnecting from SCM
		scm = NULL;
		return FALSE; 
	}
	SERVICE_STATUS serviceStatus;
	BOOL ret = 
		ControlService(Service, SERVICE_CONTROL_STOP, &serviceStatus);
	if (!ret)
	{
		// failure
		// Print additional information
		DWORD err = GetLastError();
		CString str;
		str.Format(_T("ERR: Can't stop service. Err=%d\n"),err);
		AfxMessageBox(str);
	}

	CloseServiceHandle (Service);
	return ret;
}
BOOL DriverWork::Exchange(unsigned long ioctlCode,	// IOCTL code
						  PWCHAR pInStr,			// Input string
						  DWORD inStr_size,			// Size of input string
						  PWCHAR pOutStr,			// Output string
						  DWORD outStr_size,		// Size of output string
						  PDWORD BytesReturned)		// Returned bytes number
{
	HANDLE hHandle =           
		CreateFile( _T("\\\\.\\HideDriver"),
		GENERIC_READ | GENERIC_WRITE,
		FILE_SHARE_READ | FILE_SHARE_WRITE,
		NULL,
		OPEN_EXISTING,
		FILE_ATTRIBUTE_NORMAL,
		NULL );
	if(hHandle == INVALID_HANDLE_VALUE)
	{	
		AfxMessageBox(_T("ERR: can not access driver HideDriver !\n"));
		return FALSE;
	}

	if( !DeviceIoControl(   hHandle,
		ioctlCode,
		pInStr, inStr_size,  // Input
		pOutStr, outStr_size,// Output
		BytesReturned,
		NULL )  )
	{
		// failure
		// additional information
		DWORD err = GetLastError();
		CString str;
		str.Format(_T("ERR: Can't send information to service. Err=%d\n"),err);
		AfxMessageBox(str);

		CloseHandle(hHandle);
		return FALSE;
	}
	CloseHandle(hHandle);
	
	return TRUE;
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Chief Technology Officer Apriorit Inc.
United States United States
ApriorIT is a software research and development company specializing in cybersecurity and data management technology engineering. We work for a broad range of clients from Fortune 500 technology leaders to small innovative startups building unique solutions.

As Apriorit offers integrated research&development services for the software projects in such areas as endpoint security, network security, data security, embedded Systems, and virtualization, we have strong kernel and driver development skills, huge system programming expertise, and are reals fans of research projects.

Our specialty is reverse engineering, we apply it for security testing and security-related projects.

A separate department of Apriorit works on large-scale business SaaS solutions, handling tasks from business analysis, data architecture design, and web development to performance optimization and DevOps.

Official site: https://www.apriorit.com
Clutch profile: https://clutch.co/profile/apriorit
This is a Organisation

33 members

Written By
Software Developer Codedgers Inc
Ukraine Ukraine
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Written By
Software Developer (Junior) ApriorIT
Ukraine Ukraine
Sergey Popenko.
22 years old.
The Driver Team`s software developer.
Master of the Applied Math faculty, the Dnipropetrovsk National University, Ukraine.

Comments and Discussions