Task

Implement the driver to hide files and processes on the local PC. Processes should be hidden from the applications that browse Process List (Task manager, Process Explorer etc.) and from the Windows API calls (EnumProcesses, OpenProcess, EnumProcessModules and other Process APIs).

Files should be hidden from the file managers (Windows Explorer, Far, Total Commander) and also from the Windows API calls (FindFile, OpenFile and other File APIs).

This project was developed by Ivan Romanenko, Junior Software Developer (Network Security Direction) and Sergiy Popenko, Junior Software Developer (Driver Development Direction).

Results

During the project implementation we add some features that were not mentioned in the initial task:

• Correct work on the multiple-processor systems.
• Support of the masks in the names of processes and files.
• Filtering of the access by the name of the process that requested for access.

Also we planned to add more interesting features but didn’t have enough time to implement all of them:

• Hiding of registry keys (that task was solved earlier by the ApriorIT specialists – see the Case Study).
• Filtering of the access by the user name.
• Hiding the list of drivers.
• Storing the parameters in the registry or .xml file

A lot of time was spent to create the Universal Subsystem of Interceptions where the implementation of the concrete interception is a kind of plug-in. Due to the limited terms we implemented only two such plug-ins with expanded functionality. But also we developed the interception of functions via System Service Table (SST) that allowed hiding opened ports, registry keys, handles, memory.

Tools and Technologies

Working with SST, DPC Sync for correct hook installation in the multiple-processor systems.

Internal ApriorIT library for driver development in C++, STL (Standard Template Library), MFC (Microsoft Foundation Classes).

Patterns: Proxy (Wrapper), Singleton, MVC (Model View Controller), Model (from MFC Document) and some others.

Download Project Documentation and SSDT Patching Description.

Download Source Files.