windows10驱动 x64--- 驱动实现隐藏驱动模块（五）

本文链接：https://blog.csdn.net/weixin_41725706/article/details/127806538

本文介绍了如何在Windows驱动程序中实现驱动模块的隐藏，通过遍历LDR_DATA_TABLE_ENTRY结构体的双链表，修改链接字段来达到隐藏指定驱动的目的。在驱动加载前后对比，展示了驱动隐藏的效果。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

驱动实现隐藏驱动模块（五）

原理
驱动代码 --- 0环
总结

原理

每个驱动DriverObject->DriverSection存着个结构体LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG64 SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
}
双链表遍历前面已经文章已经很多次了

驱动代码 — 0环

#include "ntifs.h"
#include<wdm.h>

//extern PEPROCESS PsInitialSystemProcess;
NTSTATUS DriverUnload(PDRIVER_OBJECT DriverObject)
{
	DbgPrint("Driver Exit \r\n");
	return STATUS_SUCCESS;

}
typedef struct LDR_DATA_TABLE_ENTRY
{
	LIST_ENTRY InLoadOrderLinks;
	LIST_ENTRY InMemoryOrderLinks; 
	LIST_ENTRY InInitializationOrderLinks;
	PVOID DllBase;
	PVOID EntryPoint;
	ULONG64 SizeOfImage;
	UNICODE_STRING FullDllName;
	UNICODE_STRING BaseDllName;

}DriverSectionObject, * pDriverSectionObject;



NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Regedit)
{
	
	pDriverSectionObject SectionObject = (pDriverSectionObject)DriverObject->DriverSection;
	PLIST_ENTRY bmpDriverList = (PLIST_ENTRY)SectionObject->InLoadOrderLinks.Flink;

	SectionObject = (pDriverSectionObject)bmpDriverList;

	pDriverSectionObject tmpSectionObject = SectionObject;


	UNICODE_STRING UniString1;
	WCHAR* string1 = L"MyDriverHello.sys";
	RtlInitUnicodeString(&UniString1,string1);
	DbgPrint("DriverName:%wZ\n", &UniString1);

	//遍历内核驱动
	for (;;)
	{
		bmpDriverList = bmpDriverList->Flink;
		SectionObject = (pDriverSectionObject)bmpDriverList;
		DbgPrint("DriverName:%wZ\n", &SectionObject->BaseDllName);
		RtlEqualUnicodeString(&SectionObject->BaseDllName, &UniString1, TRUE);
		//相等等于1  不相等为 0 返回是char类型
		if (tmpSectionObject == SectionObject)
		{
			DbgPrint("结尾了");
			break;
		}
		if(RtlEqualUnicodeString(&SectionObject->BaseDllName,&UniString1,TRUE))

		{
		
			//内核驱动隐藏
			bmpDriverList->Flink->Blink = bmpDriverList->Blink;
			bmpDriverList->Blink->Flink = bmpDriverList->Flink;
			//过滤掉头指针 重新遍历
			bmpDriverList = bmpDriverList->Flink;
			for (;;)
			{
				bmpDriverList = bmpDriverList->Flink;
				SectionObject = (pDriverSectionObject)bmpDriverList;
				DbgPrint("DriverName:%wZ\n", &SectionObject->BaseDllName);
				RtlEqualUnicodeString(&SectionObject->BaseDllName, &UniString1, TRUE);
				if (tmpSectionObject == SectionObject)
				{
					DbgPrint("结尾了");
					break;
				}
			}
			break;

		}
	
	}





	DriverObject->DriverUnload = DriverUnload;
	return STATUS_SUCCESS;
}