[MindfreaK]

The tittle contains everything. It is a sample NtQuerySystemInformation Hook that is working with x64.
I got some trouble with it when it is the first process in the list so it has some bugs.
The "HookEngine" is bad but works.
( IDE: VS2008+x64CompilerTools )

[Tigzy]

Hello

Seems interesting.
Just there are no comments in the source, can you explain briefly what it does?

[MindfreaK]

It runs taskmgr.exe.
After that it does an injection into taskmgr.exe by injecting via 'full pe injection', this writes the whole opcode of the process in taskmgr.exe and creates a thread.
This thread does an hook on NtQuerySystemInformation which will hide everything in processlist that name contain '$sys$' without '' . But there are some bugs (; it doesn't hide everything properly . you need to run the file you want to hide before taskmanager is ran to get it hidden , because my code doesn't hide the first or last (don't actually know right now) process in the processinformation array. Thanks for reply.