驱动断链 修改模块信息实现隐藏

#include "ntddk.h"
HANDLE hThread;
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
	DbgPrint("驱动卸载成功\n");
}

VOID ThreadRun(
	 PVOID StartContext)
{
	LARGE_INTEGER times;
	PDRIVER_OBJECT pDriverObject;
	times.QuadPart = -30 * 1000 * 1000;  //等待3秒  单位是纳秒
	
	KeDelayExecutionThread(KernelMode, FALSE, &times);
	pDriverObject=(PDRIVER_OBJECT)StartContext;
	//修改模块信息
	pDriverObject->DriverSize = 0;
	pDriverObject->DriverSection = NULL;
	pDriverObject->DriverExtension = NULL;
	pDriverObject->DriverStart = NULL;
	pDriverObject->DriverInit = NULL;
	pDriverObject->FastIoDispatch = NULL;
	pDriverObject->DriverStartIo = NULL;
	
	ZwClose(hThread);
}


NTSTATUS	DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pReg)
{
	PLIST_ENTRY pModuleList;
	pModuleList = pDriverObject->DriverSection;
	
	//前一个模块的Flink=本模块的Flink
	pModuleList->Blink->Flink = pModuleList->Flink;
	//前一个模块的Blink=本模块的Blink
	pModuleList->Flink->Blink = pModuleList->Blink;
	PsCreateSystemThread(&hThread,GENERIC_ALL,NULL,NULL,NULL, ThreadRun, pDriverObject);
	return 0;
}

卸载操作
HOOK IopCompleteUnloadOrDelete驱动卸载函数 在卸载时，恢复修改掉的值，才能正确卸载。