LDR断链隐藏DLL（转载）

最新推荐文章于 2024-07-25 11:55:38 发布

Shirley068

最新推荐文章于 2024-07-25 11:55:38 发布

阅读量1k

点赞数

原文链接：https://blog.csdn.net/yoie01/article/details/11696295

版权

    typedef struct _LSA_UNICODE_STRING {
       USHORT Length;
       USHORT MaximumLength;
       PWSTR Buffer;}
    UNICODE_STRING, *PUNICODE_STRING;

    typedef struct _PEB_LDR_DATA
    {
       DWORD Length; // +0x00
       bool Initialized; // +0x04
       PVOID SsHandle; // +0x08
       LIST_ENTRY InLoadOrderModuleList; // +0x0c
       LIST_ENTRY InMemoryOrderModuleList; // +0x14
       LIST_ENTRY InInitializationOrderModuleList;// +0x1c
    } PEB_LDR_DATA,*PPEB_LDR_DATA; // +0x24

    typedef struct _LDR_MODULE
    {
       LIST_ENTRY          InLoadOrderModuleList;
       LIST_ENTRY          InMemoryOrderModuleList;
       LIST_ENTRY          InInitializationOrderModuleList;
       void*               BaseAddress;
       void*               EntryPoint;
       ULONG               SizeOfImage;
       UNICODE_STRING   FullDllName;
       UNICODE_STRING      BaseDllName;
       ULONG               Flags;
       SHORT               LoadCount;
       SHORT               TlsIndex;
       HANDLE              SectionHandle;
       ULONG               CheckSum;
       ULONG               TimeDateStamp;
    } LDR_MODULE, *PLDR_MODULE;

    //需要隐藏的DLL句柄
    void hide_module(HMODULE hMod)
    {
       PLIST_ENTRY Head,Cur;
       PPEB_LDR_DATA ldr;
       PLDR_MODULE ldm;
       __asm
       {
           mov eax , fs:[0x30]
           mov ecx , [eax + 0x0c] //Ldr
           mov ldr , ecx
       }
       Head = &(ldr->InLoadOrderModuleList);
       Cur = Head->Flink;
       do
       {
           ldm = CONTAINING_RECORD( Cur, LDR_MODULE, InLoadOrderModuleList);
           if( hMod == ldm->BaseAddress)
           {
               ldm->InLoadOrderModuleList.Blink->Flink =
               ldm->InLoadOrderModuleList.Flink;
               ldm->InLoadOrderModuleList.Flink->Blink =
               ldm->InLoadOrderModuleList.Blink;
               ldm->InInitializationOrderModuleList.Blink->Flink =
               ldm->InInitializationOrderModuleList.Flink;
               ldm->InInitializationOrderModuleList.Flink->Blink =
               ldm->InInitializationOrderModuleList.Blink;
               ldm->InMemoryOrderModuleList.Blink->Flink =
               ldm->InMemoryOrderModuleList.Flink;
               ldm->InMemoryOrderModuleList.Flink->Blink =
               ldm->InMemoryOrderModuleList.Blink;
               break;
           }
           Cur= Cur->Flink;
       }while(Head != Cur);
    }

直接拿去就可用

引用下windows头就可以了
---------------------
版权声明：本文为CSDN博主「Yoie」的原创文章，遵循CC 4.0 by-sa版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/yoie01/article/details/11696295