Hide Way

Hide Way

Service Hiding

Written by:
Eugene Wineblat,
Senior Developer of Network Security Team,
Apriorit Inc. http://www.apriorit.com

Content:

1. Introduction
2. List of services
   1. services.exe
   2. Signatures
   3. Structure of SERVICE_RECORD
   4. Life After The Windows Vista
3. Patching
   1. Search of signatures
   2. Service hiding
   3. Correct restoration
4. Structure of the project files
5. References

1. Introduction

In this article we continue investigation in the field of hiding application in the system. This theme was started by Ivan Romanenko and Sergey Popenko in the article “Driver to Hide Processes and Files”. Our aim is to discover the ways of application hiding in the system for the wide audience. The approaches described can be used in the Corporate Security systems development – to hide system agents and prevent switching them off by users. Information can be also useful for those who research harmful software - to build the adequate answer for the threats.

This article will tell where Windows OS stores the services and how uses them. We’ll discuss how this knowledge can be applied to finding our custom service and hiding it.

So let’s start our research.

2. List of services

At the first step of my research I thought that if there were services then somewhere their manager had to be. And it discovered to be true – such manager is in the file named services.exe.

2.1. services.exe

The process services.exe deals with all operations associated with services, service manager – which is familiar to many developers by the ::OpenSCManager function, and obviously with the service storing too.

So my first task is to find where the service database is stored.

My analysis showed that we need ScInitDatabase function and it includes such assembler instructions:

ScInitDatabase proc near

xor eax, eax

push esi

mov g_uScTotalNumServiceRecs, eax

mov g_ImageDatabase, eax ; _IMAGE_RECORD ImageDatabase

mov g_pImageDatabase, eax ; Pointer to first _IMAGE_RECORD

mov g_ServiceDatabase, eax ; _SERVICE_RECORD ServiceDatabase

mov g_pServiceDatabase, eax ; Pointer to first _SERVICE_RECORD

call ?ScInitGroupDatabase@@YGXXZ ; ScInitGroupDatabase(void)

mov esi, ds:__imp__RtlInitializeResource@4 ; RtlInitializeResource(x)

push offset ?ScServiceRecordLock@@3VCServiceRecordLock@@A ; CServiceRecordLock

ScServiceRecordLock

mov ?ResumeNumber@@3KA, 1 ; ulong ResumeNumber

call esi ; RtlInitializeResource(x) ; RtlInitializeResource(x)

push offset ?ScServiceListLock@@3VCServiceListLock@@A ; CServiceListLock

ScServiceListLock

call esi ; RtlInitializeResource(x) ; RtlInitializeResource(x)

push offset ?ScGroupListLock@@3VCGroupListLock@@A ; CGroupListLock

ScGroupListLock

call esi ; RtlInitializeResource(x) ; RtlInitializeResource(x)

call ?ScGenerateServiceDB@@YGHXZ ; ScGenerateServiceDB(void)

neg eax

sbb eax, eax

neg eax

pop esi

retn

ScInitDatabase end

The third, sixth and seventh lines are suspected to store the data we need – service database g_pServiceDatabase. On the basis of the places where ScCreateServiceRecord and ScGetNamedServiceRecord variables are used we can say that it is exactly what we are looking for – service database and the pointer to its beginning.

2.2. Signatures

Without second thought we take this method as a basis as it is called only once at the program start, and choose signature to search pointer to the beginning of the list of services in the process memory.

Let’s consider the first variant A3 9C A0 01 01 A3 98 A0 01 01 E8 B5 08 00 00, which is just the assembler code of the three mentioned lines:

mov g_ServiceDatabase, eax ; _SERVICE_RECORD ServiceDatabase

mov g_pServiceDatabase, eax ; Pointer to first _SERVICE_RECORD

call ?ScInitGroupDatabase@@YGXXZ ; ScInitGroupDatabase(void)

To use this signature we should guarantee that:

• All versions of services.exe have the same signature in the proper place
• All versions of services.exe have only one such signature

I developed the simple utility based on the code of FindSignature function (plServicesSiganture.cpp):

 

unsigned char g_ServicesDBSignature[] =

{ 0xA3, 0x9C, 0xA0, 0x01, 0x01, 0xA3, 0x98, 0xA0, 0x01, 0x01,

0xE8, 0xB5, 0x08, 0x00, 0x00 };

unsigned char g_ServicesDBSignatureMask[] =

{ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,

0xFF, 0xFF, 0xFF, 0xFF, 0xFF };

 

 

int

FindSignature ( char* pBaseAddr, unsigned long ulSectionSize, unsigned

long *pulSignatureOffset )

{

char* pFoundPos = 0;

char* pCheckPos = 0;

MASK_BUFFER bufMask = { (char*)g_ServicesDBSignature,

(char*)g_ServicesDBSignatureMask,

sizeof ( g_ServicesDBSignature ) / sizeof ( g_ServicesDBSignature[0] ) };

// find first occurrence of signature

BUFFER bufMemory = { pBaseAddr, ulSectionSize };

if ( PL_STATUS_SUCCESS != PlSearchSequence ( &bufMask,

&bufMemory,

&pFoundPos ) )

{

return 0;

}

// find second occurrence of signature – exception situation

bufMemory.pStart = pFoundPos + 1;

bufMemory.nSize = ulSectionSize - (pFoundPos - pBaseAddr + 1);

if ( PL_STATUS_SUCCESS == PlSearchSequence ( &bufMask,

&bufMemory,

&pCheckPos ) )

{

return 0;

}

*pulSignatureOffset = (unsigned long)(pFoundPos - pBaseAddr);

return 1;

}

I started with services.exe for Windows XP and then checked all mentioned requirements for the signature for the rest of the services.exe versions for other OS versions. That gave me the final variant of the signature, which suited all versions and requirements:

68 XX XX XX XX C7 XX XX XX XX XX 01 00 00 00

where XX is any value that means that we should search the signature by mask.

This signature is pointing to the execution of the following commands from ScInitDatabase function:

push offset ?ScServiceRecordLock@@3VCServiceRecordLock@@A ; CServiceRecordLock

ScServiceRecordLock

mov ?ResumeNumber@@3KA, 1 ; ulong ResumeNumber

2.3.Structure of SERVICE_RECORD

Service database it’s the list of structures SERVICE_RECORD, which contain necessary description of each service for the system. Here we won’t discuss the complete structure SERVICE_RECORD as far as it’s not necessary for us.

My further research discovered three fields:

Prev – pointer to the previous list element
Next – pointer to the next list element
ServiceName – pointer to the string with the service name

The offsets of these fields relative to the SERVICE_RECORD structure beginning are:

Prev – 0x00
Next – 0x04
ServiceName – 0x08

2.4. Life After The Windows Vista

Windows Vista release “changed the world” – and it affected services.exe also.

The search for the list beginning changed and so do the structure of SERVICE_RECORD. Now dereferencing should be applied to the pointer to the service list beginning (it must be the common improved protection of the pointers in the process memory) and also I had to look for the new offsets of Next, Prev and ServiceName fields.

Here are these offsets:

Prev – 0x00
Next – 0x60
ServiceName – 0x04

Changes in the logic of the database beginning search are reflected in the functions SearchForServicesDbOffset_EarlierVista and SearchForServicesDbOffset_Vista (in the file plServicesSignature.cpp).

3. Patching

Below we’ll discuss the difficulties of the practical implementation.

3.1 Search of the signatures

To search for the signatures we should look through the memory of the “services.exe” process and detect a signature. So we examine all memory allocated by this process using VirtualQueryEx and ReadProcessMemory functions:

 

MEMORY_BASIC_INFORMATION mbi;

if ( ::VirtualQueryEx ( hProcess, 0, &mbi, sizeof(mbi) ) != sizeof(mbi) )

throw std::exception ( "Error on VirtualQueryEx" );

 

void* pAddr = mbi.AllocationBase;

do

{

MEMORY_BASIC_INFORMATION mbi1;

if ( ::VirtualQueryEx ( hProcess, pAddr, &mbi1, sizeof(mbi1) ) != sizeof(mbi1) )

throw std::exception ( "Error on VirtualQueryEx" );

 

if ( mbi1.RegionSize != 0 )

{

std::vector< unsigned char > bufMemory ( mbi1.RegionSize );

SIZE_T nBytesRead = 0;

if ( ::ReadProcessMemory ( hProcess, pAddr, &amp;bufMemory[0],

mbi1.RegionSize, &amp;nBytesRead ) )

{

//Here you can search for your data

}

}

else

{

throw std::exception ( "No more process memory" );

}

 

pAddr = (PBYTE)pAddr + mbi1.RegionSize;

 

} while ( true );

After that we find the beginning of the service list by the signature.

3.2. Service hiding

Now we should only find our record in the list and redefine the Next pointer of the previous record to the record which is next to our one, and correspondingly the Prev pointer of the next to our record should be redefined to the record which is previous to our one:

 

// find sevice by ServiceName

PUCHAR pServiceRecord = 0;

if ( !LookupServicesDbRecordByName ( hProcess, pServiceDb, pServicesContext,

pwstrServiceName, &amp;pServiceRecord ) )

{

false;

}

 

std::vector< unsigned char > buffer (

pServicesContext->m_OffsetFncList.m_fncGetEstimatedSize () );

if ( !::ReadProcessMemory ( hProcess, pServiceRecord, &amp;buffer[0],

pServicesContext->m_OffsetFncList.m_fncGetEstimatedSize (), 0 ) )

{

throw std::exception ( "Error on ReadProcessMemory" );

}

 

// Get address of Next and Prev records

PUCHAR pPrevServiceRecord = (unsigned char*)*

(PULONG)pServicesContext->m_OffsetFncList.m_fncGetOffset_Prev ( &amp;buffer[0] );

PUCHAR pNextServiceRecord = (unsigned char*)*

(PULONG)pServicesContext->m_OffsetFncList.m_fncGetOffset_Next ( &amp;buffer[0] );

 

if ( pPrevServiceRecord )

{

// PrevRecord->Next = NextRecord

 

ulPatchAddr = (ULONG)pNextServiceRecord;

PUCHAR pPrevNextServiceRecord =

(PUCHAR)pServicesContext->m_OffsetFncList.m_fncGetOffset_Next

( pPrevServiceRecord );

 

SIZE_T szWritten = 0;

if ( !::WriteProcessMemory ( hProcess,

pPrevNextServiceRecord,

&amp;ulPatchAddr,

sizeof (ulPatchAddr),

&amp;szWritten ) )

{

throw std::exception ( "Error on WriteProcessMemory" );

}

}

 

if ( pNextServiceRecord )

{

// NextRecord->Prev = PrevRecord

 

ulPatchAddr = (ULONG)pPrevServiceRecord;

PUCHAR pNextPrevServiceRecord =

(PUCHAR)pServicesContext->m_OffsetFncList.m_fncGetOffset_Prev

( pNextServiceRecord );

if ( !::WriteProcessMemory ( hProcess,

pNextPrevServiceRecord,

&amp;ulPatchAddr,

sizeof (ulPatchAddr),

0 ) )

{

throw std::exception ( "Error on WriteProcessMemory" );

}

}

After these manipulations our service disappears.

3.3 Correct restoration

Hiding is good but I should tell about restoration too to complete the story.

Why restore? To delete service correctly by means of corresponding DeleteService function.

My proposition is to create callback function that returns the address of the hided service in the memory of the “services.exe” process after the hiding. Then we will be able to easily restore the services sequence when we need it.

We should remember that the system is permanently changing and Prev and Next pointers of the hided record can not be the “live” records in the service list already.

That’s why while restoring we should make such steps:

• Search the record which corresponds to the Prev address; if there is such a record then add element to the list after the specified element (InsertAfter).
• If the record is not found then search the record by the corresponding Next address. If it is found then add element to the list before the specified element (InsertBefore).
• If the record is not found by Next pointer then simply add the service to the end of the service list (InsertAtTheEnd).

 

std::vector< unsigned char > buffer (

pServicesContext->m_OffsetFncList.m_fncGetEstimatedSize () );

if ( !::ReadProcessMemory ( hProcess, pServiceRecord, &amp;buffer[0],

pServicesContext->m_OffsetFncList.m_fncGetEstimatedSize (), 0 ) )

{

throw std::exception ( "Error on ReadProcessMemory" );

}

 

PUCHAR pPrevServiceRecord = (unsigned char*)*

(PULONG)pServicesContext->m_OffsetFncList.m_fncGetOffset_Prev ( &amp;buffer[0] );

if ( pPrevServiceRecord )

{

bool bFound = LookupServicesDbRecordByAddr ( hProcess, pServiceDb, pServicesContext,

pPrevServiceRecord, &amp;pPrevServiceRecord );

if ( bFound )

{

InsertAfterPreviousRecord ( hProcess, pServicesContext, pServiceRecord,

pPrevServiceRecord );

return true;

}

}

 

PUCHAR pNextServiceRecord = (unsigned char*)*

(PULONG)pServicesContext->m_OffsetFncList.m_fncGetOffset_Next ( &amp;buffer[0] );

if ( pNextServiceRecord )

{

bool bFound = LookupServicesDbRecordByAddr ( hProcess, pServiceDb, pServicesContext,

pNextServiceRecord, &amp;pNextServiceRecord );

if ( bFound )

{

InsertBeforeNextRecord ( hProcess, pServicesContext, pServiceRecord,

pNextServiceRecord );

return true;

}

}

 

bool bFound = LookupServicesDbRecordByEnd ( hProcess, pServiceDb, pServicesContext,

&amp;pPrevServiceRecord );

if ( !bFound )

{

return false;

}

 

InsertAsLastRecord ( hProcess, pServicesContext, pServiceRecord, pPrevServiceRecord );

return true;

4. Structure of the project files

The source code of the usermode application which illustrates everything told here is in the archive attached.

Download sources.

5. References

Jeffrey Richter, Christophe Nasarre. Windows via C/C++. Especially the chapter devoted to the Virtual memory research.

About the Author

Eugene Wineblat is Senior Developer in Network Security Team of Apriorit Inc.
Apriorit is the provider of professional consulting and development services in advanced IT and SD fields.

Hide $7.99 BONUS: This edition includes a new afterword: Lights, Camera, Hide the movie! You have good reason to be afraid. . . . It was a case that haunts Bobby Dodge to this day—the case that nearly killed him and changed his life forever. Now, in an underground chamber on the grounds of an abandoned Massachusetts mental hospital, the gruesome discovery of six mummified corpses resurrects his worst nightmare: the return of a killer he thought dead and buried. There’s no place to run. . . . Bobby’s only lead is wrapped around a dead woman’s neck. Annabelle Granger has been in hiding for as long as she can remember. Her childhood was a blur of new cities and assumed identities. But what—or who—her family was running from, she never knew. Now a body is unearthed from a grave, wearing a necklace bearing Annabelle’s name, and the danger is too close to escape. This time, she’s not going to run. You know he will find you. . . . The new threat could be the dead psychopath’s copycat, his protégé—or something far more terrifying. Dodge knows the only way to find him is to solve the mystery of Annabelle Granger, and to do that he must team up with his former lover, partner, and friend D. D. Warren from the Boston P.D. But the trail leads back to a woman from Bobby’s past who may be every bit as dangerous as the new killer—a beautiful survivor-turned-avenger with an eerie link to Annabelle. From its tense opening pages to its shocking climax, Hide is a thriller that delves into our deepest, darkest fears. Where there is no one to trust. Where there is no place left to hide.

Timber Hide A Way - Large $13.99 Timber Hide-A-Way provides shelter, seclusion and security for your small animal friend. It is made from 100% Natural Timber and is an excellent addtion to any cage. Large and extra large Timber Hide-A-Way's are perfect for guinea pigs while extra large Timber Hide-A-Way's are perfect for rabbits. Size: 10" L x 8 1/4" W x 7" H

The Hide $10.99 The Hide

Timber Hide A Way - Small $3.99 This little hut makes an excellent hideaway for your small pet. Made from all-natural wood, it also provides some chewing fun, too The perfect size for hamsters, gerbils, and other small pets. Size: 4 1/4" x 4" x 3" high.

Timber Hide A Way - Medium $5.99 This little hut makes an excellent hideaway for your small pet. Made from all-natural wood, it also provides some chewing fun, too The perfect size for hamsters, gerbils, and other small pets. Size: 6 1/4" L x 5 1/4" W x 4 1/2" H

HIDE-A-WAY WATERFRONT COTTAGES $200 THE HIDEAWAY WATERFRONT COTTAGES ARE OPEN YEAR AROUND ANDOFFER QUAINT AND PRIVATE LAKEFRONT COTTAGES THAT ARE VERYCLEAN AND COMFORTABLE. THESE 2 BEDROOM COTTAGES HAVE FULLKITCHENS, FAMILY ROOMS WITH GAS BURNING FIREPLACES, QUEENSIZE BEDS, TRIPLE BUNK BEDS AND COVERED DECKS OVERLOOKINGLAKE VANARE. OUR GUEST ENJOY FREE USE OUR ROWBOATS, CANOES,PADDLEBOATS AND SANDY BEACH. EACH OF THE COTTAGES HAS ACAMPFIRE AREA WITH PICNIC TABLE AND CHARCOAL GRILL. OURLARGE LAKEFRONT COTTAGE HAS A LUXURY BATHROOM WITH AJACUZZI FOR 2 AND A 48 SHOWER WITH THREE SHOWERHEADS ANDIDEAL FOR A PRIVATE ROMANTIC RETREAT. THE LAKE GEORGE AREAHAS A WONDERFUL VARIETY OF RESTAURANTS AND OUTDOORACTIVITIES. YOU CAN CRUISE NEARBY LAKE GEORGE, HIKE ONE OFTHE MANY NEARBY MOUNTAIN TRAILS, RIDE ON THE BIKE TRAIL,RAFT THE WATERS OF SEVERAL MOUNTAIN RIVERS, ATTEND THELOCAL RODEO OR ONE OF OUR LOCAL DINNER THEATRES. JUST TONAME A FEW ACTIVITIES. OVERLOOK COTTAGE S3QOVERLOOK COTTAGE 1 QUEEN BED 1 SINGLE BED 1 DOUBLE BED GASFIRE PLACECOVE 1 2 S3Q2 BEDROOM COTTAGE 1 QUEEN BED 1 DOUBLE BED 1 SINGLE BED GASFIREPLACEHAVENS 2 DOUBLES S4D2 BEDROOM 2 DOUBLE BEDS AND 2 SINGLE BEDS GAS FIREPLACEHILL COTTAGE 1 QUEEN BED S1QHILL COTTAGE 1 QUEEN BED WITH A LAKE VIEWLAKEFRONT S2QLAKEFRONT COTTAGE 1 QUEEN AND A PULL OUT QUEEN COVERED DECK2 PERSON JACUZZI 3 HEAD SHOWERTHE B S S3QLAKE FRONT 2 BEDROOM COTTAGE WITH A QUEEN BED A DOUBLE BEDAND A SINGLE BED

Peters Rabbit Woven Grass Hide - A - Way - Hut $17.57 Woven grass hide a way hut is made of all natural grass and is safe to chew. Protects sensitive paws from wire bottom cages. Can be used inside and outside of cage. 100% All Natural Woven Grass Wicker. Dimensions (L x W x H): 9.5" x 7" x 7".

Peters Rabbit Grass Hide-A-Way Hut $7.99 Peters Woven Grass Hide-a-Way Hut Give your small animal a taste of the outdoors with Peters Hide-a-Way Hut. This is made of natural, woven grasses that your pet will love to chew and nest with. It's fun shape gives your pet a safe place to cozy up. Features: Ideal for rabbits and other small animals. Made of natural woven grass, which makes it safe for your pet to chew. Can be used as an extra sleeping area. Your pet can also pull apart and make their own nest! Item Specifications: Size: 7 1/2"L x 9"W x 7"H

Hide and Seek $12.99 Another sexy tale from a sultry new voice in erotic romance. Confident, freewheeling Maxim Cox has been thinking lately that something's been missing in his life. Then he sees his old college crush facing scandal in a tabloid and figures it out; it's Elisa Cross, the one who got away. Now he'll do anything it takes to have Elisa, in every way. To escape the scandal, Elisa has sworn off men and holed herself up in a cabin miles from anywhere. So when Maxim appears at her door in the middle of a snowstorm, she can't believe it. She swore she'd never give in to his devilish good looks, but the raging storm and her raging desires make him impossible to refuse. But Elisa's determined to keep the upper hand-and arranges a game of Hide and Seek. And if Maxim can play by her rules and find her, he can have her-all of her.

Peters Woven Grass - Hide-A-Way Hut $6.99 A comfortable escape from wire-bottomed cages and the hustle and bustle of the day, your rabbit or other small animal will enjoy some rest inside their very own Hide-a-Way Hut. Made from all-natural woven grasses, it's completely safe for a little chewing, as well. Use it outside your pet's cage for playtime fun, too. Size: Hut is 9.75" x 7.5" x 6.5" high, opening is 8.5" x 5.25" high.

Timber Hide A Way - X-Large $19.99 This little hut makes an excellent hideaway for your small pet. Made from all-natural wood, it also provides some chewing fun, too The perfect size for rabbits, guinea pigs, and other similar sized pets.

Clinton Element Series Hide-A-Way Cabinet $522.69 Features of the Clinton Element Series Hide-A-Way Cabinet: 5 independent, quick-change positions for holding your choice of exercise band (50 yds., hollow core center only) and/or tubing. Tubing spools sold separately (CLI-XP1010). Innovative design for storing cuff weights, dumbbells, exercise band/tubing and much more. Cabinet rests on the floor and must be secured to the wall. Mirror has polished edges with ANSI safety backing. 4 adjustable shelves. Holds up to 18 cuff weights, 10 dumbbells, 5 rolls of exercise band and/or tubing and much more. Width: 20.5". Height: 66". Depth: 7.5".

Rick Steves Hide A Way Tote Copper $19.95 This ultra-light stowable tote gives you that last minute shopping take-it-home solution. The Hide-Away Tote is huge and yet folds away to just 6" x 10" for easy packing. This zip-shut tote is cavernous(17«" x 16" x 7", over 1900 cubic inches), yet rolls up into a compact 6" x 10" pouch. The rugged little buddy that helps you to assemble a picnic, survive the laundromat, stow extra gear in the car trunk. The perfect bag for that giddy-last-minute-carry-on-shopping-spree.

Nowhere To Hide $9.56 Rated: RSynopsis: In a port city where violence abounds, a drug boss is viciously stabbed to death by the drug lord Chang Sungmin (Sung-Ki). Detective Woo (Joong-Hoon) is the cunning police detective who pursues the elusive Sungmin in a maze-like chase. Along the way, Woo and his men hunt down and apprehend the underworld mobsters and beautiful Juyon (Ji-Woo), Sungmin's lover. But Sungmin remains at large, a master of disguise and escape, until the final showdown with supreme detective Woo.

Nowhere to Hide $24.95 A new approach to help kids with ADHD and LD succeed in and outside the classroom This groundbreaking book addresses the consequences of the unabated stress associated with Learning disabilities and ADHD and the toxic, deleterious impact of this stress on kids' academic learning, social skills, behavior, and efficient brain functioning. Schultz draws upon three decades of work as a neuropsychologist, teacher educator, and school consultant to address this gap. This book can help change the way parents and teachers think about why kids with LD and ADHD find school and homework so toxic. It will also offer an abundant supply of practical, understandable strategies that have been shown to reduce stress at school and at home. Offers a new way to look at why kids with ADHD/LD struggle at school Provides effective strategies to reduce stress in kids with ADHD and LD Includes helpful rating scales, checklists, and printable charts to use at school and home This important resource is written by a faculty member of Harvard Medical School in the Department of Psychiatry and former classroom teacher.

Norway to Hide $5.99 Sure, Jackie Thum's newly published novel might not be Hemingway, but bad reviews from her fellow travelers have Emily Andrew's transgender ex-husband (Jackie was formerly Jack) steaming like a sauna. It's a dismal start to their Scandinavian tour, and group leader Emily is getting that sinking feeling in Helsinki: something fishy this way comes. When Jackie's most outspoken critic, a Floridian from a picture-perfect gated community called The Hamlets, is found dead, suspicion falls on Jackie -- who surprises everyone with an airtight alibi. But when another guest turns up dead, Emily realizes there is a killer hiding among them. Herrings, both red and pickled, abound on a Norwegian fjord cruise -- and Jackie is suddenly nowhere to be found. With her mother arranging a wedding disaster for Emily back home in Iowa, Emily must somehow salvage her nuptials from overseas while icing a killer -- before someone else meets a nasty Finnish.

Hide This Spanish Book Xtreme (Hide This Book Xtreme) $4.99 You've never learned a language like this before, fully uncensored and untamed! Compiled by a team of young, smart, trendsetting native speakers, the brand new Hide This Book Spanish Xtreme is a totally subversive way to pick up the language while learning about dating, the internet, iPods and other gadgets, style, travel, humor, and more. Get down and dirty with the hottest lingo, cheeky quizzes, wild language games, and cool cartoons and pictures. A Z-A organized anti-dictionary ensures users can quickly find a term or expression, or browse the amazing compilation of slang and current lingo. Also included is a link to download the corresponding audio online, so users can hear how the expressions are authentically said.

Hide and Seek First Words $12.99 This stunning new picture-and-word book features dozens of beautiful full-page photographs, each showing a collection of objects in a single category, such as sports, animals, clothing, and music. On every spread, children can play hide-and-seek, searching the main picture for specific objects that are named and pictured at the side. Along the way, they'll learn lots of new words and have fun discovering the surprises hidden in the pictures.

Sioux Tepee Made of Buffalo Hide Sewn with Sinew in the Traditional Way, Hill City, South Dakota $39.99 Sioux Tepee Made of Buffalo Hide Sewn with Sinew in the Traditional Way, Hill City, South Dakota - Giclee Print

Thirty Rooms to Hide in (Hardcover) $36.4 Author Luke Longstreet Sullivan has a simple way of describing his new memoir: ?It`s like The Shining . . . only funnier.? And as this astonishing account reveals, the comment is accurate. Thirty Rooms to Hide In tells the story of Sullivan`s father and his descent from being one of the world`s top orthopedic surgeons at the Mayo Clinic to a man who is increasingly abusive, alcoholic, and insane, ultimately dying alone on the floor of a Georgia motel. For his wife and six sons, the years prior to his death were years of turmoil, anger, and family dysfunction; but somehow, they were also a time of real happiness for Sullivan and his five brothers, full of dark humor and much laughter.Through the 1950s and 1960s, the six brothers had a wildly fun and thoroughly dysfunctional childhood living in a forbidding thirty-room mansion, known as the Millstone, on the outskirts of Rochester, Minnesota. The many rooms of the immense home, as well as their mother`s loving protection, allowed the Sullivan brothers to grow up as normal, mischievous boys. Against a backdrop of the times?the Cold War, the Cuban Missile Crisis, fallout shelters, JFK`s assassination, and the Beatles?the cracks in their home life and their father`s psyche continue to widen. When their mother decides to leave the Millstone and move the family across town, the Sullivan boys are able to find solace in each other and in rock `n` roll.As Thirty Rooms to Hide In follows the story of the Sullivan family?at times grim, at others poignant?there is a wonderful, dark humor that lifts the narrative. Tragic, funny, and powerfully evocative of the 1950s and 1960s, Thirty Rooms to Hide In is a tale of public success and private dysfunction, personal and familial resilience, and the strange power of humor to give refuge when it is needed most, even if it can`t always provide the answers.

Hide This French Book Xtreme $4.49 You've never learned a language like this before, fully uncensored and untamed! Compiled by a team of young, smart, trendsetting native speakers, the brand new Hide This Book French Xtreme is a totally subversive way to pick up the language while learning about dating, the internet, iPods and other gadgets, style, travel, humor, and more. Get down and dirty with the hottest lingo, cheeky quizzes, wild language games, and cool cartoons and pictures. A Z-A organized anti-dictionary ensures users can quickly find a term or expression, or browse the amazing compilation of slang and current lingo. Also included is a link to download the corresponding audio online, so users can hear how the expressions are authentically said.

Further Seems Forever - Hide Nothing $28.17 Track Listing: Light Up Ahead For All We Know Hide Nothing Already Gone Like Someone You Know Make It Apart All Rise Call On The Life Lead The Way Bleed

Hide from Evil $7.99 Like a chess master, he carefully weighs his next move . . . advancing slowly until he is sure he can capture his helpless pawn. For in his mind, there's no way to . . . HIDE FROM EVIL Sean Flynn should feel lucky he's alive. But a betrayal by a close friend-and two years on death row-has left him feeling only numb. When his conviction was overturned, Sean retreated to a quiet woodland cabin, far away from prying eyes. There, he believed, the past couldn't come back to haunt him . . . until she showed up. Overcome with guilt, Deputy Prosecuting Attorney Krista Slater can't forgive herself for convicting an innocent man. But when another brutal murder reveals chilling, new facts about his case, she must turn to Sean for help. She's ready to face his anger, but the desire in his eyes ignites a need she's never felt before. Shadowed by danger, Sean and Krista uncover a twisted maze of deception and betrayal-all under the dangerous gaze of a cunning mastermind who will do whatever it takes to keep his evil secrets safe.

Hide from Evil (Paperback) $16.44 Like a chess master, he carefully weighs his next move . . . advancing slowly until he is sure he can capture his helpless pawn. For in his mind, there`s no way to . . . HIDE FROM EVILSean Flynn should feel lucky he`s alive. But a betrayal by a close friend-and two years on death row-has left him feeling only numb. When his conviction was overturned, Sean retreated to a quiet woodland cabin, far away from prying eyes. There, he believed, the past couldn`t come back to haunt him . . . until she showed up.Overcome with guilt, Deputy Prosecuting Attorney Krista Slater can`t forgive herself for convicting an innocent man. But when another brutal murder reveals chilling, new facts about his case, she must turn to Sean for help. She`s ready to face his anger, but the desire in his eyes ignites a need she`s never felt before. Shadowed by danger, Sean and Krista uncover a twisted maze of deception and betrayal-all under the dangerous gaze of a cunning mastermind who will do whatever it takes to keep his evil secrets safe.

Hide Your Assets and Disappear $22.11 A New York Times andWall Street Journal bestseller!Are you tired of the way you're living? Are you fed up with everyone trying to take your most valuable possessions--your money and assets--away? Are you sick of having creditors, the IRS, or a vindictive ex-spouse nipping at your heels? If only you could disappear without a trace...if only you could resurface in some exotic foreign place with a whole new identity and a brand-spanking new life. And on the other side, how would you like to track down that ex (and his assets) who owesyou money? Want to know his tricks? For most people, this is just a fantasy. But it doesn't have to be. In Hide Your Assets and Disappear, one of the nation's top-ten-rated private investigators, Edmund J. Pankau, reveals all the tricks of his trade to show you how to hide it all or find someone who has. An experienced tracker who has worked for the government to recover missing assets, Pankau explains step-by-step how to successfully get away or find someone who has. Filled with vividreal-life stories of both successes and failures as well as an Internet research guide, this invaluable guide outlines exactly what you should know before you go, including the ever-increasing difficulties you will face as the world becomes more tightly linked through electronic networks. Pankau shows you how to pay attention to prevent slip-ups that can give you away, from birthday phone calls to magazine subscriptions to an off-the-cuff comment to a stranger. He prepares you logistically and psychologically to successfully make the transition to your new life and new self in a new world, and gives you the best information on how to go, where to go, how to live, how to behave, and even who to become once you get there. Should I keep my assets here or move them abroad? How do I create a new identity? How do I stay lost? Can I ever go back? How can I avoid anyone who might be looking for me? And how ...

Solar Light w/Hide a Key $14.99 This realistic-looking "rock" is a light and a place to hide keys. When closed, the two sections are held securely in place by 4 magnets. The solar panel at top converts sunlight into energy stored in the rechargeable battery (included) which illuminates the way after dark. Weatherproof high-impact polyresin includes 3 super-bright LEDs. On/off switch in base. 5"L x 4"W x 3"H.

Cory Morrow - Nothing Left to Hide $26.43 Disc 1:Heart of FireGood IntentionsBeat of Your HeartI Couldn`t Be ThereWhole Lot, ANothing Left to HideRestless GirlMy Way HomeChoicesBest LowCarnival Ride

Hide and Shriek #14 $5.99 The girls go on an overnight and share horror stories around the campfire. But it’s the one about Cropsy, the creepy old man who lives just outside the campgrounds and is known for torturing Lakeview campers, that hits closest to home. Especially when Chelsea leaves the group for a bathroom break in the woods and doesn’t return after 45 minutes. No sooner do her bunkmates go after her then do they realize they’ve completely lost their way and are now at the mercy of the evil Cropsy’s whims!