void HideDll()
{
    HMODULE hMod = ::GetModuleHandle("MyHook.dll"); 
    PLIST_ENTRY Head,Cur;
    PPEB_LDR_DATA ldr;
    PLDR_MODULE ldm;
    __asm
    {
        mov eax , fs:[0x30]
        mov ecx , [eax + 0x0c] //Ldr
        mov ldr , ecx
    }
    Head = &(ldr->InLoadOrderModuleList);
    Cur = Head->Flink;
    do
    {
        ldm = CONTAINING_RECORD( Cur, LDR_MODULE, InLoadOrderModuleList);
        //printf("EntryPoint [0x%X]\n",ldm->BaseAddress);
        if( hMod == ldm->BaseAddress)
         {
            ldm->InLoadOrderModuleList.Blink->Flink =
                ldm->InLoadOrderModuleList.Flink;
            ldm->InLoadOrderModuleList.Flink->Blink =
                ldm->InLoadOrderModuleList.Blink; 
            ldm->InInitializationOrderModuleList.Blink->Flink =
                ldm->InInitializationOrderModuleList.Flink;
            ldm->InInitializationOrderModuleList.Flink->Blink =
                ldm->InInitializationOrderModuleList.Blink;  
            ldm->InMemoryOrderModuleList.Blink->Flink =
                ldm->InMemoryOrderModuleList.Flink;
            ldm->InMemoryOrderModuleList.Flink->Blink =
                ldm->InMemoryOrderModuleList.Blink;  
            break;
         }
        Cur= Cur->Flink; 
     }while(Head != Cur);
}

相关文章:

  • 2021-11-21
  • 2021-12-18
  • 2022-12-23
  • 2022-12-23
  • 2022-01-08
  • 2022-12-23
  • 2022-12-23
  • 2022-12-23
猜你喜欢
  • 2022-12-23
  • 2022-02-05
  • 2022-12-23
  • 2021-07-23
  • 2022-02-20
  • 2022-12-23
  • 2021-12-25
相关资源
相似解决方案