内核驱动隐藏【绕过PatchGuard】

---

心血来潮_{测试隐藏驱动还不触发PG，看看有探讨的同学不}

---

1. 断链 //你可能会随时会看到一个蓝色的屏幕！
2. 直接MiProcessLoaderEntry //跟断链没有太大区别，但是在测试中，不会见到蓝色的屏幕，同时SEH异常处理也失效！
3. 现在操作的就是使用MiProcessLoaderEntry来处理！

关键步骤如下：

1.驱动入口调用IoRegisterDriverReinitialization函数原型如下

void IoRegisterDriverReinitialization(
  _in_           PDRIVER_OBJECT       DriverObject,
  _in_           PDRIVER_REINITIALIZE DriverReinitializationRoutine,
  _in_, optional_ PVOID                Context
);

2.处理操作如下：

typedef NTSTATUS(__fastcall* _MiProcessLoaderEntry)(PVOID pDriverSection, BOOLEAN bool_);
typedef struct _LDR_DATA_TABLE_ENTRY {
	LIST_ENTRY InLoadOrderLinks;
	LIST_ENTRY InMemoryOrderLinks;
	LIST_ENTRY InInitializationOrderLinks;
	PVOID DllBase;
	PVOID EntryPoint;
	ULONG SizeofImage;
	UNICODE_STRING FullDllName;
	UNICODE_STRING BaseDllName;
	ULONG Flags;
	USHORT LoadCount;
	USHORT TlsIndex;
	PVOID SectionPointer;
	ULONG CheckSum;
	PVOID LoadedImports;
	LIST_ENTRY64 ForwardweLinks;
	LIST_ENTRY64 ServiceTaLinks;
	LIST_ENTRY64 sTATIClINKS;
	PVOID ContextInformation;
	LARGE_INTEGER LoadTime;
}LDR_DATA_TABLE_ENTRY, * P_LDR_DATA_TABLE_ENTRY;

VOID DriverReinitializationRoutine(PDRIVER_OBJECT pDriverObject, PVOID Context, ULONG Count){
	_MiProcessLoaderEntry MiProcessLoaderEntry = NULL;
	MiProcessLoaderEntry(pDriverObject->DriverSection, FALSE);
	P_LDR_DATA_TABLE_ENTRY LdrEntry = (P_LDR_DATA_TABLE_ENTRY)pDriverObject->DriverSection;
	InitializeListHead(&LdrEntry->InLoadOrderLinks);
	InitializeListHead(&LdrEntry->InMemoryOrderLinks);
	p->DriverUnload = NULL;
	p->DriverInit = NULL;
	p->DriverSize = NULL;
	p->DriverStart = NULL;
	p->DeviceObject = NULL;
	p->DriverSection = NULL;
}

经过上方一系列操作后，任何工具都无法看到驱动的加载，当然也是正常运行的！
正常通讯！