how to hide a file

I think that for real hooking you will need to write ring0 driver. This ring3 hooking with dll injection is not enough releable technique.

hxxp://www.phrack.org/show.php?p=62&a=6

Dig through that, it will give you some rather interesting ideas
at the very least.

Originally Posted by jov

I think that for real hooking you will need to write ring0 driver. This ring3 hooking with dll injection is not enough releable technique.

it's reliable enough, and KMDs are NT-only (and if you combine some sort of VXD/KMD stuff in one app, it will look ugly :/ ). IAT-hooking is sufficient for the average job, but you need to watch out for some annoying pitfalls, like patching LoadLibrary()/GetProcAddress(), but even then an app could dynamically obtain API address by enumerating EATs, so that's where EAT-hooking comes in.

As for reliability, it's simply best to allocate a buffer of say, 20 bytes of nops, and a jmp , use a LDE, scan the first few instructions, until the length you have scanned exceeds 6 (push dword / retn, it must be direct, not relative, so it can be hooked again), copy those instructions into your empty buffer, patch the entrypoint, repair the empty jump in the buffer, and that shall act as a stub your hooking procedure calls to return to the original function. I, personally, think this is the most reliable way out there.

as for dll-injection, open a process, retreive its threads, use OpenThread() to convert dwThreadID to hThread, SuspendThread(), GetThreadContext(), alter eip, SetThreadContext(), and inject a CreateThread() call, then resume the thread.

OpenThread() is "officially" only avaliable on NT, but there are plenty of undocummented ways to achieve the same.

ok just my 2 cents.

It looks like toas is running a pre-NT windows OS. I don't see why the described method would work on NT4.0+.

[taos]

Originally Posted by homersux

It looks like toas is running a pre-NT windows OS. I don't see why the described method would work on NT4.0+.

Quote from Validtec:
"APIHookxp.dll: Win32 API Hook DLL for WINNT/2000/XP
APIHook9x.dll: Win32 API Hook DLL for WIN9X/WINME"

It's valid for different OS. You only need to distribute the right dlll or both.

For hide file on HardDisc, maybe you should learn some stealth techniq from phrack.

For hide pe file on running, you can coding to change own PEB; hook some api, and even inject own into other process