E语言ring0 inline &ssdt hook
驱动被无情杀害
源码留着没用
直接开源
代码不复杂
需要WINSDK
NtTerminateProcess ＝ 257
NtCreateDirectoryObject ＝ 34
NtLoadDriver ＝ 97
NtOpenKey ＝ 119
NtTerminateProcess_Index ＝ Index_Address (KeServiceDescriptorTablea, NtTerminateProcess)
NtCreateDirectoryObject_Index ＝ Index_Address (KeServiceDescriptorTablea, NtCreateDirectoryObject)
NtLoadDriver_Index ＝ Index_Address (KeServiceDescriptorTablea, NtLoadDriver)
NtOpenKey_Index ＝ Index_Address (KeServiceDescriptorTablea, NtOpenKey)
NtTerminateProcess_Address ＝ GetOldFunction (KeServiceDescriptorTablea, NtTerminateProcess)
NtCreateDirectoryObject_Address ＝ GetOldFunction (KeServiceDescriptorTablea, NtCreateDirectoryObject)
NtLoadDriver_Address ＝ GetOldFunction (KeServiceDescriptorTablea, NtLoadDriver)
NtOpenKey_Address ＝ GetOldFunction (KeServiceDescriptorTablea, NtOpenKey)
NtTerminateProcess_Proxy ＝ 分配内存 (Pool_type, 12, “viphaa”)
NtLoadDriver_Index_Proxy ＝ 分配内存 (Pool_type, 6, “viphaa”)
NtTerminateProcess_Index_Proxy ＝ 分配内存 (Pool_type, 6, “viphaa”)
Write_SSDT2 (&NewNtLoadDriver, NtLoadDriver_Index, NtLoadDriver_Index_Proxy)
Write_SSDT2 (&New_NtTerminateProcess, NtTerminateProcess_Index, NtTerminateProcess_Index_Proxy)
Write_Inline_Hook3 (NtTerminateProcess_Address, &New_NtTerminateProcess, NtTerminateProcess_Proxy)
Write_Inline_Hook2 (NtLoadDriver_Address, &NewNtLoadDriver)
Write_Inline_Hook2 (NtCreateDirectoryObject_Address, &New_NtCreateDirectoryObject)
Write_Inline_Hook2 (NtLoadDriver_Address, &NewNtLoadDriver)
Inline_ProcAddress (&DriverEntry, &New_DriverEntry)
Inline_ProcAddress (&DispatchClose, &New_DispathClose)
Inline_ProcAddress (&DispatchDeviceControl, &New_DispachDeviceControl)
Set_SSDT (&New_NtClose, NtClose)
Set_SSDT (&New_NtAllocateLocallyUniqueId, NtAllocateLocallyUniqueId)
Set_SSDT (&New_NtAllocateVirtualMemory, NtAllocateVirtualMemory)
Set_SSDT (&New_NtOpenKey, NtOpenKey_Index)
诅咒 360老总 。。
准备考试过后 全部ASM 我靠C部分也杀了
明天考试了 
未经作者允许 放在 其他BBS 尤其是E语言BBS 诅咒你
画圈圈中 。。。
