// HELIOS + Tetsuo void cPatchUtils::HideModuleEx ( HMODULE hModule, ELIST eList ) { _TEB* pTeb = NULL; __asm { xor eax, eax; mov eax, fs:[0x18]; mov pTeb, eax; } PPEB Peb = (PPEB)pTeb->Peb; char szPath[MAX_PATH] = { 0 }; GetModuleFileNameA(hModule, szPath, MAX_PATH); if (Peb && Peb->LoaderData && Peb->LoaderData->Initialized) { PLIST_ENTRY pListHead = NULL, pListPtr = NULL; DWORD dOffset = 0; switch (eList) // There are 3 module lists with different offsets { case LIST_LoadOrder: pListHead = pListPtr = &(Peb->LoaderData->InLoadOrderModuleList); dOffset = 0x24; break; case LIST_MemoryOrder: pListHead = pListPtr = &(Peb->LoaderData->InMemoryOrderModuleList); dOffset = 0x1C; break; case LIST_InitOrder: pListHead = pListPtr = &(Peb->LoaderData->InInitializationOrderModuleList); dOffset = 0x14; break; } if (pListHead && pListPtr) { // LIST_ENTRY is a double linked list, so we need to loop thru 2 lists do // Loop thru Flink { char name[MAX_PATH]; wsprintfA(name, "%S", ((PUNICODE_STRING)((PCHAR)pListPtr->Flink + dOffset))->Buffer); if (!stricmp(name, szPath)) // We found our module, so lets hide it { pListPtr->Flink = pListPtr->Flink->Flink; } pListPtr = pListPtr->Flink; } while (pListPtr->Flink != pListHead->Flink); do // Loop thru Blink { char name[MAX_PATH]; wsprintfA(name, "%S", ((PUNICODE_STRING)((PCHAR)pListPtr->Blink + dOffset))->Buffer); if (!stricmp(name, szPath)) // We found our module, so lets hide it { pListPtr->Blink = pListPtr->Blink->Blink; } pListPtr = pListPtr->Blink; } while (pListPtr->Blink != pListHead->Blink); } } }