static
NTSTATUS NTAPI
HookNtQueryInformationProcess
(
IN HANDLE ProcessHandle
,
IN PROCESSINFOCLASS ProcessInformationClass
,
OUT PVOID ProcessInformation
,
IN ULONG ProcessInformationLength
,
OUT PULONG ReturnLength
)
{
NTSTATUS ret
=
Undocumented
::
NtQueryInformationProcess
(
ProcessHandle
,
ProcessInformationClass
,
ProcessInformation
,
ProcessInformationLength
,
ReturnLength
)
;
{
if
(
NT_SUCCESS
(
ret
)
&&
ProcessInformation
&&
ProcessInformationClass
!=
ProcessBasicInformation
)
//prevent stack overflow
{
else
if
(
ProcessInformationClass
==
ProcessDebugPort
)
{
if
(
Hider
::
IsHidden
(
pid
,
HideProcessDebugPort
)
)
{
Log
(
"[TITANHIDE] ProcessDebugPort by %d\r\n"
,
pid
)
;
__try
{
BACKUP_RETURNLENGTH
(
)
;
*
(
ULONG_PTR
*
)
ProcessInformation
=
0
;
RESTORE_RETURNLENGTH
(
)
;
}
__except
(
EXCEPTION_EXECUTE_HANDLER
)
{
ret
=
GetExceptionCode
(
)
;
}
}
}
}
}
return
ret
;
}