驱动实现隐藏驱动模块(五)
原理
每个驱动DriverObject->DriverSection存着个结构体LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG64 SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
}
双链表遍历前面已经文章已经很多次了
驱动代码 — 0环
#include "ntifs.h"
#include<wdm.h>
//extern PEPROCESS PsInitialSystemProcess;
NTSTATUS DriverUnload(PDRIVER_OBJECT DriverObject)
{
DbgPrint("Driver Exit \r\n");
return STATUS_SUCCESS;
}
typedef struct LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG64 SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
}DriverSectionObject, * pDriverSectionObject;
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Regedit)
{
pDriverSectionObject SectionObject = (pDriverSectionObject)DriverObject->DriverSection;
PLIST_ENTRY bmpDriverList = (PLIST_ENTRY)SectionObject->InLoadOrderLinks.Flink;
SectionObject = (pDriverSectionObject)bmpDriverList;
pDriverSectionObject tmpSectionObject = SectionObject;
UNICODE_STRING UniString1;
WCHAR* string1 = L"MyDriverHello.sys";
RtlInitUnicodeString(&UniString1,string1);
DbgPrint("DriverName:%wZ\n", &UniString1);
//遍历内核驱动
for (;;)
{
bmpDriverList = bmpDriverList->Flink;
SectionObject = (pDriverSectionObject)bmpDriverList;
DbgPrint("DriverName:%wZ\n", &SectionObject->BaseDllName);
RtlEqualUnicodeString(&SectionObject->BaseDllName, &UniString1, TRUE);
//相等等于1 不相等为 0 返回是char类型
if (tmpSectionObject == SectionObject)
{
DbgPrint("结尾了");
break;
}
if(RtlEqualUnicodeString(&SectionObject->BaseDllName,&UniString1,TRUE))
{
//内核驱动隐藏
bmpDriverList->Flink->Blink = bmpDriverList->Blink;
bmpDriverList->Blink->Flink = bmpDriverList->Flink;
//过滤掉头指针 重新遍历
bmpDriverList = bmpDriverList->Flink;
for (;;)
{
bmpDriverList = bmpDriverList->Flink;
SectionObject = (pDriverSectionObject)bmpDriverList;
DbgPrint("DriverName:%wZ\n", &SectionObject->BaseDllName);
RtlEqualUnicodeString(&SectionObject->BaseDllName, &UniString1, TRUE);
if (tmpSectionObject == SectionObject)
{
DbgPrint("结尾了");
break;
}
}
break;
}
}
DriverObject->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}
总结
隐藏驱动–>MyDriverHello.sys
驱动加载前:可以看到MyDriverHello.sys
驱动加载后:看不到MyDriverHello.sys