#include 
#include 
class
ModuleHider
{
private
:
//only x86 structs
typedef
struct
_PEB_LDR_DATA
{
ULONG Length
;
BOOLEAN Initialized
;
HANDLE SsHandle
;
LIST_ENTRY InLoadOrderModuleList
;
LIST_ENTRY InMemoryOrderModuleList
;
LIST_ENTRY InInitializationOrderModuleList
;
PVOID      EntryInProgress
;
}
PEB_LDR_DATA
,
*
PPEB_LDR_DATA
;
typedef
struct
_LDR_DATA_ENTRY
{
//PVOID Reserved1[0];
LIST_ENTRY InLoadOrderModuleList
;
LIST_ENTRY InInitializationOrderModuleList
;
LIST_ENTRY InMemoryOrderModuleList
;
//PVOID Reserved2[2];
PVOID DllBase
;
PVOID Reserved3
[
2
]
;
UNICODE_STRING FullDllName
;
BYTE Reserved4
[
8
]
;
PVOID Reserved5
[
3
]
;
#pragma warning(push)
#pragma warning(disable: 4201)
// we'll always use the Microsoft compiler
union
{
ULONG CheckSum
;
PVOID Reserved6
;
}
DUMMYUNIONNAME
;
#pragma warning(pop)
ULONG TimeDateStamp
;
}
LDR_DATA_ENTRY
,
*
PLDR_DATA_ENTRY
;
PPEB_LDR_DATA _m_pPEB_LDR
;
PLDR_DATA_ENTRY _m_pEntry
;
HINSTANCE _m_DllHandle
;
PLDR_DATA_ENTRY _m_pDoEntry
,
_m_pAfterEntry
;
LIST_ENTRY _m_origAddrs
;
bool
_m_bIsHided
;
public
:
ModuleHider
(
const
HINSTANCE hModule
)
:
_m_DllHandle
(
hModule
)
,
_m_bIsHided
(
false
)
{
_m_pPEB_LDR
=
(
PPEB_LDR_DATA
)
NtCurrentTeb
(
)
->
ProcessEnvironmentBlock
->
Ldr
;
_m_pEntry
=
(
PLDR_DATA_ENTRY
)
_m_pPEB_LDR
->
InLoadOrderModuleList
.
Flink
;
}
;
~
ModuleHider
(
)
{
Show
(
)
;
}
;
auto
Hide
(
void
)
->
bool
{
if
(
_m_bIsHided
==
true
)
return
false
;
while
(
_m_pEntry
->
DllBase
)
{
if
(
_m_pEntry
->
DllBase
==
_m_DllHandle
)
{
_m_pDoEntry
=
(
PLDR_DATA_ENTRY
)
_m_pEntry
->
InLoadOrderModuleList
.
Blink
;
_m_pAfterEntry
=
(
PLDR_DATA_ENTRY
)
_m_pEntry
->
InLoadOrderModuleList
.
Flink
;
_m_origAddrs
.
Flink
=
_m_pAfterEntry
->
InLoadOrderModuleList
.
Blink
;
_m_origAddrs
.
Blink
=
_m_pDoEntry
->
InLoadOrderModuleList
.
Flink
;
_m_pDoEntry
->
InLoadOrderModuleList
.
Flink
=
_m_pEntry
->
InLoadOrderModuleList
.
Flink
;
_m_pAfterEntry
->
InLoadOrderModuleList
.
Blink
=
_m_pEntry
->
InLoadOrderModuleList
.
Blink
;
_m_bIsHided
=
true
;
return
true
;
}
_m_pEntry
=
(
PLDR_DATA_ENTRY
)
_m_pEntry
->
InLoadOrderModuleList
.
Flink
;
}
return
false
;
}
;
auto
Show
(
void
)
->
bool
{
if
(
_m_bIsHided
==
true
)
{
_m_pDoEntry
->
InLoadOrderModuleList
.
Flink
=
_m_origAddrs
.
Flink
;
_m_pAfterEntry
->
InLoadOrderModuleList
.
Blink
=
_m_origAddrs
.
Blink
;
_m_bIsHided
=
false
;
return
true
;
}
return
false
;
}
;
auto
IsModuleHided
(
void
)
->
bool
{
return
_m_bIsHided
;
}
;
}
;

HINSTANCE hModule
{
}
;
//предположим, что это валидный хендл нашего модуля
//создадим экзепляр класса, передавая в конструктор хендл модуля
std
::
unique_ptr

pModuleHider
=
std
::
make_unique

(
hModule
)
;
//метод для скрытия модуля
if
(
pModuleHider
->
Hide
(
)
)
std
::
cout

Show
(
)
)
std
::
cout

IsModuleHided
(
)
;