feat add protect list

2026-06-03 10:03:26 +08:00
parent 93417ef728
commit 762cedc015
10 changed files with 163 additions and 10 deletions
@@ -11,8 +11,23 @@ namespace load_image_notify_routine
 		UNREFERENCED_PARAMETER(ProcessId);
 		UNREFERENCED_PARAMETER(ImageInfo);

-		if(FullImageName->Buffer)
-			DbgPrintEx(77, 0, "[+] %ws\n", FullImageName->Buffer);
+		if (FullImageName->Buffer)
+		{
+
+			if (wcsstr(FullImageName->Buffer, L"MyDriver1"))
+			{
+				DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
+
+				ZwUnmapViewOfSection(PsGetCurrentProcess(), ImageInfo->ImageBase);
+
+			}
+
+			
+
+		}
+			
+
+
 		
 	}