断链隐藏dll

typedef struct _UNICODE_STRING
{
 USHORT Length;
 USHORT MaximumLength;
 PWSTR  Buffer;
} UNICODE_STRING,*PUNICODE_STRING;

typedef struct _PEB_LDR_DATA {
 ULONG                   Length;
 BOOLEAN                 Initialized;
 PVOID                   SsHandle;
 LIST_ENTRY              InLoadOrderModuleList;
 LIST_ENTRY              InMemoryOrderModuleList;
 LIST_ENTRY              InInitializationOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;

typedef struct _LDR_MODULE
{
 LIST_ENTRY          InLoadOrderModuleList;   //+0x00
 LIST_ENTRY          InMemoryOrderModuleList; //+0x08 
 LIST_ENTRY          InInitializationOrderModuleList; //+0x10
 void*               BaseAddress;  //+0x18
 void*               EntryPoint;   //+0x1c
 ULONG               SizeOfImage;
 UNICODE_STRING      FullDllName;
 UNICODE_STRING      BaseDllName;
 ULONG               Flags;
 SHORT               LoadCount;
 SHORT               TlsIndex;
 HANDLE              SectionHandle;
 ULONG               CheckSum;
 ULONG               TimeDateStamp;
} LDR_MODULE, *PLDR_MODULE;


void CMyHookDlg::HideDll()
{
 HMODULE hMod = ::GetModuleHandle("kernel.dll");
 PLIST_ENTRY Head,Cur;
 PPEB_LDR_DATA ldr;
 PLDR_MODULE ldm;
 __asm
 {
  mov eax , fs:[0x30]
  mov ecx , [eax + 0x0c] //Ldr
  mov ldr , ecx
 }
 Head = &(ldr->InLoadOrderModuleList);
 Cur = Head->Flink;
 do
 {
  ldm = CONTAINING_RECORD( Cur, LDR_MODULE, InLoadOrderModuleList);
  //printf("EntryPoint [0x%X]/n",ldm->BaseAddress);
  if( hMod == ldm->BaseAddress)
  {
   ldm->InLoadOrderModuleList.Blink->Flink =
    ldm->InLoadOrderModuleList.Flink;
   ldm->InLoadOrderModuleList.Flink->Blink =
    ldm->InLoadOrderModuleList.Blink;
   ldm->InInitializationOrderModuleList.Blink->Flink =
    ldm->InInitializationOrderModuleList.Flink;
   ldm->InInitializationOrderModuleList.Flink->Blink =
    ldm->InInitializationOrderModuleList.Blink; 
   ldm->InMemoryOrderModuleList.Blink->Flink =
    ldm->InMemoryOrderModuleList.Flink;
   ldm->InMemoryOrderModuleList.Flink->Blink =
    ldm->InMemoryOrderModuleList.Blink; 
   break;
  }
  Cur= Cur->Flink;
 }while(Head != Cur);
}

  • 0
    点赞
  • 3
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值