断链隐藏其他驱动需要注意的是要用到之前借壳通信的知识
extern POBJECT_TYPE IoDriverObjectType;
NTSTATUS
ObReferenceObjectByName(
in PUNICODE_STRING ObjectName,
in ULONG Attributes,
in_opt PACCESS_STATE AccessState,
in_opt ACCESS_MASK DesiredAccess,
in POBJECT_TYPE ObjectType,
in KPROCESSOR_MODE AccessMode,
__inout_opt PVOID ParseContext,
__out PVOID Object
);
通过驱动名称获取驱动对象
代码
include<ntifs.h>
include<intrin.h>
extern POBJECT_TYPE IoDriverObjectType;
NTSTATUS
ObReferenceObjectByName(
in PUNICODE_STRING ObjectName,
in ULONG Attributes,
in_opt PACCESS_STATE AccessState,
in_opt ACCESS_MASK DesiredAccess,
in POBJECT_TYPE ObjectType,
in KPROCESSOR_MODE AccessMode,
__inout_opt PVOID ParseContext,
__out PVOID Object
);
typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
union
{
LIST_ENTRY HashLinks;
struct
{
PVOID SectionPointer;
ULONG CheckSum;
};
};
union
{
ULONG TimeDateStamp;
PVOID LoadedImports;
};
PVOID EntryPointActivationContext;
PVOID PatchInformation;
LIST_ENTRY ForwarderLinks;
LIST_ENTRY ServiceTagLinks;
LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
VOID DriverUnload(PDRIVER_OBJECT pDriverObject) {
DbgPrint("Unload Driver Success! ");
}
VOID HideDriver(PDRIVER_OBJECT pDriverObject) {
PLDR_DATA_TABLE_ENTRY HeaderNode = &((PLDR_DATA_TABLE_ENTRY)pDriverObject->DriverSection)->InLoadOrderLinks;
RemoveEntryList(HeaderNode);
pDriverObject->DriverSection = 0;
pDriverObject->Size = 0;
pDriverObject->Type = 0;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath) {
DbgPrint("Load Driver Success!");
//设备名称
UNICODE_STRING uDrivername = { 0 };
//初始化设备名称
RtlInitUnicodeString(&uDrivername, L"\Driver\MyDriver2");
//设置驱动对象
PDRIVER_OBJECT pDriverObject1 = NULL;
//获取驱动对象->借壳通信
NTSTATUS ntSTATUS = ObReferenceObjectByName(&uDrivername, OBJ_CASE_INSENSITIVE, NULL, FILE_ALL_ACCESS, *IoDriverObjectType, KernelMode, NULL, &pDriverObject1);
if (!NT_SUCCESS(ntSTATUS))
{
DbgPrint("%x", ntSTATUS);
}
if (pDriverObject1)
{
ObDereferenceObject(pDriverObject1);//失败后关闭驱动对象引用
}
HideDriver(pDriverObject1);
return STATUS_SUCCESS;
}
我们现在不需要挂系统线程进行驱动隐藏,我们直接封装成函数,通过RemoveEntryList的API进行删除,在删除之前通过ObReferenceObjectByName获取驱动对象
没有启动“隐藏驱动”

我们可以看到自己的驱动
启动“隐藏驱动”

Driver2已经被隐藏,现在只有自己的Driver4