[驱动] 隐藏进程 驱动级 摘链 任务管理器看不到

闲着蛋疼写来玩玩练练手 没啥技术含量 只是个简单的摘链 任务管理器看不到

测试环境 Win7 x86

typedef struct 
{
	DWORD_PTR	EProcess;
	UCHAR*		ImageName;
	ULONG		ProcessID;
}_Process_Info;

NTSTATUS HideProcess()
{
	DWORD_PTR CurrentEProcess = (DWORD_PTR)PsGetCurrentProcess(); // 首先取到自身EPROCESS结构
	// EPROCESS + 0x16c = ImageFileName
	KdPrint(("SpriteDrv: Current Image File Name: %s\n", (UCHAR*)(CurrentEProcess + 0x16c)));

	// 取活动进程链表
	// EPROCESS + 0x16c ] + 0xb8 = ActiveProcessLinks
	PLIST_ENTRY pActiveProcessLinks = (LIST_ENTRY*)(CurrentEProcess + 0xb8);
	PLIST_ENTRY pNextPtr = pActiveProcessLinks->Flink;

	int count = 0;
	while (pNextPtr->Flink != pActiveProcessLinks->Flink) {

		_Process_Info ProcessInfo;

		ProcessInfo.EProcess = ((DWORD_PTR)pNextPtr - 0xb8);
		ProcessInfo.ImageName = (UCHAR*)(ProcessInfo.EProcess + 0x16c);
		ProcessInfo.ProcessID = *((ULONG*)(ProcessInfo.EProcess