驱动开发与系统原理-断链隐藏其他驱动

大理寺少卿

断链隐藏其他驱动需要注意的是要用到之前借壳通信的知识

extern POBJECT_TYPE IoDriverObjectType; NTSTATUS ObReferenceObjectByName( in PUNICODE_STRING ObjectName, in ULONG Attributes, in_opt PACCESS_STATE AccessState, in_opt ACCESS_MASK DesiredAccess, in POBJECT_TYPE ObjectType, in KPROCESSOR_MODE AccessMode, __inout_opt PVOID ParseContext, __out PVOID Object ); 通过驱动名称获取驱动对象

代码

include<ntifs.h>

include<intrin.h>

extern POBJECT_TYPE IoDriverObjectType; NTSTATUS ObReferenceObjectByName( in PUNICODE_STRING ObjectName, in ULONG Attributes, in_opt PACCESS_STATE AccessState, in_opt ACCESS_MASK DesiredAccess, in POBJECT_TYPE ObjectType, in KPROCESSOR_MODE AccessMode, __inout_opt PVOID ParseContext, __out PVOID Object ); typedef struct _LDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; LIST_ENTRY InMemoryOrderLinks; LIST_ENTRY InInitializationOrderLinks; PVOID DllBase; PVOID EntryPoint; ULONG SizeOfImage; UNICODE_STRING FullDllName; UNICODE_STRING BaseDllName; ULONG Flags; USHORT LoadCount; USHORT TlsIndex; union { LIST_ENTRY HashLinks; struct { PVOID SectionPointer; ULONG CheckSum; }; }; union { ULONG TimeDateStamp; PVOID LoadedImports; }; PVOID EntryPointActivationContext; PVOID PatchInformation; LIST_ENTRY ForwarderLinks; LIST_ENTRY ServiceTagLinks; LIST_ENTRY StaticLinks; } LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;

VOID DriverUnload(PDRIVER_OBJECT pDriverObject) {

DbgPrint("Unload Driver Success! ");

} VOID HideDriver(PDRIVER_OBJECT pDriverObject) { PLDR_DATA_TABLE_ENTRY HeaderNode = &((PLDR_DATA_TABLE_ENTRY)pDriverObject->DriverSection)->InLoadOrderLinks; RemoveEntryList(HeaderNode); pDriverObject->DriverSection = 0; pDriverObject->Size = 0; pDriverObject->Type = 0; }

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath) { DbgPrint("Load Driver Success!"); //设备名称 UNICODE_STRING uDrivername = { 0 }; //初始化设备名称 RtlInitUnicodeString(&uDrivername, L"\Driver\MyDriver2"); //设置驱动对象 PDRIVER_OBJECT pDriverObject1 = NULL; //获取驱动对象->借壳通信 NTSTATUS ntSTATUS = ObReferenceObjectByName(&uDrivername, OBJ_CASE_INSENSITIVE, NULL, FILE_ALL_ACCESS, *IoDriverObjectType, KernelMode, NULL, &pDriverObject1); if (!NT_SUCCESS(ntSTATUS)) { DbgPrint("%x", ntSTATUS); } if (pDriverObject1) { ObDereferenceObject(pDriverObject1);//失败后关闭驱动对象引用 } HideDriver(pDriverObject1); return STATUS_SUCCESS; } 我们现在不需要挂系统线程进行驱动隐藏，我们直接封装成函数，通过RemoveEntryList的API进行删除，在删除之前通过ObReferenceObjectByName获取驱动对象

没有启动“隐藏驱动”

我们可以看到自己的驱动

启动“隐藏驱动”

Driver2已经被隐藏，现在只有自己的Driver4

YINXN

谢谢分享

AO1199

历害！！

woshuox

非常好教程