驱动开发与系统原理-驱动断链隐藏

大理寺少卿

补充

pDriverObject->DriverSection实际指向的是下面这个结构，但是微软并没有导出该结构体，需要我们自己定义使用

typedef struct _LDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; LIST_ENTRY InMemoryOrderLinks; LIST_ENTRY InInitializationOrderLinks; PVOID DllBase; PVOID EntryPoint; ULONG SizeOfImage; UNICODE_STRING FullDllName; UNICODE_STRING BaseDllName; ULONG Flags; USHORT LoadCount; USHORT TlsIndex; union { LIST_ENTRY HashLinks; struct { PVOID SectionPointer; ULONG CheckSum; }; }; union { ULONG TimeDateStamp; PVOID LoadedImports; }; PVOID EntryPointActivationContext; PVOID PatchInformation; LIST_ENTRY ForwarderLinks; LIST_ENTRY ServiceTagLinks; LIST_ENTRY StaticLinks; } LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY; 操作

驱动也是一个双向链表，我们可以效仿之前断链隐藏进程的方式进行断链

但是我们在断链该驱动的时候，需要将该驱动对象的相关属性进行重置设置，如果直接置0，会发生蓝屏，因为我们正在使用该驱动

因此我们可以挂一个系统线程，对该驱动进行操作

include<ntifs.h>

include<intrin.h>

typedef struct _LDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; LIST_ENTRY InMemoryOrderLinks; LIST_ENTRY InInitializationOrderLinks; PVOID DllBase; PVOID EntryPoint; ULONG SizeOfImage; UNICODE_STRING FullDllName; UNICODE_STRING BaseDllName; ULONG Flags; USHORT LoadCount; USHORT TlsIndex; union { LIST_ENTRY HashLinks; struct { PVOID SectionPointer; ULONG CheckSum; }; }; union { ULONG TimeDateStamp; PVOID LoadedImports; }; PVOID EntryPointActivationContext; PVOID PatchInformation; LIST_ENTRY ForwarderLinks; LIST_ENTRY ServiceTagLinks; LIST_ENTRY StaticLinks; } LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;

VOID DriverUnload(PDRIVER_OBJECT pDriverObject) {

DbgPrint("Unload Driver Success! ");

} VOID ThreadCallBackHide(PVOID Context) { PDRIVER_OBJECT pDriverObject = Context; PLDR_DATA_TABLE_ENTRY HeaderNode = &((PLDR_DATA_TABLE_ENTRY)pDriverObject->DriverSection)->InLoadOrderLinks; RemoveEntryList(HeaderNode); pDriverObject->DriverSection = 0;//对驱动中的一些属性进行重置操作 pDriverObject->Size = 0; pDriverObject->Type = 0; }

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath) { DbgPrint("Load Driver Success!"); HANDLE hThread = NULL; PsCreateSystemThread(&hThread, THREAD_ALL_ACCESS, NULL, NULL, NULL, ThreadCallBackHide, pDriverObject); return STATUS_SUCCESS; } 由于我们隐藏了该驱动，所以我们的卸载函数就会失效，同时PCHUNTER也检测不到该驱动

未加载

已加载

lou879

66666666666

YINXN

谢谢分享支持楼主