Skip To Main Content
PVOID Base on Muck Rack

PVOID Base

As seen in: CSDN
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work. Claim your profile

Get in touch with PVOID

Contact PVOID, search articles and posts on X, monitor coverage, and track replies from one place.

Learn more about Muck Rack

Actions

Share this page

Is this you?

As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile

Articles

驱动开发：内核无痕隐藏自身分析_驱动隐藏_孤风洗剑的博客-CSDN博客

|
By PVOID Base, ULONG Size, ULONG Flags, Ushort LoadOrder Index
| CSDN
在笔者前面有一篇文章《驱动开发：断链隐藏驱动程序自身》通过摘除驱动的链表实现了断链隐藏自身的目的，但此方法恢复时会触发PG会蓝屏，偶然间在网上找到了一个作者介绍的一种方法，觉得有必要详细分析一下他是如何实现的进程隐藏的，总体来说作者的思路是最终寻找到MiProcessLoaderEntry的入口地址，该函数的作用是将驱动信息加入链表和移除链表，运用这个函数即可动态处理驱动的添加和移除问题。 MiProcessLoaderEntry(pDriverObject->DriverSection, 1) 添加 MiProcessLoaderEntry(pDriverObject->DriverSection, 0) 移除 那么如何找到MiProcessLoaderEntry函数入口地址就是下一步的目标，寻找入口可以总结为； 1.寻找MmUnloadSystemImage函数地址，可通过MmGetSystemRoutineAddress函数得到。 2.在MmUnloadSystemImage里面寻找MiUnloadSystemImage函数地址。...
Open in Who Shared Issue with article?
See all 1 articles