Skip to content

gmh5225/HideDriver-MiProcessLoaderEntry

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 

Repository files navigation

HideDriver

Hide Driver,win7*64

  • 先通过EtwWriteString找MiProcessLoaderEntry函数 (first using EtwWriteString find for MiProcessLoaderEntry funciton)
  • 用MiProcessLoaderEntry移除DriverObject->DriverSection(直接断链会遭遇PG) (use MiProcessLoaderEntry remove DriverObject->DriverSection dont straight set DriverObject->DriverSection. u got be BSOD 109)
  • 然后抹去Driver特征,有个问题,不能在DriverEntry中抹除驱动特征,所以开了个线程,当发现驱动加载完毕的时候就去抹除特征。 (remove driver information)

About

Hide Driver,win7*64

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • C 100.0%