rdtsc.pas

PhantOm,Ollydbg隐藏调试的辅助插件代码！

unit RDTSC;

interface

uses
  nt_status,
  ntoskrnl;

function _DriverEntry(DriverObject:PDriverObject;RegistryPath:PUnicodeString):NTSTATUS; stdcall;

implementation

var
  g_dwLogon : DWORD  = $BB40;

function  mg_Main( DriverObject:PDriverObject;RegistryPath:PUnicodeString ):NTSTATUS;
begin
  Result := 0;
end;

procedure DriverUnload(DriverObject:PDriverObject); stdcall;
begin

end;

function _DriverEntry(DriverObject:PDriverObject;RegistryPath:PUnicodeString):NTSTATUS; stdcall;
var
  count : DWORD;
begin
  if( ( g_dwLogon <> 0 ) or ( g_dwLogon = $BB40 ))then
  begin
   // count := KeTickCount.LowPart ^ ( g_dwLogon shr $08 );
   // g_dwLogon := KeTickCount.LowPart ^ ( g_dwLogon shr $08 );
  end;

  g_dwLogon := not count;
  //
  Result :=  mg_Main( DriverObject , RegistryPath );
 //设置驱动卸载函数:
 //DriverObject^.DriverUnload:=@DriverUnload;
 //Result:=STATUS_SUCCESS;
end;

end.