├── .gitignore ├── KillDriverProtect.sln ├── KillDriverProtect ├── Driver.c ├── Helper.c ├── Helper.h ├── KillDriverProtect.inf ├── KillDriverProtect.vcxproj ├── KillDriverProtect.vcxproj.filters ├── KillDriverProtect.vcxproj.user ├── KillFsFilter.c ├── KillFsFilter.h ├── KillRegFilter.c └── KillRegFilter.h └── README.md /.gitignore: -------------------------------------------------------------------------------- 1 | /.vs 2 | /Release 3 | /x64 4 | /KillDriverProtect/Release 5 | /KillDriverProtect/x64 6 | -------------------------------------------------------------------------------- /KillDriverProtect.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.28307.1433 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "KillDriverProtect", "KillDriverProtect\KillDriverProtect.vcxproj", "{C13FA071-EEB9-4325-811A-CF70B1553C95}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|ARM = Debug|ARM 11 | Debug|ARM64 = Debug|ARM64 12 | Debug|x64 = Debug|x64 13 | Debug|x86 = Debug|x86 14 | Release|ARM = Release|ARM 15 | Release|ARM64 = Release|ARM64 16 | Release|x64 = Release|x64 17 | Release|x86 = Release|x86 18 | EndGlobalSection 19 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 20 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Debug|ARM.ActiveCfg = Debug|ARM 21 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Debug|ARM.Build.0 = Debug|ARM 22 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Debug|ARM.Deploy.0 = Debug|ARM 23 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Debug|ARM64.ActiveCfg = Debug|ARM64 24 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Debug|ARM64.Build.0 = Debug|ARM64 25 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Debug|ARM64.Deploy.0 = Debug|ARM64 26 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Debug|x64.ActiveCfg = Debug|x64 27 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Debug|x64.Build.0 = Debug|x64 28 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Debug|x64.Deploy.0 = Debug|x64 29 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Debug|x86.ActiveCfg = Debug|Win32 30 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Debug|x86.Build.0 = Debug|Win32 31 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Debug|x86.Deploy.0 = Debug|Win32 32 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Release|ARM.ActiveCfg = Release|ARM 33 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Release|ARM.Build.0 = Release|ARM 34 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Release|ARM.Deploy.0 = Release|ARM 35 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Release|ARM64.ActiveCfg = Release|ARM64 36 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Release|ARM64.Build.0 = Release|ARM64 37 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Release|ARM64.Deploy.0 = Release|ARM64 38 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Release|x64.ActiveCfg = Release|x64 39 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Release|x64.Build.0 = Release|x64 40 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Release|x64.Deploy.0 = Release|x64 41 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Release|x86.ActiveCfg = Release|Win32 42 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Release|x86.Build.0 = Release|Win32 43 | {C13FA071-EEB9-4325-811A-CF70B1553C95}.Release|x86.Deploy.0 = Release|Win32 44 | EndGlobalSection 45 | GlobalSection(SolutionProperties) = preSolution 46 | HideSolutionNode = FALSE 47 | EndGlobalSection 48 | GlobalSection(ExtensibilityGlobals) = postSolution 49 | SolutionGuid = {33867E0F-4417-4835-87FB-A83170AB4397} 50 | EndGlobalSection 51 | EndGlobal 52 | -------------------------------------------------------------------------------- /KillDriverProtect/Driver.c: -------------------------------------------------------------------------------- 1 | #include "KillFsFilter.h" 2 | #include "KillRegFilter.h" 3 | 4 | VOID DriverUnload(PDRIVER_OBJECT DriverObject) 5 | { 6 | } 7 | 8 | NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) 9 | { 10 | KillFsFilter(); 11 | 12 | KillRegFilter(); 13 | 14 | DriverObject->DriverUnload = DriverUnload; 15 | 16 | return STATUS_SUCCESS; 17 | } -------------------------------------------------------------------------------- /KillDriverProtect/Helper.c: -------------------------------------------------------------------------------- 1 | #include "Helper.h" 2 | 3 | VOID DisableFunctionWithReturnZero(PVOID Address, int retType) 4 | { 5 | KIRQL irql; 6 | CHAR* patchCode = (char *)ExAllocatePool(NonPagedPool, 5); 7 | int length; 8 | 9 | if (retType == 0) //ret 10 | { 11 | char* temp = "\x33\xC0\xC3"; 12 | length = 3; 13 | memmove(patchCode, temp, length); 14 | } 15 | else if (retType == 1) //ret c 16 | { 17 | char* temp = "\x33\xC0\xc2\x0c\x00"; 18 | length = 5; 19 | memmove(patchCode, temp, length); 20 | } 21 | else if (retType == 2) //ret 0x10 22 | { 23 | char* temp = "\x33\xC0\xc2\x10\x00"; 24 | length = 5; 25 | memmove(patchCode, temp, length); 26 | } 27 | 28 | if (MmIsAddressValid(Address)) 29 | { 30 | irql = WPOFF(); 31 | memmove(Address, patchCode, length); 32 | WPON(irql); 33 | } 34 | } 35 | 36 | VOID DisableFunctionWithReturnOne(PVOID Address, int retType) 37 | { 38 | KIRQL irql; 39 | CHAR* patchCode = (char *)ExAllocatePool(NonPagedPool, 8); 40 | int length; 41 | 42 | if (retType == 0) //ret 43 | { 44 | char* temp = "\xb8\x01\x00\x00\x00\xc3"; 45 | length = 6; 46 | memmove(patchCode, temp, length); 47 | } 48 | else if (retType == 1) //ret c 49 | { 50 | char* temp = "\xb8\x01\x00\x00\x00\xc2\x0c\x00"; 51 | length = 8; 52 | memmove(patchCode, temp, length); 53 | } 54 | else if (retType == 2) //ret 0x10 55 | { 56 | char* temp = "\xb8\x01\x00\x00\x00\xc2\x10\x00"; 57 | length = 8; 58 | memmove(patchCode, temp, length); 59 | } 60 | 61 | if (MmIsAddressValid(Address)) 62 | { 63 | irql = WPOFF(); 64 | memmove(Address, patchCode, length); 65 | WPON(irql); 66 | } 67 | } 68 | 69 | KIRQL WPOFF() 70 | { 71 | KIRQL irql = KeRaiseIrqlToDpcLevel(); 72 | #ifdef _WIN64 73 | UINT64 cr0 = __readcr0(); 74 | cr0 &= 0xfffffffffffeffff; 75 | # else 76 | UINT32 cr0 = __readcr0(); 77 | cr0 &= 0xFFFEFFFF; 78 | # endif 79 | __writecr0(cr0); 80 | _disable(); 81 | return irql; 82 | } 83 | 84 | void WPON(KIRQL irql) 85 | { 86 | #ifdef _WIN64 87 | UINT64 cr0 = __readcr0(); 88 | cr0 |= 0x10000; 89 | # else 90 | UINT32 cr0 = __readcr0(); 91 | cr0 |= (!0xFFFEFFFF); 92 | # endif 93 | _enable(); 94 | __writecr0(cr0); 95 | KeLowerIrql(irql); 96 | } 97 | -------------------------------------------------------------------------------- /KillDriverProtect/Helper.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | 4 | #define _LogMsg(lvl, lvlname, frmt, ...) \ 5 | DbgPrintEx(\ 6 | DPFLTR_IHVDRIVER_ID, \ 7 | lvl, \ 8 | "[" lvlname "] [irql:%Iu,pid:%Iu,tid:%Iu]\tKillDriverProtect!" __FUNCTION__ ": " frmt "\n", \ 9 | KeGetCurrentIrql(), \ 10 | PsGetCurrentProcessId(), \ 11 | PsGetCurrentThreadId(), \ 12 | __VA_ARGS__ \ 13 | ) 14 | 15 | #define LogError(frmt, ...) _LogMsg(DPFLTR_ERROR_LEVEL, "error", frmt, __VA_ARGS__) 16 | #define LogWarning(frmt, ...) _LogMsg(DPFLTR_WARNING_LEVEL, "warning", frmt, __VA_ARGS__) 17 | #define LogTrace(frmt, ...) _LogMsg(DPFLTR_TRACE_LEVEL, "trace", frmt, __VA_ARGS__) 18 | #define LogInfo(frmt, ...) _LogMsg(DPFLTR_INFO_LEVEL, "info", frmt, __VA_ARGS__) 19 | 20 | VOID DisableFunctionWithReturnZero(PVOID Address, int retType); 21 | VOID DisableFunctionWithReturnOne(PVOID Address, int retType); 22 | 23 | KIRQL WPOFF(); 24 | void WPON(KIRQL irql); 25 | 26 | -------------------------------------------------------------------------------- /KillDriverProtect/KillDriverProtect.inf: -------------------------------------------------------------------------------- 1 | ;;; 2 | ;;; KillDriverProtect 3 | ;;; 4 | 5 | [Version] 6 | Signature = "$Windows NT$" 7 | ; TODO - Change the Class and ClassGuid to match the Load Order Group value, see http://msdn.microsoft.com/en-us/windows/hardware/gg462963 8 | Class = "ActivityMonitor" ;This is determined by the work this filter driver does 9 | ClassGuid = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2} ;This value is determined by the Load Order Group value 10 | Provider = %ManufacturerName% 11 | DriverVer = 3/27/2016 12 | CatalogFile = KillDriverProtect.cat 13 | 14 | [DestinationDirs] 15 | DefaultDestDir = 12 16 | MiniFilter.DriverFiles = 12 ;%windir%\system32\drivers 17 | 18 | ;; 19 | ;; Default install sections 20 | ;; 21 | 22 | [DefaultInstall] 23 | OptionDesc = %ServiceDescription% 24 | CopyFiles = MiniFilter.DriverFiles 25 | 26 | [DefaultInstall.Services] 27 | AddService = %ServiceName%,,MiniFilter.Service 28 | 29 | ;; 30 | ;; Default uninstall sections 31 | ;; 32 | 33 | [DefaultUninstall] 34 | DelFiles = MiniFilter.DriverFiles 35 | 36 | [DefaultUninstall.Services] 37 | DelService = %ServiceName%,0x200 ;Ensure service is stopped before deleting 38 | 39 | ; 40 | ; Services Section 41 | ; 42 | 43 | [MiniFilter.Service] 44 | DisplayName = %ServiceName% 45 | Description = %ServiceDescription% 46 | ServiceBinary = %12%\%DriverName%.sys ;%windir%\system32\drivers\ 47 | Dependencies = "FltMgr" 48 | ServiceType = 2 ;SERVICE_FILE_SYSTEM_DRIVER 49 | StartType = 3 ;SERVICE_DEMAND_START 50 | ErrorControl = 1 ;SERVICE_ERROR_NORMAL 51 | ; TODO - Change the Load Order Group value, see http://connect.microsoft.com/site221/content/content.aspx?ContentID=2512 52 | LoadOrderGroup = "FSFilter Activity Monitor" 53 | ;LoadOrderGroup = "_TODO_Change_LoadOrderGroup_appropriately_" 54 | AddReg = MiniFilter.AddRegistry 55 | 56 | ; 57 | ; Registry Modifications 58 | ; 59 | 60 | [MiniFilter.AddRegistry] 61 | HKR,,"DebugFlags",0x00010001 ,0x0 62 | HKR,,"SupportedFeatures",0x00010001,0x3 63 | HKR,"Instances","DefaultInstance",0x00000000,%DefaultInstance% 64 | HKR,"Instances\"%Instance1.Name%,"Altitude",0x00000000,%Instance1.Altitude% 65 | HKR,"Instances\"%Instance1.Name%,"Flags",0x00010001,%Instance1.Flags% 66 | 67 | ; 68 | ; Copy Files 69 | ; 70 | 71 | [MiniFilter.DriverFiles] 72 | %DriverName%.sys 73 | 74 | [SourceDisksFiles] 75 | KillDriverProtect.sys = 1,, 76 | 77 | [SourceDisksNames] 78 | 1 = %DiskId1%,,, 79 | 80 | ;; 81 | ;; String Section 82 | ;; 83 | 84 | [Strings] 85 | ; TODO - Add your manufacturer 86 | ManufacturerName = "Template" 87 | ServiceDescription = "KillDriverProtect Kernel Driver" 88 | ServiceName = "KillDriverProtect" 89 | DriverName = "KillDriverProtect" 90 | DiskId1 = "KillDriverProtect Device Installation Disk" 91 | 92 | ;Instances specific information. 93 | DefaultInstance = "KillDriverProtect Instance" 94 | Instance1.Name = "KillDriverProtect Instance" 95 | ; TODO - Change the altitude value, see http://connect.microsoft.com/site221/content/content.aspx?ContentID=2512 96 | Instance1.Altitude = "370030" 97 | ;Instance.Altitude = "_TODO_Change_Altitude_appropriately_" 98 | Instance1.Flags = 0x0 ; Allow all attachments 99 | -------------------------------------------------------------------------------- /KillDriverProtect/KillDriverProtect.vcxproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | Debug 22 | ARM 23 | 24 | 25 | Release 26 | ARM 27 | 28 | 29 | Debug 30 | ARM64 31 | 32 | 33 | Release 34 | ARM64 35 | 36 | 37 | 38 | {C13FA071-EEB9-4325-811A-CF70B1553C95} 39 | {1bc93793-694f-48fe-9372-81e2b05556fd} 40 | v4.5 41 | 12.0 42 | Debug 43 | Win32 44 | KillDriverProtect 45 | 46 | 47 | 48 | Windows10 49 | true 50 | WindowsKernelModeDriver10.0 51 | Driver 52 | KMDF 53 | Universal 54 | 55 | 56 | Windows7 57 | false 58 | WindowsKernelModeDriver10.0 59 | Driver 60 | KMDF 61 | 62 | 63 | 64 | 65 | Windows10 66 | true 67 | WindowsKernelModeDriver10.0 68 | Driver 69 | KMDF 70 | Universal 71 | 72 | 73 | Windows7 74 | false 75 | WindowsKernelModeDriver10.0 76 | Driver 77 | KMDF 78 | 79 | 80 | 81 | 82 | Windows10 83 | true 84 | WindowsKernelModeDriver10.0 85 | Driver 86 | KMDF 87 | Universal 88 | 89 | 90 | Windows10 91 | false 92 | WindowsKernelModeDriver10.0 93 | Driver 94 | KMDF 95 | Universal 96 | 97 | 98 | Windows10 99 | true 100 | WindowsKernelModeDriver10.0 101 | Driver 102 | KMDF 103 | Universal 104 | 105 | 106 | Windows10 107 | false 108 | WindowsKernelModeDriver10.0 109 | Driver 110 | KMDF 111 | Universal 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | DbgengKernelDebugger 123 | 124 | 125 | DbgengKernelDebugger 126 | 127 | 128 | DbgengKernelDebugger 129 | 130 | 131 | DbgengKernelDebugger 132 | 133 | 134 | DbgengKernelDebugger 135 | 136 | 137 | DbgengKernelDebugger 138 | 139 | 140 | DbgengKernelDebugger 141 | 142 | 143 | DbgengKernelDebugger 144 | 145 | 146 | 147 | $(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies);$(KernelBufferOverflowLib);$(DDK_LIB_PATH)ntoskrnl.lib;$(DDK_LIB_PATH)hal.lib;$(DDK_LIB_PATH)wmilib.lib;$(KMDF_LIB_PATH)$(KMDF_VER_PATH)\WdfLdr.lib;$(KMDF_LIB_PATH)$(KMDF_VER_PATH)\WdfDriverEntry.lib 148 | 149 | 150 | false 151 | 152 | 153 | 154 | 155 | false 156 | 157 | 158 | $(DDK_LIB_PATH)\fltmgr.lib;%(AdditionalDependencies);$(KernelBufferOverflowLib);$(DDK_LIB_PATH)ntoskrnl.lib;$(DDK_LIB_PATH)hal.lib;$(DDK_LIB_PATH)wmilib.lib;$(KMDF_LIB_PATH)$(KMDF_VER_PATH)\WdfLdr.lib;$(KMDF_LIB_PATH)$(KMDF_VER_PATH)\WdfDriverEntry.lib 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 178 | 179 | 180 | 181 | -------------------------------------------------------------------------------- /KillDriverProtect/KillDriverProtect.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {8E41214B-6785-4CFE-B992-037D68949A14} 18 | inf;inv;inx;mof;mc; 19 | 20 | 21 | 22 | 23 | Driver Files 24 | 25 | 26 | 27 | 28 | Source Files 29 | 30 | 31 | Source Files 32 | 33 | 34 | Source Files 35 | 36 | 37 | Source Files 38 | 39 | 40 | 41 | 42 | Header Files 43 | 44 | 45 | Header Files 46 | 47 | 48 | Header Files 49 | 50 | 51 | -------------------------------------------------------------------------------- /KillDriverProtect/KillDriverProtect.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -------------------------------------------------------------------------------- /KillDriverProtect/KillFsFilter.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Neo-Maoku/KillDriverProtect/2ff86c4cb41d4a1ad00d17a74b014c0f8c026edb/KillDriverProtect/KillFsFilter.c -------------------------------------------------------------------------------- /KillDriverProtect/KillFsFilter.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | 5 | ULONG KillFsFilter(); 6 | 7 | -------------------------------------------------------------------------------- /KillDriverProtect/KillRegFilter.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Neo-Maoku/KillDriverProtect/2ff86c4cb41d4a1ad00d17a74b014c0f8c026edb/KillDriverProtect/KillRegFilter.c -------------------------------------------------------------------------------- /KillDriverProtect/KillRegFilter.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | 4 | ULONG KillRegFilter(); 5 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # KillDriverProtect 2 | 1. **关闭恶意驱动的文件和注册表保护** 3 | - 去除MINIFilter的IRP_MJ_CREATE的PRE回调,IRP_MJ_DIRECTORY_CONTROL的PRE和POST回调 4 | - 使用CmUnRegisterCallback去除注册表回调 5 | 2. **当前只在win7(x86，x64)，win10（x64）系统上测试过，且均测试成功** 6 | 3. **使用方法** 7 | - 拷贝KillDriverProtect.inf和KillDriverProtect.sys到目标机器 8 | - 使用禁用签名方式启动机器 9 | - 右击KillDriverProtect.inf，点安装 10 | - 已管理员权限启动cmd 11 | - 启动服务：**sc start KillDriverProtect** 12 | --------------------------------------------------------------------------------