43 lines
1.3 KiB
C++
43 lines
1.3 KiB
C++
#include "ob_reg_callback.h"
|
|
#include "create_thread_callback.h"
|
|
#include "process_notify_callback.h"
|
|
#include "load_Image_callback.h"
|
|
#include "protect_filter.h"
|
|
#include "comm.h"
|
|
#include "inline_hooks.h"
|
|
#include "mouse_keybord_hook.h"
|
|
#include "ssdt.h"
|
|
|
|
|
|
EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
|
|
{
|
|
if (drv_obj)
|
|
{
|
|
drv_obj->DriverUnload = [](PDRIVER_OBJECT)
|
|
{
|
|
kernel_comm_create::remove();
|
|
//ob_call_back::uninstall_ob_callback();
|
|
process_notify_callback::remov_process_notify();
|
|
thread_notify_routine::unload_thread_routine();
|
|
|
|
//load_image_notify_routine::remove_image_load_notify_routine();
|
|
};
|
|
}
|
|
|
|
protect_filter::Init();
|
|
kernel_api::kernel_api_init();
|
|
kernel_comm_create::Init();
|
|
|
|
//把保护的进程插入到链表中
|
|
//protect_filter::add_protect_list(12204, 0, FALSE);
|
|
|
|
//mouse_keybord_hook::install_mouse_keybord_hook();
|
|
DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
|
|
DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify());
|
|
DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
|
|
|
|
|
|
//我过滤了那个任务管理器 所以看不了结束进程效果 直接看能不能读搜索就行了 没有图标吧
|
|
//也搜索不了 我这个就是内存加载 也不会蓝屏啊
|
|
return STATUS_SUCCESS;
|
|
} |