驱动的遍历和隐藏

DRIVER_OBJECT

0: kd> dt _DRIVER_OBJECT
nt!_DRIVER_OBJECT
   +0x000 Type             : Int2B
   +0x002 Size             : Int2B
   +0x008 DeviceObject     : Ptr64 _DEVICE_OBJECT
   +0x010 Flags            : Uint4B
   +0x018 DriverStart      : Ptr64 Void
   +0x020 DriverSize       : Uint4B
   +0x028 DriverSection    : Ptr64 Void
   +0x030 DriverExtension  : Ptr64 _DRIVER_EXTENSION
   +0x038 DriverName       : _UNICODE_STRING
   +0x048 HardwareDatabase : Ptr64 _UNICODE_STRING
   +0x050 FastIoDispatch   : Ptr64 _FAST_IO_DISPATCH
   +0x058 DriverInit       : Ptr64     long 
   +0x060 DriverStartIo    : Ptr64     void 
   +0x068 DriverUnload     : Ptr64     void 
   +0x070 MajorFunction    : [28] Ptr64     long 

LDR_DATA_TABLE_ENTRY

0: kd> dt _LDR_DATA_TABLE_ENTRY
nt!_LDR_DATA_TABLE_ENTRY
   +0x000 InLoadOrderLinks : _LIST_ENTRY
   +0x010 InMemoryOrderLinks : _LIST_ENTRY
   +0x020 InInitializationOrderLinks : _LIST_ENTRY
   +0x030 DllBase          : Ptr64 Void
   +0x038 EntryPoint       : Ptr64 Void
   +0x040 SizeOfImage      : Uint4B
   +0x048 FullDllName      : _UNICODE_STRING
   +0x058 BaseDllName      : _UNICODE_STRING
   +0x068 Flags            : Uint4B
   +0x06c LoadCount        : Uint2B
   +0x06e TlsIndex         : Uint2B
   +0x070 HashLinks        : _LIST_ENTRY
   +0x070 SectionPointer   : Ptr64 Void
   +0x078 CheckSum         : Uint4B
   +0x080 TimeDateStamp    : Uint4B
   +0x080 LoadedImports    : Ptr64 Void
   +0x088 EntryPointActivationContext : Ptr64 _ACTIVATION_CONTEXT
   +0x090 PatchInformation : Ptr64 Void
   +0x098 ForwarderLinks   : _LIST_ENTRY
   +0x0a8 ServiceTagLinks  : _LIST_ENTRY
   +0x0b8 StaticLinks      : _LIST_ENTRY
   +0x0c8 ContextInformation : Ptr64 Void
   +0x0d0 OriginalBase     : Uint8B
   +0x0d8 LoadTime         : _LARGE_INTEGER

#include <ntddk.h>

//卸载函数
VOID DriverUnload(PDRIVER_OBJECT driver)
{
	DbgPrint("驱动程序停止运行了.\r\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING reg_path)
{
	PLIST_ENTRY DriverList = NULL;
	PLIST_ENTRY NextList = NULL;
	UNICODE_STRING usDriverName;
	PUNICODE_STRING pusDriverName = NULL;
	RtlInitUnicodeString(&usDriverName, L"ntoskrnl.exe");
	DriverList = (PLIST_ENTRY)pDriver->DriverSection;
	NextList = DriverList;
	do 
	{
		//0x58 DriverInit
		pusDriverName = (PUNICODE_STRING)((ULONG64)NextList + 0x58);
		//DbgPrint("%wZ", &pusDriverName);
		if (!RtlCompareUnicodeString(&usDriverName, pusDriverName,TRUE))
		{
			DbgPrint("%wZ", &pusDriverName);
			DbgPrint("0x%X", (ULONG64)NextList);
			return STATUS_SUCCESS;
		}
		NextList = NextList->Flink;
	} while (NextList != DriverList);

	pDriver->DriverUnload = DriverUnload;
	return STATUS_SUCCESS;
}

在Ring0 fs指向KPCR 在Ring3 指向TEB
在x64中，ntoskerl BaseFullName为ntkrnlpa.exe FullDllName为ntoskrnl.exe 所以，获取名称时尽量使用FullDllName